]> git.ipfire.org Git - thirdparty/grsecurity-scrape.git/blame - test/grsecurity-2.2.2-2.6.39-201105251736.patch
projects / thirdparty / grsecurity-scrape.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Auto commit, 1 new patch{es}.
[thirdparty/grsecurity-scrape.git] / test / grsecurity-2.2.2-2.6.39-201105251736.patch
CommitLineData
8c5734e2
PK		 1diff -urNp linux-2.6.39/arch/alpha/include/asm/dma-mapping.h linux-2.6.39/arch/alpha/include/asm/dma-mapping.h
2--- linux-2.6.39/arch/alpha/include/asm/dma-mapping.h 2011-05-19 00:06:34.000000000 -0400
3+++ linux-2.6.39/arch/alpha/include/asm/dma-mapping.h 2011-05-22 19:36:30.000000000 -0400
4@@ -3,9 +3,9 @@
5
6 #include <linux/dma-attrs.h>
7
8-extern struct dma_map_ops *dma_ops;
9+extern const struct dma_map_ops *dma_ops;
10
11-static inline struct dma_map_ops *get_dma_ops(struct device *dev)
12+static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
13 {
14 return dma_ops;
15 }
16diff -urNp linux-2.6.39/arch/alpha/include/asm/elf.h linux-2.6.39/arch/alpha/include/asm/elf.h
17--- linux-2.6.39/arch/alpha/include/asm/elf.h 2011-05-19 00:06:34.000000000 -0400
18+++ linux-2.6.39/arch/alpha/include/asm/elf.h 2011-05-22 19:36:30.000000000 -0400
19@@ -90,6 +90,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_N
20
21 #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE + 0x1000000)
22
23+#ifdef CONFIG_PAX_ASLR
24+#define PAX_ELF_ET_DYN_BASE (current->personality & ADDR_LIMIT_32BIT ? 0x10000 : 0x120000000UL)
25+
26+#define PAX_DELTA_MMAP_LEN (current->personality & ADDR_LIMIT_32BIT ? 14 : 28)
27+#define PAX_DELTA_STACK_LEN (current->personality & ADDR_LIMIT_32BIT ? 14 : 19)
28+#endif
29+
30 /* $0 is set by ld.so to a pointer to a function which might be
31 registered using atexit. This provides a mean for the dynamic
32 linker to call DT_FINI functions for shared libraries that have
33diff -urNp linux-2.6.39/arch/alpha/include/asm/pgtable.h linux-2.6.39/arch/alpha/include/asm/pgtable.h
34--- linux-2.6.39/arch/alpha/include/asm/pgtable.h 2011-05-19 00:06:34.000000000 -0400
35+++ linux-2.6.39/arch/alpha/include/asm/pgtable.h 2011-05-22 19:36:30.000000000 -0400
36@@ -101,6 +101,17 @@ struct vm_area_struct;
37 #define PAGE_SHARED __pgprot(_PAGE_VALID | __ACCESS_BITS)
38 #define PAGE_COPY __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW)
39 #define PAGE_READONLY __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW)
40+
41+#ifdef CONFIG_PAX_PAGEEXEC
42+# define PAGE_SHARED_NOEXEC __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOE)
43+# define PAGE_COPY_NOEXEC __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW | _PAGE_FOE)
44+# define PAGE_READONLY_NOEXEC __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW | _PAGE_FOE)
45+#else
46+# define PAGE_SHARED_NOEXEC PAGE_SHARED
47+# define PAGE_COPY_NOEXEC PAGE_COPY
48+# define PAGE_READONLY_NOEXEC PAGE_READONLY
49+#endif
50+
51 #define PAGE_KERNEL __pgprot(_PAGE_VALID | _PAGE_ASM | _PAGE_KRE | _PAGE_KWE)
52
53 #define _PAGE_NORMAL(x) __pgprot(_PAGE_VALID | __ACCESS_BITS | (x))
54diff -urNp linux-2.6.39/arch/alpha/kernel/core_apecs.c linux-2.6.39/arch/alpha/kernel/core_apecs.c
55--- linux-2.6.39/arch/alpha/kernel/core_apecs.c 2011-05-19 00:06:34.000000000 -0400
56+++ linux-2.6.39/arch/alpha/kernel/core_apecs.c 2011-05-22 19:36:30.000000000 -0400
57@@ -305,7 +305,7 @@ apecs_write_config(struct pci_bus *bus,
58 return PCIBIOS_SUCCESSFUL;
59 }
60
61-struct pci_ops apecs_pci_ops =
62+const struct pci_ops apecs_pci_ops =
63 {
64 .read = apecs_read_config,
65 .write = apecs_write_config,
66diff -urNp linux-2.6.39/arch/alpha/kernel/core_cia.c linux-2.6.39/arch/alpha/kernel/core_cia.c
67--- linux-2.6.39/arch/alpha/kernel/core_cia.c 2011-05-19 00:06:34.000000000 -0400
68+++ linux-2.6.39/arch/alpha/kernel/core_cia.c 2011-05-22 19:36:30.000000000 -0400
69@@ -239,7 +239,7 @@ cia_write_config(struct pci_bus *bus, un
70 return PCIBIOS_SUCCESSFUL;
71 }
72
73-struct pci_ops cia_pci_ops =
74+const struct pci_ops cia_pci_ops =
75 {
76 .read = cia_read_config,
77 .write = cia_write_config,
78diff -urNp linux-2.6.39/arch/alpha/kernel/core_irongate.c linux-2.6.39/arch/alpha/kernel/core_irongate.c
79--- linux-2.6.39/arch/alpha/kernel/core_irongate.c 2011-05-19 00:06:34.000000000 -0400
80+++ linux-2.6.39/arch/alpha/kernel/core_irongate.c 2011-05-22 19:36:30.000000000 -0400
81@@ -155,7 +155,7 @@ irongate_write_config(struct pci_bus *bu
82 return PCIBIOS_SUCCESSFUL;
83 }
84
85-struct pci_ops irongate_pci_ops =
86+const struct pci_ops irongate_pci_ops =
87 {
88 .read = irongate_read_config,
89 .write = irongate_write_config,
90diff -urNp linux-2.6.39/arch/alpha/kernel/core_lca.c linux-2.6.39/arch/alpha/kernel/core_lca.c
91--- linux-2.6.39/arch/alpha/kernel/core_lca.c 2011-05-19 00:06:34.000000000 -0400
92+++ linux-2.6.39/arch/alpha/kernel/core_lca.c 2011-05-22 19:36:30.000000000 -0400
93@@ -231,7 +231,7 @@ lca_write_config(struct pci_bus *bus, un
94 return PCIBIOS_SUCCESSFUL;
95 }
96
97-struct pci_ops lca_pci_ops =
98+const struct pci_ops lca_pci_ops =
99 {
100 .read = lca_read_config,
101 .write = lca_write_config,
102diff -urNp linux-2.6.39/arch/alpha/kernel/core_marvel.c linux-2.6.39/arch/alpha/kernel/core_marvel.c
103--- linux-2.6.39/arch/alpha/kernel/core_marvel.c 2011-05-19 00:06:34.000000000 -0400
104+++ linux-2.6.39/arch/alpha/kernel/core_marvel.c 2011-05-22 19:36:30.000000000 -0400
105@@ -588,7 +588,7 @@ marvel_write_config(struct pci_bus *bus,
106 return PCIBIOS_SUCCESSFUL;
107 }
108
109-struct pci_ops marvel_pci_ops =
110+const struct pci_ops marvel_pci_ops =
111 {
112 .read = marvel_read_config,
113 .write = marvel_write_config,
114diff -urNp linux-2.6.39/arch/alpha/kernel/core_mcpcia.c linux-2.6.39/arch/alpha/kernel/core_mcpcia.c
115--- linux-2.6.39/arch/alpha/kernel/core_mcpcia.c 2011-05-19 00:06:34.000000000 -0400
116+++ linux-2.6.39/arch/alpha/kernel/core_mcpcia.c 2011-05-22 19:36:30.000000000 -0400
117@@ -235,7 +235,7 @@ mcpcia_write_config(struct pci_bus *bus,
118 return PCIBIOS_SUCCESSFUL;
119 }
120
121-struct pci_ops mcpcia_pci_ops =
122+const struct pci_ops mcpcia_pci_ops =
123 {
124 .read = mcpcia_read_config,
125 .write = mcpcia_write_config,
126diff -urNp linux-2.6.39/arch/alpha/kernel/core_polaris.c linux-2.6.39/arch/alpha/kernel/core_polaris.c
127--- linux-2.6.39/arch/alpha/kernel/core_polaris.c 2011-05-19 00:06:34.000000000 -0400
128+++ linux-2.6.39/arch/alpha/kernel/core_polaris.c 2011-05-22 19:36:30.000000000 -0400
129@@ -136,7 +136,7 @@ polaris_write_config(struct pci_bus *bus
130 return PCIBIOS_SUCCESSFUL;
131 }
132
133-struct pci_ops polaris_pci_ops =
134+const struct pci_ops polaris_pci_ops =
135 {
136 .read = polaris_read_config,
137 .write = polaris_write_config,
138diff -urNp linux-2.6.39/arch/alpha/kernel/core_t2.c linux-2.6.39/arch/alpha/kernel/core_t2.c
139--- linux-2.6.39/arch/alpha/kernel/core_t2.c 2011-05-19 00:06:34.000000000 -0400
140+++ linux-2.6.39/arch/alpha/kernel/core_t2.c 2011-05-22 19:36:30.000000000 -0400
141@@ -314,7 +314,7 @@ t2_write_config(struct pci_bus *bus, uns
142 return PCIBIOS_SUCCESSFUL;
143 }
144
145-struct pci_ops t2_pci_ops =
146+const struct pci_ops t2_pci_ops =
147 {
148 .read = t2_read_config,
149 .write = t2_write_config,
150diff -urNp linux-2.6.39/arch/alpha/kernel/core_titan.c linux-2.6.39/arch/alpha/kernel/core_titan.c
151--- linux-2.6.39/arch/alpha/kernel/core_titan.c 2011-05-19 00:06:34.000000000 -0400
152+++ linux-2.6.39/arch/alpha/kernel/core_titan.c 2011-05-22 19:36:30.000000000 -0400
153@@ -191,7 +191,7 @@ titan_write_config(struct pci_bus *bus,
154 return PCIBIOS_SUCCESSFUL;
155 }
156
157-struct pci_ops titan_pci_ops =
158+const struct pci_ops titan_pci_ops =
159 {
160 .read = titan_read_config,
161 .write = titan_write_config,
162diff -urNp linux-2.6.39/arch/alpha/kernel/core_tsunami.c linux-2.6.39/arch/alpha/kernel/core_tsunami.c
163--- linux-2.6.39/arch/alpha/kernel/core_tsunami.c 2011-05-19 00:06:34.000000000 -0400
164+++ linux-2.6.39/arch/alpha/kernel/core_tsunami.c 2011-05-22 19:36:30.000000000 -0400
165@@ -166,7 +166,7 @@ tsunami_write_config(struct pci_bus *bus
166 return PCIBIOS_SUCCESSFUL;
167 }
168
169-struct pci_ops tsunami_pci_ops =
170+const struct pci_ops tsunami_pci_ops =
171 {
172 .read = tsunami_read_config,
173 .write = tsunami_write_config,
174diff -urNp linux-2.6.39/arch/alpha/kernel/core_wildfire.c linux-2.6.39/arch/alpha/kernel/core_wildfire.c
175--- linux-2.6.39/arch/alpha/kernel/core_wildfire.c 2011-05-19 00:06:34.000000000 -0400
176+++ linux-2.6.39/arch/alpha/kernel/core_wildfire.c 2011-05-22 19:36:30.000000000 -0400
177@@ -431,7 +431,7 @@ wildfire_write_config(struct pci_bus *bu
178 return PCIBIOS_SUCCESSFUL;
179 }
180
181-struct pci_ops wildfire_pci_ops =
182+const struct pci_ops wildfire_pci_ops =
183 {
184 .read = wildfire_read_config,
185 .write = wildfire_write_config,
186diff -urNp linux-2.6.39/arch/alpha/kernel/module.c linux-2.6.39/arch/alpha/kernel/module.c
187--- linux-2.6.39/arch/alpha/kernel/module.c 2011-05-19 00:06:34.000000000 -0400
188+++ linux-2.6.39/arch/alpha/kernel/module.c 2011-05-22 19:36:30.000000000 -0400
189@@ -182,7 +182,7 @@ apply_relocate_add(Elf64_Shdr *sechdrs,
190
191 /* The small sections were sorted to the end of the segment.
192 The following should definitely cover them. */
193- gp = (u64)me->module_core + me->core_size - 0x8000;
194+ gp = (u64)me->module_core_rw + me->core_size_rw - 0x8000;
195 got = sechdrs[me->arch.gotsecindex].sh_addr;
196
197 for (i = 0; i < n; i++) {
198diff -urNp linux-2.6.39/arch/alpha/kernel/osf_sys.c linux-2.6.39/arch/alpha/kernel/osf_sys.c
199--- linux-2.6.39/arch/alpha/kernel/osf_sys.c 2011-05-19 00:06:34.000000000 -0400
200+++ linux-2.6.39/arch/alpha/kernel/osf_sys.c 2011-05-22 19:36:30.000000000 -0400
201@@ -1142,7 +1142,7 @@ arch_get_unmapped_area_1(unsigned long a
202 /* At this point: (!vma || addr < vma->vm_end). */
203 if (limit - len < addr)
204 return -ENOMEM;
205- if (!vma || addr + len <= vma->vm_start)
206+ if (check_heap_stack_gap(vma, addr, len))
207 return addr;
208 addr = vma->vm_end;
209 vma = vma->vm_next;
210@@ -1178,6 +1178,10 @@ arch_get_unmapped_area(struct file *filp
211 merely specific addresses, but regions of memory -- perhaps
212 this feature should be incorporated into all ports? */
213
214+#ifdef CONFIG_PAX_RANDMMAP
215+ if (!(current->mm->pax_flags & MF_PAX_RANDMMAP))
216+#endif
217+
218 if (addr) {
219 addr = arch_get_unmapped_area_1 (PAGE_ALIGN(addr), len, limit);
220 if (addr != (unsigned long) -ENOMEM)
221@@ -1185,8 +1189,8 @@ arch_get_unmapped_area(struct file *filp
222 }
223
224 /* Next, try allocating at TASK_UNMAPPED_BASE. */
225- addr = arch_get_unmapped_area_1 (PAGE_ALIGN(TASK_UNMAPPED_BASE),
226- len, limit);
227+ addr = arch_get_unmapped_area_1 (PAGE_ALIGN(current->mm->mmap_base), len, limit);
228+
229 if (addr != (unsigned long) -ENOMEM)
230 return addr;
231
232diff -urNp linux-2.6.39/arch/alpha/kernel/pci_iommu.c linux-2.6.39/arch/alpha/kernel/pci_iommu.c
233--- linux-2.6.39/arch/alpha/kernel/pci_iommu.c 2011-05-19 00:06:34.000000000 -0400
234+++ linux-2.6.39/arch/alpha/kernel/pci_iommu.c 2011-05-22 19:36:30.000000000 -0400
235@@ -950,7 +950,7 @@ static int alpha_pci_set_mask(struct dev
236 return 0;
237 }
238
239-struct dma_map_ops alpha_pci_ops = {
240+const struct dma_map_ops alpha_pci_ops = {
241 .alloc_coherent = alpha_pci_alloc_coherent,
242 .free_coherent = alpha_pci_free_coherent,
243 .map_page = alpha_pci_map_page,
244@@ -962,5 +962,5 @@ struct dma_map_ops alpha_pci_ops = {
245 .set_dma_mask = alpha_pci_set_mask,
246 };
247
248-struct dma_map_ops *dma_ops = &alpha_pci_ops;
249+const struct dma_map_ops *dma_ops = &alpha_pci_ops;
250 EXPORT_SYMBOL(dma_ops);
251diff -urNp linux-2.6.39/arch/alpha/kernel/pci-noop.c linux-2.6.39/arch/alpha/kernel/pci-noop.c
252--- linux-2.6.39/arch/alpha/kernel/pci-noop.c 2011-05-19 00:06:34.000000000 -0400
253+++ linux-2.6.39/arch/alpha/kernel/pci-noop.c 2011-05-22 19:36:30.000000000 -0400
254@@ -173,7 +173,7 @@ static int alpha_noop_set_mask(struct de
255 return 0;
256 }
257
258-struct dma_map_ops alpha_noop_ops = {
259+const struct dma_map_ops alpha_noop_ops = {
260 .alloc_coherent = alpha_noop_alloc_coherent,
261 .free_coherent = alpha_noop_free_coherent,
262 .map_page = alpha_noop_map_page,
263@@ -183,7 +183,7 @@ struct dma_map_ops alpha_noop_ops = {
264 .set_dma_mask = alpha_noop_set_mask,
265 };
266
267-struct dma_map_ops *dma_ops = &alpha_noop_ops;
268+const struct dma_map_ops *dma_ops = &alpha_noop_ops;
269 EXPORT_SYMBOL(dma_ops);
270
271 void __iomem *pci_iomap(struct pci_dev *dev, int bar, unsigned long maxlen)
272diff -urNp linux-2.6.39/arch/alpha/kernel/proto.h linux-2.6.39/arch/alpha/kernel/proto.h
273--- linux-2.6.39/arch/alpha/kernel/proto.h 2011-05-19 00:06:34.000000000 -0400
274+++ linux-2.6.39/arch/alpha/kernel/proto.h 2011-05-22 19:36:30.000000000 -0400
275@@ -17,14 +17,14 @@ struct pci_dev;
276 struct pci_controller;
277
278 /* core_apecs.c */
279-extern struct pci_ops apecs_pci_ops;
280+extern const struct pci_ops apecs_pci_ops;
281 extern void apecs_init_arch(void);
282 extern void apecs_pci_clr_err(void);
283 extern void apecs_machine_check(unsigned long vector, unsigned long la_ptr);
284 extern void apecs_pci_tbi(struct pci_controller *, dma_addr_t, dma_addr_t);
285
286 /* core_cia.c */
287-extern struct pci_ops cia_pci_ops;
288+extern const struct pci_ops cia_pci_ops;
289 extern void cia_init_pci(void);
290 extern void cia_init_arch(void);
291 extern void pyxis_init_arch(void);
292@@ -33,19 +33,19 @@ extern void cia_machine_check(unsigned l
293 extern void cia_pci_tbi(struct pci_controller *, dma_addr_t, dma_addr_t);
294
295 /* core_irongate.c */
296-extern struct pci_ops irongate_pci_ops;
297+extern const struct pci_ops irongate_pci_ops;
298 extern int irongate_pci_clr_err(void);
299 extern void irongate_init_arch(void);
300 #define irongate_pci_tbi ((void *)0)
301
302 /* core_lca.c */
303-extern struct pci_ops lca_pci_ops;
304+extern const struct pci_ops lca_pci_ops;
305 extern void lca_init_arch(void);
306 extern void lca_machine_check(unsigned long vector, unsigned long la_ptr);
307 extern void lca_pci_tbi(struct pci_controller *, dma_addr_t, dma_addr_t);
308
309 /* core_marvel.c */
310-extern struct pci_ops marvel_pci_ops;
311+extern const struct pci_ops marvel_pci_ops;
312 extern void marvel_init_arch(void);
313 extern void marvel_kill_arch(int);
314 extern void marvel_machine_check(unsigned long, unsigned long);
315@@ -60,14 +60,14 @@ struct io7 *marvel_next_io7(struct io7 *
316 void io7_clear_errors(struct io7 *io7);
317
318 /* core_mcpcia.c */
319-extern struct pci_ops mcpcia_pci_ops;
320+extern const struct pci_ops mcpcia_pci_ops;
321 extern void mcpcia_init_arch(void);
322 extern void mcpcia_init_hoses(void);
323 extern void mcpcia_machine_check(unsigned long vector, unsigned long la_ptr);
324 extern void mcpcia_pci_tbi(struct pci_controller *, dma_addr_t, dma_addr_t);
325
326 /* core_polaris.c */
327-extern struct pci_ops polaris_pci_ops;
328+extern const struct pci_ops polaris_pci_ops;
329 extern int polaris_read_config_dword(struct pci_dev *, int, u32 *);
330 extern int polaris_write_config_dword(struct pci_dev *, int, u32);
331 extern void polaris_init_arch(void);
332@@ -75,14 +75,14 @@ extern void polaris_machine_check(unsign
333 #define polaris_pci_tbi ((void *)0)
334
335 /* core_t2.c */
336-extern struct pci_ops t2_pci_ops;
337+extern const struct pci_ops t2_pci_ops;
338 extern void t2_init_arch(void);
339 extern void t2_kill_arch(int);
340 extern void t2_machine_check(unsigned long vector, unsigned long la_ptr);
341 extern void t2_pci_tbi(struct pci_controller *, dma_addr_t, dma_addr_t);
342
343 /* core_titan.c */
344-extern struct pci_ops titan_pci_ops;
345+extern const struct pci_ops titan_pci_ops;
346 extern void titan_init_arch(void);
347 extern void titan_kill_arch(int);
348 extern void titan_machine_check(unsigned long, unsigned long);
349@@ -90,14 +90,14 @@ extern void titan_pci_tbi(struct pci_con
350 extern struct _alpha_agp_info *titan_agp_info(void);
351
352 /* core_tsunami.c */
353-extern struct pci_ops tsunami_pci_ops;
354+extern const struct pci_ops tsunami_pci_ops;
355 extern void tsunami_init_arch(void);
356 extern void tsunami_kill_arch(int);
357 extern void tsunami_machine_check(unsigned long vector, unsigned long la_ptr);
358 extern void tsunami_pci_tbi(struct pci_controller *, dma_addr_t, dma_addr_t);
359
360 /* core_wildfire.c */
361-extern struct pci_ops wildfire_pci_ops;
362+extern const struct pci_ops wildfire_pci_ops;
363 extern void wildfire_init_arch(void);
364 extern void wildfire_kill_arch(int);
365 extern void wildfire_machine_check(unsigned long vector, unsigned long la_ptr);
366diff -urNp linux-2.6.39/arch/alpha/mm/fault.c linux-2.6.39/arch/alpha/mm/fault.c
367--- linux-2.6.39/arch/alpha/mm/fault.c 2011-05-19 00:06:34.000000000 -0400
368+++ linux-2.6.39/arch/alpha/mm/fault.c 2011-05-22 19:36:30.000000000 -0400
369@@ -54,6 +54,124 @@ __load_new_mm_context(struct mm_struct *
370 __reload_thread(pcb);
371 }
372
373+#ifdef CONFIG_PAX_PAGEEXEC
374+/*
375+ * PaX: decide what to do with offenders (regs->pc = fault address)
376+ *
377+ * returns 1 when task should be killed
378+ * 2 when patched PLT trampoline was detected
379+ * 3 when unpatched PLT trampoline was detected
380+ */
381+static int pax_handle_fetch_fault(struct pt_regs *regs)
382+{
383+
384+#ifdef CONFIG_PAX_EMUPLT
385+ int err;
386+
387+ do { /* PaX: patched PLT emulation #1 */
388+ unsigned int ldah, ldq, jmp;
389+
390+ err = get_user(ldah, (unsigned int *)regs->pc);
391+ err |= get_user(ldq, (unsigned int *)(regs->pc+4));
392+ err |= get_user(jmp, (unsigned int *)(regs->pc+8));
393+
394+ if (err)
395+ break;
396+
397+ if ((ldah & 0xFFFF0000U) == 0x277B0000U &&
398+ (ldq & 0xFFFF0000U) == 0xA77B0000U &&
399+ jmp == 0x6BFB0000U)
400+ {
401+ unsigned long r27, addr;
402+ unsigned long addrh = (ldah | 0xFFFFFFFFFFFF0000UL) << 16;
403+ unsigned long addrl = ldq | 0xFFFFFFFFFFFF0000UL;
404+
405+ addr = regs->r27 + ((addrh ^ 0x80000000UL) + 0x80000000UL) + ((addrl ^ 0x8000UL) + 0x8000UL);
406+ err = get_user(r27, (unsigned long *)addr);
407+ if (err)
408+ break;
409+
410+ regs->r27 = r27;
411+ regs->pc = r27;
412+ return 2;
413+ }
414+ } while (0);
415+
416+ do { /* PaX: patched PLT emulation #2 */
417+ unsigned int ldah, lda, br;
418+
419+ err = get_user(ldah, (unsigned int *)regs->pc);
420+ err |= get_user(lda, (unsigned int *)(regs->pc+4));
421+ err |= get_user(br, (unsigned int *)(regs->pc+8));
422+
423+ if (err)
424+ break;
425+
426+ if ((ldah & 0xFFFF0000U) == 0x277B0000U &&
427+ (lda & 0xFFFF0000U) == 0xA77B0000U &&
428+ (br & 0xFFE00000U) == 0xC3E00000U)
429+ {
430+ unsigned long addr = br | 0xFFFFFFFFFFE00000UL;
431+ unsigned long addrh = (ldah | 0xFFFFFFFFFFFF0000UL) << 16;
432+ unsigned long addrl = lda | 0xFFFFFFFFFFFF0000UL;
433+
434+ regs->r27 += ((addrh ^ 0x80000000UL) + 0x80000000UL) + ((addrl ^ 0x8000UL) + 0x8000UL);
435+ regs->pc += 12 + (((addr ^ 0x00100000UL) + 0x00100000UL) << 2);
436+ return 2;
437+ }
438+ } while (0);
439+
440+ do { /* PaX: unpatched PLT emulation */
441+ unsigned int br;
442+
443+ err = get_user(br, (unsigned int *)regs->pc);
444+
445+ if (!err && (br & 0xFFE00000U) == 0xC3800000U) {
446+ unsigned int br2, ldq, nop, jmp;
447+ unsigned long addr = br | 0xFFFFFFFFFFE00000UL, resolver;
448+
449+ addr = regs->pc + 4 + (((addr ^ 0x00100000UL) + 0x00100000UL) << 2);
450+ err = get_user(br2, (unsigned int *)addr);
451+ err |= get_user(ldq, (unsigned int *)(addr+4));
452+ err |= get_user(nop, (unsigned int *)(addr+8));
453+ err |= get_user(jmp, (unsigned int *)(addr+12));
454+ err |= get_user(resolver, (unsigned long *)(addr+16));
455+
456+ if (err)
457+ break;
458+
459+ if (br2 == 0xC3600000U &&
460+ ldq == 0xA77B000CU &&
461+ nop == 0x47FF041FU &&
462+ jmp == 0x6B7B0000U)
463+ {
464+ regs->r28 = regs->pc+4;
465+ regs->r27 = addr+16;
466+ regs->pc = resolver;
467+ return 3;
468+ }
469+ }
470+ } while (0);
471+#endif
472+
473+ return 1;
474+}
475+
476+void pax_report_insns(void *pc, void *sp)
477+{
478+ unsigned long i;
479+
480+ printk(KERN_ERR "PAX: bytes at PC: ");
481+ for (i = 0; i < 5; i++) {
482+ unsigned int c;
483+ if (get_user(c, (unsigned int *)pc+i))
484+ printk(KERN_CONT "???????? ");
485+ else
486+ printk(KERN_CONT "%08x ", c);
487+ }
488+ printk("\n");
489+}
490+#endif
491
492 /*
493 * This routine handles page faults. It determines the address,
494@@ -131,8 +249,29 @@ do_page_fault(unsigned long address, uns
495 good_area:
496 si_code = SEGV_ACCERR;
497 if (cause < 0) {
498- if (!(vma->vm_flags & VM_EXEC))
499+ if (!(vma->vm_flags & VM_EXEC)) {
500+
501+#ifdef CONFIG_PAX_PAGEEXEC
502+ if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || address != regs->pc)
503+ goto bad_area;
504+
505+ up_read(&mm->mmap_sem);
506+ switch (pax_handle_fetch_fault(regs)) {
507+
508+#ifdef CONFIG_PAX_EMUPLT
509+ case 2:
510+ case 3:
511+ return;
512+#endif
513+
514+ }
515+ pax_report_fault(regs, (void *)regs->pc, (void *)rdusp());
516+ do_group_exit(SIGKILL);
517+#else
518 goto bad_area;
519+#endif
520+
521+ }
522 } else if (!cause) {
523 /* Allow reads even for write-only mappings */
524 if (!(vma->vm_flags & (VM_READ | VM_WRITE)))
525diff -urNp linux-2.6.39/arch/arm/common/it8152.c linux-2.6.39/arch/arm/common/it8152.c
526--- linux-2.6.39/arch/arm/common/it8152.c 2011-05-19 00:06:34.000000000 -0400
527+++ linux-2.6.39/arch/arm/common/it8152.c 2011-05-22 19:36:30.000000000 -0400
528@@ -221,7 +221,7 @@ static int it8152_pci_write_config(struc
529 return PCIBIOS_SUCCESSFUL;
530 }
531
532-static struct pci_ops it8152_ops = {
533+static const struct pci_ops it8152_ops = {
534 .read = it8152_pci_read_config,
535 .write = it8152_pci_write_config,
536 };
537diff -urNp linux-2.6.39/arch/arm/common/via82c505.c linux-2.6.39/arch/arm/common/via82c505.c
538--- linux-2.6.39/arch/arm/common/via82c505.c 2011-05-19 00:06:34.000000000 -0400
539+++ linux-2.6.39/arch/arm/common/via82c505.c 2011-05-22 19:36:30.000000000 -0400
540@@ -52,7 +52,7 @@ via82c505_write_config(struct pci_bus *b
541 return PCIBIOS_SUCCESSFUL;
542 }
543
544-static struct pci_ops via82c505_ops = {
545+static const struct pci_ops via82c505_ops = {
546 .read = via82c505_read_config,
547 .write = via82c505_write_config,
548 };
549diff -urNp linux-2.6.39/arch/arm/include/asm/cacheflush.h linux-2.6.39/arch/arm/include/asm/cacheflush.h
550--- linux-2.6.39/arch/arm/include/asm/cacheflush.h 2011-05-19 00:06:34.000000000 -0400
551+++ linux-2.6.39/arch/arm/include/asm/cacheflush.h 2011-05-22 19:36:30.000000000 -0400
552@@ -115,7 +115,7 @@ struct cpu_cache_fns {
553 */
554 #ifdef MULTI_CACHE
555
556-extern struct cpu_cache_fns cpu_cache;
557+extern const struct cpu_cache_fns cpu_cache;
558
559 #define __cpuc_flush_icache_all cpu_cache.flush_icache_all
560 #define __cpuc_flush_kern_all cpu_cache.flush_kern_all
561diff -urNp linux-2.6.39/arch/arm/include/asm/elf.h linux-2.6.39/arch/arm/include/asm/elf.h
562--- linux-2.6.39/arch/arm/include/asm/elf.h 2011-05-19 00:06:34.000000000 -0400
563+++ linux-2.6.39/arch/arm/include/asm/elf.h 2011-05-22 19:36:30.000000000 -0400
564@@ -115,7 +115,14 @@ int dump_task_regs(struct task_struct *t
565 the loader. We need to make sure that it is out of the way of the program
566 that it will "exec", and that there is sufficient room for the brk. */
567
568-#define ELF_ET_DYN_BASE (2 * TASK_SIZE / 3)
569+#define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
570+
571+#ifdef CONFIG_PAX_ASLR
572+#define PAX_ELF_ET_DYN_BASE 0x00008000UL
573+
574+#define PAX_DELTA_MMAP_LEN ((current->personality == PER_LINUX_32BIT) ? 16 : 10)
575+#define PAX_DELTA_STACK_LEN ((current->personality == PER_LINUX_32BIT) ? 16 : 10)
576+#endif
577
578 /* When the program starts, a1 contains a pointer to a function to be
579 registered with atexit, as per the SVR4 ABI. A value of 0 means we
580@@ -125,10 +132,6 @@ int dump_task_regs(struct task_struct *t
581 extern void elf_set_personality(const struct elf32_hdr *);
582 #define SET_PERSONALITY(ex) elf_set_personality(&(ex))
583
584-struct mm_struct;
585-extern unsigned long arch_randomize_brk(struct mm_struct *mm);
586-#define arch_randomize_brk arch_randomize_brk
587-
588 extern int vectors_user_mapping(void);
589 #define arch_setup_additional_pages(bprm, uses_interp) vectors_user_mapping()
590 #define ARCH_HAS_SETUP_ADDITIONAL_PAGES
591diff -urNp linux-2.6.39/arch/arm/include/asm/kmap_types.h linux-2.6.39/arch/arm/include/asm/kmap_types.h
592--- linux-2.6.39/arch/arm/include/asm/kmap_types.h 2011-05-19 00:06:34.000000000 -0400
593+++ linux-2.6.39/arch/arm/include/asm/kmap_types.h 2011-05-22 19:36:30.000000000 -0400
594@@ -21,6 +21,7 @@ enum km_type {
595 KM_L1_CACHE,
596 KM_L2_CACHE,
597 KM_KDB,
598+ KM_CLEARPAGE,
599 KM_TYPE_NR
600 };
601
602diff -urNp linux-2.6.39/arch/arm/include/asm/outercache.h linux-2.6.39/arch/arm/include/asm/outercache.h
603--- linux-2.6.39/arch/arm/include/asm/outercache.h 2011-05-19 00:06:34.000000000 -0400
604+++ linux-2.6.39/arch/arm/include/asm/outercache.h 2011-05-22 19:36:30.000000000 -0400
605@@ -38,7 +38,7 @@ struct outer_cache_fns {
606
607 #ifdef CONFIG_OUTER_CACHE
608
609-extern struct outer_cache_fns outer_cache;
610+extern const struct outer_cache_fns outer_cache;
611
612 static inline void outer_inv_range(phys_addr_t start, phys_addr_t end)
613 {
614diff -urNp linux-2.6.39/arch/arm/include/asm/page.h linux-2.6.39/arch/arm/include/asm/page.h
615--- linux-2.6.39/arch/arm/include/asm/page.h 2011-05-19 00:06:34.000000000 -0400
616+++ linux-2.6.39/arch/arm/include/asm/page.h 2011-05-22 19:36:30.000000000 -0400
617@@ -126,7 +126,7 @@ struct cpu_user_fns {
618 };
619
620 #ifdef MULTI_USER
621-extern struct cpu_user_fns cpu_user;
622+extern const struct cpu_user_fns cpu_user;
623
624 #define __cpu_clear_user_highpage cpu_user.cpu_clear_user_highpage
625 #define __cpu_copy_user_highpage cpu_user.cpu_copy_user_highpage
626diff -urNp linux-2.6.39/arch/arm/include/asm/uaccess.h linux-2.6.39/arch/arm/include/asm/uaccess.h
627--- linux-2.6.39/arch/arm/include/asm/uaccess.h 2011-05-19 00:06:34.000000000 -0400
628+++ linux-2.6.39/arch/arm/include/asm/uaccess.h 2011-05-22 19:36:30.000000000 -0400
629@@ -403,6 +403,9 @@ extern unsigned long __must_check __strn
630
631 static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
632 {
633+ if ((long)n < 0)
634+ return n;
635+
636 if (access_ok(VERIFY_READ, from, n))
637 n = __copy_from_user(to, from, n);
638 else /* security hole - plug it */
639@@ -412,6 +415,9 @@ static inline unsigned long __must_check
640
641 static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n)
642 {
643+ if ((long)n < 0)
644+ return n;
645+
646 if (access_ok(VERIFY_WRITE, to, n))
647 n = __copy_to_user(to, from, n);
648 return n;
649diff -urNp linux-2.6.39/arch/arm/kernel/kgdb.c linux-2.6.39/arch/arm/kernel/kgdb.c
650--- linux-2.6.39/arch/arm/kernel/kgdb.c 2011-05-19 00:06:34.000000000 -0400
651+++ linux-2.6.39/arch/arm/kernel/kgdb.c 2011-05-22 19:36:30.000000000 -0400
652@@ -246,7 +246,7 @@ void kgdb_arch_exit(void)
653 * and we handle the normal undef case within the do_undefinstr
654 * handler.
655 */
656-struct kgdb_arch arch_kgdb_ops = {
657+const struct kgdb_arch arch_kgdb_ops = {
658 #ifndef __ARMEB__
659 .gdb_bpt_instr = {0xfe, 0xde, 0xff, 0xe7}
660 #else /* ! __ARMEB__ */
661diff -urNp linux-2.6.39/arch/arm/kernel/process.c linux-2.6.39/arch/arm/kernel/process.c
662--- linux-2.6.39/arch/arm/kernel/process.c 2011-05-19 00:06:34.000000000 -0400
663+++ linux-2.6.39/arch/arm/kernel/process.c 2011-05-22 19:36:30.000000000 -0400
664@@ -28,7 +28,6 @@
665 #include <linux/tick.h>
666 #include <linux/utsname.h>
667 #include <linux/uaccess.h>
668-#include <linux/random.h>
669 #include <linux/hw_breakpoint.h>
670
671 #include <asm/cacheflush.h>
672@@ -479,12 +478,6 @@ unsigned long get_wchan(struct task_stru
673 return 0;
674 }
675
676-unsigned long arch_randomize_brk(struct mm_struct *mm)
677-{
678- unsigned long range_end = mm->brk + 0x02000000;
679- return randomize_range(mm->brk, range_end, 0) ? : mm->brk;
680-}
681-
682 #ifdef CONFIG_MMU
683 /*
684 * The vectors page is always readable from user space for the
685diff -urNp linux-2.6.39/arch/arm/mach-cns3xxx/pcie.c linux-2.6.39/arch/arm/mach-cns3xxx/pcie.c
686--- linux-2.6.39/arch/arm/mach-cns3xxx/pcie.c 2011-05-19 00:06:34.000000000 -0400
687+++ linux-2.6.39/arch/arm/mach-cns3xxx/pcie.c 2011-05-22 19:36:30.000000000 -0400
688@@ -162,7 +162,7 @@ static int cns3xxx_pci_setup(int nr, str
689 return 1;
690 }
691
692-static struct pci_ops cns3xxx_pcie_ops = {
693+static const struct pci_ops cns3xxx_pcie_ops = {
694 .read = cns3xxx_pci_read_config,
695 .write = cns3xxx_pci_write_config,
696 };
697diff -urNp linux-2.6.39/arch/arm/mach-dove/pcie.c linux-2.6.39/arch/arm/mach-dove/pcie.c
698--- linux-2.6.39/arch/arm/mach-dove/pcie.c 2011-05-19 00:06:34.000000000 -0400
699+++ linux-2.6.39/arch/arm/mach-dove/pcie.c 2011-05-22 19:36:30.000000000 -0400
700@@ -155,7 +155,7 @@ static int pcie_wr_conf(struct pci_bus *
701 return ret;
702 }
703
704-static struct pci_ops pcie_ops = {
705+static const struct pci_ops pcie_ops = {
706 .read = pcie_rd_conf,
707 .write = pcie_wr_conf,
708 };
709diff -urNp linux-2.6.39/arch/arm/mach-footbridge/dc21285.c linux-2.6.39/arch/arm/mach-footbridge/dc21285.c
710--- linux-2.6.39/arch/arm/mach-footbridge/dc21285.c 2011-05-19 00:06:34.000000000 -0400
711+++ linux-2.6.39/arch/arm/mach-footbridge/dc21285.c 2011-05-22 19:36:30.000000000 -0400
712@@ -129,7 +129,7 @@ dc21285_write_config(struct pci_bus *bus
713 return PCIBIOS_SUCCESSFUL;
714 }
715
716-static struct pci_ops dc21285_ops = {
717+static const struct pci_ops dc21285_ops = {
718 .read = dc21285_read_config,
719 .write = dc21285_write_config,
720 };
721diff -urNp linux-2.6.39/arch/arm/mach-integrator/pci_v3.c linux-2.6.39/arch/arm/mach-integrator/pci_v3.c
722--- linux-2.6.39/arch/arm/mach-integrator/pci_v3.c 2011-05-19 00:06:34.000000000 -0400
723+++ linux-2.6.39/arch/arm/mach-integrator/pci_v3.c 2011-05-22 19:36:30.000000000 -0400
724@@ -340,7 +340,7 @@ static int v3_write_config(struct pci_bu
725 return PCIBIOS_SUCCESSFUL;
726 }
727
728-static struct pci_ops pci_v3_ops = {
729+static const struct pci_ops pci_v3_ops = {
730 .read = v3_read_config,
731 .write = v3_write_config,
732 };
733diff -urNp linux-2.6.39/arch/arm/mach-iop13xx/pci.c linux-2.6.39/arch/arm/mach-iop13xx/pci.c
734--- linux-2.6.39/arch/arm/mach-iop13xx/pci.c 2011-05-19 00:06:34.000000000 -0400
735+++ linux-2.6.39/arch/arm/mach-iop13xx/pci.c 2011-05-22 19:36:30.000000000 -0400
736@@ -324,7 +324,7 @@ iop13xx_atux_write_config(struct pci_bus
737 return PCIBIOS_SUCCESSFUL;
738 }
739
740-static struct pci_ops iop13xx_atux_ops = {
741+static const struct pci_ops iop13xx_atux_ops = {
742 .read = iop13xx_atux_read_config,
743 .write = iop13xx_atux_write_config,
744 };
745@@ -471,7 +471,7 @@ iop13xx_atue_write_config(struct pci_bus
746 return PCIBIOS_SUCCESSFUL;
747 }
748
749-static struct pci_ops iop13xx_atue_ops = {
750+static const struct pci_ops iop13xx_atue_ops = {
751 .read = iop13xx_atue_read_config,
752 .write = iop13xx_atue_write_config,
753 };
754diff -urNp linux-2.6.39/arch/arm/mach-ixp2000/enp2611.c linux-2.6.39/arch/arm/mach-ixp2000/enp2611.c
755--- linux-2.6.39/arch/arm/mach-ixp2000/enp2611.c 2011-05-19 00:06:34.000000000 -0400
756+++ linux-2.6.39/arch/arm/mach-ixp2000/enp2611.c 2011-05-22 19:36:30.000000000 -0400
757@@ -137,7 +137,7 @@ static int enp2611_pci_write_config(stru
758 return PCIBIOS_DEVICE_NOT_FOUND;
759 }
760
761-static struct pci_ops enp2611_pci_ops = {
762+static const struct pci_ops enp2611_pci_ops = {
763 .read = enp2611_pci_read_config,
764 .write = enp2611_pci_write_config
765 };
766diff -urNp linux-2.6.39/arch/arm/mach-ixp2000/pci.c linux-2.6.39/arch/arm/mach-ixp2000/pci.c
767--- linux-2.6.39/arch/arm/mach-ixp2000/pci.c 2011-05-19 00:06:34.000000000 -0400
768+++ linux-2.6.39/arch/arm/mach-ixp2000/pci.c 2011-05-22 19:36:30.000000000 -0400
769@@ -125,7 +125,7 @@ int ixp2000_pci_write_config(struct pci_
770 }
771
772
773-static struct pci_ops ixp2000_pci_ops = {
774+static const struct pci_ops ixp2000_pci_ops = {
775 .read = ixp2000_pci_read_config,
776 .write = ixp2000_pci_write_config
777 };
778diff -urNp linux-2.6.39/arch/arm/mach-ixp23xx/pci.c linux-2.6.39/arch/arm/mach-ixp23xx/pci.c
779--- linux-2.6.39/arch/arm/mach-ixp23xx/pci.c 2011-05-19 00:06:34.000000000 -0400
780+++ linux-2.6.39/arch/arm/mach-ixp23xx/pci.c 2011-05-22 19:36:30.000000000 -0400
781@@ -136,7 +136,7 @@ static int ixp23xx_pci_write_config(stru
782 return PCIBIOS_SUCCESSFUL;
783 }
784
785-struct pci_ops ixp23xx_pci_ops = {
786+const struct pci_ops ixp23xx_pci_ops = {
787 .read = ixp23xx_pci_read_config,
788 .write = ixp23xx_pci_write_config,
789 };
790diff -urNp linux-2.6.39/arch/arm/mach-ixp4xx/common-pci.c linux-2.6.39/arch/arm/mach-ixp4xx/common-pci.c
791--- linux-2.6.39/arch/arm/mach-ixp4xx/common-pci.c 2011-05-19 00:06:34.000000000 -0400
792+++ linux-2.6.39/arch/arm/mach-ixp4xx/common-pci.c 2011-05-22 19:36:30.000000000 -0400
793@@ -283,7 +283,7 @@ static int ixp4xx_pci_write_config(struc
794 return PCIBIOS_SUCCESSFUL;
795 }
796
797-struct pci_ops ixp4xx_ops = {
798+const struct pci_ops ixp4xx_ops = {
799 .read = ixp4xx_pci_read_config,
800 .write = ixp4xx_pci_write_config,
801 };
802diff -urNp linux-2.6.39/arch/arm/mach-kirkwood/pcie.c linux-2.6.39/arch/arm/mach-kirkwood/pcie.c
803--- linux-2.6.39/arch/arm/mach-kirkwood/pcie.c 2011-05-19 00:06:34.000000000 -0400
804+++ linux-2.6.39/arch/arm/mach-kirkwood/pcie.c 2011-05-22 19:36:30.000000000 -0400
805@@ -111,7 +111,7 @@ static int pcie_wr_conf(struct pci_bus *
806 return ret;
807 }
808
809-static struct pci_ops pcie_ops = {
810+static const struct pci_ops pcie_ops = {
811 .read = pcie_rd_conf,
812 .write = pcie_wr_conf,
813 };
814diff -urNp linux-2.6.39/arch/arm/mach-ks8695/pci.c linux-2.6.39/arch/arm/mach-ks8695/pci.c
815--- linux-2.6.39/arch/arm/mach-ks8695/pci.c 2011-05-19 00:06:34.000000000 -0400
816+++ linux-2.6.39/arch/arm/mach-ks8695/pci.c 2011-05-22 19:36:30.000000000 -0400
817@@ -136,7 +136,7 @@ static void ks8695_local_writeconfig(int
818 __raw_writel(value, KS8695_PCI_VA + KS8695_PBCD);
819 }
820
821-static struct pci_ops ks8695_pci_ops = {
822+static const struct pci_ops ks8695_pci_ops = {
823 .read = ks8695_pci_readconfig,
824 .write = ks8695_pci_writeconfig,
825 };
826diff -urNp linux-2.6.39/arch/arm/mach-mmp/clock.c linux-2.6.39/arch/arm/mach-mmp/clock.c
827--- linux-2.6.39/arch/arm/mach-mmp/clock.c 2011-05-19 00:06:34.000000000 -0400
828+++ linux-2.6.39/arch/arm/mach-mmp/clock.c 2011-05-22 19:36:30.000000000 -0400
829@@ -29,7 +29,7 @@ static void apbc_clk_disable(struct clk
830 __raw_writel(0, clk->clk_rst);
831 }
832
833-struct clkops apbc_clk_ops = {
834+const struct clkops apbc_clk_ops = {
835 .enable = apbc_clk_enable,
836 .disable = apbc_clk_disable,
837 };
838@@ -44,7 +44,7 @@ static void apmu_clk_disable(struct clk
839 __raw_writel(0, clk->clk_rst);
840 }
841
842-struct clkops apmu_clk_ops = {
843+const struct clkops apmu_clk_ops = {
844 .enable = apmu_clk_enable,
845 .disable = apmu_clk_disable,
846 };
847diff -urNp linux-2.6.39/arch/arm/mach-msm/iommu.c linux-2.6.39/arch/arm/mach-msm/iommu.c
848--- linux-2.6.39/arch/arm/mach-msm/iommu.c 2011-05-19 00:06:34.000000000 -0400
849+++ linux-2.6.39/arch/arm/mach-msm/iommu.c 2011-05-22 19:36:30.000000000 -0400
850@@ -669,7 +669,7 @@ fail:
851 return 0;
852 }
853
854-static struct iommu_ops msm_iommu_ops = {
855+static const struct iommu_ops msm_iommu_ops = {
856 .domain_init = msm_iommu_domain_init,
857 .domain_destroy = msm_iommu_domain_destroy,
858 .attach_dev = msm_iommu_attach_dev,
859diff -urNp linux-2.6.39/arch/arm/mach-msm/last_radio_log.c linux-2.6.39/arch/arm/mach-msm/last_radio_log.c
860--- linux-2.6.39/arch/arm/mach-msm/last_radio_log.c 2011-05-19 00:06:34.000000000 -0400
861+++ linux-2.6.39/arch/arm/mach-msm/last_radio_log.c 2011-05-22 19:36:30.000000000 -0400
862@@ -48,6 +48,7 @@ static ssize_t last_radio_log_read(struc
863 }
864
865 static struct file_operations last_radio_log_fops = {
866+ /* cannot be const, see msm_init_last_radio_log */
867 .read = last_radio_log_read,
868 .llseek = default_llseek,
869 };
870diff -urNp linux-2.6.39/arch/arm/mach-mv78xx0/pcie.c linux-2.6.39/arch/arm/mach-mv78xx0/pcie.c
871--- linux-2.6.39/arch/arm/mach-mv78xx0/pcie.c 2011-05-19 00:06:34.000000000 -0400
872+++ linux-2.6.39/arch/arm/mach-mv78xx0/pcie.c 2011-05-22 19:36:30.000000000 -0400
873@@ -222,7 +222,7 @@ static int pcie_wr_conf(struct pci_bus *
874 return ret;
875 }
876
877-static struct pci_ops pcie_ops = {
878+static const struct pci_ops pcie_ops = {
879 .read = pcie_rd_conf,
880 .write = pcie_wr_conf,
881 };
882diff -urNp linux-2.6.39/arch/arm/mach-orion5x/pci.c linux-2.6.39/arch/arm/mach-orion5x/pci.c
883--- linux-2.6.39/arch/arm/mach-orion5x/pci.c 2011-05-19 00:06:34.000000000 -0400
884+++ linux-2.6.39/arch/arm/mach-orion5x/pci.c 2011-05-22 19:36:30.000000000 -0400
885@@ -130,7 +130,7 @@ static int pcie_wr_conf(struct pci_bus *
886 return ret;
887 }
888
889-static struct pci_ops pcie_ops = {
890+static const struct pci_ops pcie_ops = {
891 .read = pcie_rd_conf,
892 .write = pcie_wr_conf,
893 };
894@@ -368,7 +368,7 @@ static int orion5x_pci_wr_conf(struct pc
895 PCI_FUNC(devfn), where, size, val);
896 }
897
898-static struct pci_ops pci_ops = {
899+static const struct pci_ops pci_ops = {
900 .read = orion5x_pci_rd_conf,
901 .write = orion5x_pci_wr_conf,
902 };
903diff -urNp linux-2.6.39/arch/arm/mach-sa1100/pci-nanoengine.c linux-2.6.39/arch/arm/mach-sa1100/pci-nanoengine.c
904--- linux-2.6.39/arch/arm/mach-sa1100/pci-nanoengine.c 2011-05-19 00:06:34.000000000 -0400
905+++ linux-2.6.39/arch/arm/mach-sa1100/pci-nanoengine.c 2011-05-22 19:36:30.000000000 -0400
906@@ -117,7 +117,7 @@ static int nanoengine_write_config(struc
907 return PCIBIOS_SUCCESSFUL;
908 }
909
910-static struct pci_ops pci_nano_ops = {
911+static const struct pci_ops pci_nano_ops = {
912 .read = nanoengine_read_config,
913 .write = nanoengine_write_config,
914 };
915diff -urNp linux-2.6.39/arch/arm/mach-tegra/pcie.c linux-2.6.39/arch/arm/mach-tegra/pcie.c
916--- linux-2.6.39/arch/arm/mach-tegra/pcie.c 2011-05-19 00:06:34.000000000 -0400
917+++ linux-2.6.39/arch/arm/mach-tegra/pcie.c 2011-05-22 19:36:30.000000000 -0400
918@@ -336,7 +336,7 @@ static int tegra_pcie_write_conf(struct
919 return PCIBIOS_SUCCESSFUL;
920 }
921
922-static struct pci_ops tegra_pcie_ops = {
923+static const struct pci_ops tegra_pcie_ops = {
924 .read = tegra_pcie_read_conf,
925 .write = tegra_pcie_write_conf,
926 };
927diff -urNp linux-2.6.39/arch/arm/mach-ux500/mbox-db5500.c linux-2.6.39/arch/arm/mach-ux500/mbox-db5500.c
928--- linux-2.6.39/arch/arm/mach-ux500/mbox-db5500.c 2011-05-19 00:06:34.000000000 -0400
929+++ linux-2.6.39/arch/arm/mach-ux500/mbox-db5500.c 2011-05-22 19:41:32.000000000 -0400
930@@ -168,7 +168,7 @@ static ssize_t mbox_read_fifo(struct dev
931 return sprintf(buf, "0x%X\n", mbox_value);
932 }
933
934-static DEVICE_ATTR(fifo, S_IWUGO | S_IRUGO, mbox_read_fifo, mbox_write_fifo);
935+static DEVICE_ATTR(fifo, S_IWUSR | S_IRUGO, mbox_read_fifo, mbox_write_fifo);
936
937 static int mbox_show(struct seq_file *s, void *data)
938 {
939diff -urNp linux-2.6.39/arch/arm/mach-versatile/pci.c linux-2.6.39/arch/arm/mach-versatile/pci.c
940--- linux-2.6.39/arch/arm/mach-versatile/pci.c 2011-05-19 00:06:34.000000000 -0400
941+++ linux-2.6.39/arch/arm/mach-versatile/pci.c 2011-05-22 19:36:30.000000000 -0400
942@@ -165,7 +165,7 @@ static int versatile_write_config(struct
943 return PCIBIOS_SUCCESSFUL;
944 }
945
946-static struct pci_ops pci_versatile_ops = {
947+static const struct pci_ops pci_versatile_ops = {
948 .read = versatile_read_config,
949 .write = versatile_write_config,
950 };
951diff -urNp linux-2.6.39/arch/arm/mm/fault.c linux-2.6.39/arch/arm/mm/fault.c
952--- linux-2.6.39/arch/arm/mm/fault.c 2011-05-19 00:06:34.000000000 -0400
953+++ linux-2.6.39/arch/arm/mm/fault.c 2011-05-22 19:36:30.000000000 -0400
954@@ -182,6 +182,13 @@ __do_user_fault(struct task_struct *tsk,
955 }
956 #endif
957
958+#ifdef CONFIG_PAX_PAGEEXEC
959+ if (fsr & FSR_LNX_PF) {
960+ pax_report_fault(regs, (void *)regs->ARM_pc, (void *)regs->ARM_sp);
961+ do_group_exit(SIGKILL);
962+ }
963+#endif
964+
965 tsk->thread.address = addr;
966 tsk->thread.error_code = fsr;
967 tsk->thread.trap_no = 14;
968@@ -379,6 +386,33 @@ do_page_fault(unsigned long addr, unsign
969 }
970 #endif /* CONFIG_MMU */
971
972+#ifdef CONFIG_PAX_PAGEEXEC
973+void pax_report_insns(void *pc, void *sp)
974+{
975+ long i;
976+
977+ printk(KERN_ERR "PAX: bytes at PC: ");
978+ for (i = 0; i < 20; i++) {
979+ unsigned char c;
980+ if (get_user(c, (__force unsigned char __user *)pc+i))
981+ printk(KERN_CONT "?? ");
982+ else
983+ printk(KERN_CONT "%02x ", c);
984+ }
985+ printk("\n");
986+
987+ printk(KERN_ERR "PAX: bytes at SP-4: ");
988+ for (i = -1; i < 20; i++) {
989+ unsigned long c;
990+ if (get_user(c, (__force unsigned long __user *)sp+i))
991+ printk(KERN_CONT "???????? ");
992+ else
993+ printk(KERN_CONT "%08lx ", c);
994+ }
995+ printk("\n");
996+}
997+#endif
998+
999 /*
1000 * First Level Translation Fault Handler
1001 *
1002diff -urNp linux-2.6.39/arch/arm/mm/mmap.c linux-2.6.39/arch/arm/mm/mmap.c
1003--- linux-2.6.39/arch/arm/mm/mmap.c 2011-05-19 00:06:34.000000000 -0400
1004+++ linux-2.6.39/arch/arm/mm/mmap.c 2011-05-22 19:36:30.000000000 -0400
1005@@ -65,6 +65,10 @@ arch_get_unmapped_area(struct file *filp
1006 if (len > TASK_SIZE)
1007 return -ENOMEM;
1008
1009+#ifdef CONFIG_PAX_RANDMMAP
1010+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
1011+#endif
1012+
1013 if (addr) {
1014 if (do_align)
1015 addr = COLOUR_ALIGN(addr, pgoff);
1016@@ -72,15 +76,14 @@ arch_get_unmapped_area(struct file *filp
1017 addr = PAGE_ALIGN(addr);
1018
1019 vma = find_vma(mm, addr);
1020- if (TASK_SIZE - len >= addr &&
1021- (!vma || addr + len <= vma->vm_start))
1022+ if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len))
1023 return addr;
1024 }
1025 if (len > mm->cached_hole_size) {
1026- start_addr = addr = mm->free_area_cache;
1027+ start_addr = addr = mm->free_area_cache;
1028 } else {
1029- start_addr = addr = TASK_UNMAPPED_BASE;
1030- mm->cached_hole_size = 0;
1031+ start_addr = addr = mm->mmap_base;
1032+ mm->cached_hole_size = 0;
1033 }
1034 /* 8 bits of randomness in 20 address space bits */
1035 if ((current->flags & PF_RANDOMIZE) &&
1036@@ -100,14 +103,14 @@ full_search:
1037 * Start a new search - just in case we missed
1038 * some holes.
1039 */
1040- if (start_addr != TASK_UNMAPPED_BASE) {
1041- start_addr = addr = TASK_UNMAPPED_BASE;
1042+ if (start_addr != mm->mmap_base) {
1043+ start_addr = addr = mm->mmap_base;
1044 mm->cached_hole_size = 0;
1045 goto full_search;
1046 }
1047 return -ENOMEM;
1048 }
1049- if (!vma || addr + len <= vma->vm_start) {
1050+ if (check_heap_stack_gap(vma, addr, len)) {
1051 /*
1052 * Remember the place where we stopped the search:
1053 */
1054diff -urNp linux-2.6.39/arch/arm/plat-iop/pci.c linux-2.6.39/arch/arm/plat-iop/pci.c
1055--- linux-2.6.39/arch/arm/plat-iop/pci.c 2011-05-19 00:06:34.000000000 -0400
1056+++ linux-2.6.39/arch/arm/plat-iop/pci.c 2011-05-22 19:36:30.000000000 -0400
1057@@ -161,7 +161,7 @@ iop3xx_write_config(struct pci_bus *bus,
1058 return PCIBIOS_SUCCESSFUL;
1059 }
1060
1061-static struct pci_ops iop3xx_ops = {
1062+static const struct pci_ops iop3xx_ops = {
1063 .read = iop3xx_read_config,
1064 .write = iop3xx_write_config,
1065 };
1066diff -urNp linux-2.6.39/arch/avr32/include/asm/elf.h linux-2.6.39/arch/avr32/include/asm/elf.h
1067--- linux-2.6.39/arch/avr32/include/asm/elf.h 2011-05-19 00:06:34.000000000 -0400
1068+++ linux-2.6.39/arch/avr32/include/asm/elf.h 2011-05-22 19:36:30.000000000 -0400
1069@@ -84,8 +84,14 @@ typedef struct user_fpu_struct elf_fpreg
1070 the loader. We need to make sure that it is out of the way of the program
1071 that it will "exec", and that there is sufficient room for the brk. */
1072
1073-#define ELF_ET_DYN_BASE (2 * TASK_SIZE / 3)
1074+#define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
1075
1076+#ifdef CONFIG_PAX_ASLR
1077+#define PAX_ELF_ET_DYN_BASE 0x00001000UL
1078+
1079+#define PAX_DELTA_MMAP_LEN 15
1080+#define PAX_DELTA_STACK_LEN 15
1081+#endif
1082
1083 /* This yields a mask that user programs can use to figure out what
1084 instruction set this CPU supports. This could be done in user space,
1085diff -urNp linux-2.6.39/arch/avr32/include/asm/kmap_types.h linux-2.6.39/arch/avr32/include/asm/kmap_types.h
1086--- linux-2.6.39/arch/avr32/include/asm/kmap_types.h 2011-05-19 00:06:34.000000000 -0400
1087+++ linux-2.6.39/arch/avr32/include/asm/kmap_types.h 2011-05-22 19:36:30.000000000 -0400
1088@@ -22,7 +22,8 @@ D(10) KM_IRQ0,
1089 D(11) KM_IRQ1,
1090 D(12) KM_SOFTIRQ0,
1091 D(13) KM_SOFTIRQ1,
1092-D(14) KM_TYPE_NR
1093+D(14) KM_CLEARPAGE,
1094+D(15) KM_TYPE_NR
1095 };
1096
1097 #undef D
1098diff -urNp linux-2.6.39/arch/avr32/mm/fault.c linux-2.6.39/arch/avr32/mm/fault.c
1099--- linux-2.6.39/arch/avr32/mm/fault.c 2011-05-19 00:06:34.000000000 -0400
1100+++ linux-2.6.39/arch/avr32/mm/fault.c 2011-05-22 19:36:30.000000000 -0400
1101@@ -41,6 +41,23 @@ static inline int notify_page_fault(stru
1102
1103 int exception_trace = 1;
1104
1105+#ifdef CONFIG_PAX_PAGEEXEC
1106+void pax_report_insns(void *pc, void *sp)
1107+{
1108+ unsigned long i;
1109+
1110+ printk(KERN_ERR "PAX: bytes at PC: ");
1111+ for (i = 0; i < 20; i++) {
1112+ unsigned char c;
1113+ if (get_user(c, (unsigned char *)pc+i))
1114+ printk(KERN_CONT "???????? ");
1115+ else
1116+ printk(KERN_CONT "%02x ", c);
1117+ }
1118+ printk("\n");
1119+}
1120+#endif
1121+
1122 /*
1123 * This routine handles page faults. It determines the address and the
1124 * problem, and then passes it off to one of the appropriate routines.
1125@@ -156,6 +173,16 @@ bad_area:
1126 up_read(&mm->mmap_sem);
1127
1128 if (user_mode(regs)) {
1129+
1130+#ifdef CONFIG_PAX_PAGEEXEC
1131+ if (mm->pax_flags & MF_PAX_PAGEEXEC) {
1132+ if (ecr == ECR_PROTECTION_X || ecr == ECR_TLB_MISS_X) {
1133+ pax_report_fault(regs, (void *)regs->pc, (void *)regs->sp);
1134+ do_group_exit(SIGKILL);
1135+ }
1136+ }
1137+#endif
1138+
1139 if (exception_trace && printk_ratelimit())
1140 printk("%s%s[%d]: segfault at %08lx pc %08lx "
1141 "sp %08lx ecr %lu\n",
1142diff -urNp linux-2.6.39/arch/blackfin/kernel/kgdb.c linux-2.6.39/arch/blackfin/kernel/kgdb.c
1143--- linux-2.6.39/arch/blackfin/kernel/kgdb.c 2011-05-19 00:06:34.000000000 -0400
1144+++ linux-2.6.39/arch/blackfin/kernel/kgdb.c 2011-05-22 19:36:30.000000000 -0400
1145@@ -420,7 +420,7 @@ int kgdb_arch_handle_exception(int vecto
1146 return -1; /* this means that we do not want to exit from the handler */
1147 }
1148
1149-struct kgdb_arch arch_kgdb_ops = {
1150+const struct kgdb_arch arch_kgdb_ops = {
1151 .gdb_bpt_instr = {0xa1},
1152 .flags = KGDB_HW_BREAKPOINT,
1153 .set_hw_breakpoint = bfin_set_hw_break,
1154diff -urNp linux-2.6.39/arch/blackfin/mm/maccess.c linux-2.6.39/arch/blackfin/mm/maccess.c
1155--- linux-2.6.39/arch/blackfin/mm/maccess.c 2011-05-19 00:06:34.000000000 -0400
1156+++ linux-2.6.39/arch/blackfin/mm/maccess.c 2011-05-22 19:36:30.000000000 -0400
1157@@ -16,7 +16,7 @@ static int validate_memory_access_addres
1158 return bfin_mem_access_type(addr, size);
1159 }
1160
1161-long probe_kernel_read(void *dst, void *src, size_t size)
1162+long probe_kernel_read(void *dst, const void *src, size_t size)
1163 {
1164 unsigned long lsrc = (unsigned long)src;
1165 int mem_type;
1166@@ -55,7 +55,7 @@ long probe_kernel_read(void *dst, void *
1167 return -EFAULT;
1168 }
1169
1170-long probe_kernel_write(void *dst, void *src, size_t size)
1171+long probe_kernel_write(void *dst, const void *src, size_t size)
1172 {
1173 unsigned long ldst = (unsigned long)dst;
1174 int mem_type;
1175diff -urNp linux-2.6.39/arch/frv/include/asm/kmap_types.h linux-2.6.39/arch/frv/include/asm/kmap_types.h
1176--- linux-2.6.39/arch/frv/include/asm/kmap_types.h 2011-05-19 00:06:34.000000000 -0400
1177+++ linux-2.6.39/arch/frv/include/asm/kmap_types.h 2011-05-22 19:36:30.000000000 -0400
1178@@ -23,6 +23,7 @@ enum km_type {
1179 KM_IRQ1,
1180 KM_SOFTIRQ0,
1181 KM_SOFTIRQ1,
1182+ KM_CLEARPAGE,
1183 KM_TYPE_NR
1184 };
1185
1186diff -urNp linux-2.6.39/arch/frv/mb93090-mb00/pci-frv.h linux-2.6.39/arch/frv/mb93090-mb00/pci-frv.h
1187--- linux-2.6.39/arch/frv/mb93090-mb00/pci-frv.h 2011-05-19 00:06:34.000000000 -0400
1188+++ linux-2.6.39/arch/frv/mb93090-mb00/pci-frv.h 2011-05-22 19:36:30.000000000 -0400
1189@@ -34,7 +34,7 @@ void pcibios_resource_survey(void);
1190
1191 extern int __nongpreldata pcibios_last_bus;
1192 extern struct pci_bus *__nongpreldata pci_root_bus;
1193-extern struct pci_ops *__nongpreldata pci_root_ops;
1194+extern const struct pci_ops *__nongpreldata pci_root_ops;
1195
1196 /* pci-irq.c */
1197 extern unsigned int pcibios_irq_mask;
1198diff -urNp linux-2.6.39/arch/frv/mb93090-mb00/pci-vdk.c linux-2.6.39/arch/frv/mb93090-mb00/pci-vdk.c
1199--- linux-2.6.39/arch/frv/mb93090-mb00/pci-vdk.c 2011-05-19 00:06:34.000000000 -0400
1200+++ linux-2.6.39/arch/frv/mb93090-mb00/pci-vdk.c 2011-05-22 19:36:30.000000000 -0400
1201@@ -27,7 +27,7 @@ unsigned int __nongpreldata pci_probe =
1202
1203 int __nongpreldata pcibios_last_bus = -1;
1204 struct pci_bus *__nongpreldata pci_root_bus;
1205-struct pci_ops *__nongpreldata pci_root_ops;
1206+const struct pci_ops *__nongpreldata pci_root_ops;
1207
1208 /*
1209 * The accessible PCI window does not cover the entire CPU address space, but
1210@@ -169,7 +169,7 @@ static int pci_frv_write_config(struct p
1211 return PCIBIOS_SUCCESSFUL;
1212 }
1213
1214-static struct pci_ops pci_direct_frv = {
1215+static const struct pci_ops pci_direct_frv = {
1216 pci_frv_read_config,
1217 pci_frv_write_config,
1218 };
1219@@ -356,7 +356,7 @@ void __init pcibios_fixup_bus(struct pci
1220
1221 int __init pcibios_init(void)
1222 {
1223- struct pci_ops *dir = NULL;
1224+ const struct pci_ops *dir = NULL;
1225
1226 if (!mb93090_mb00_detected)
1227 return -ENXIO;
1228diff -urNp linux-2.6.39/arch/frv/mm/elf-fdpic.c linux-2.6.39/arch/frv/mm/elf-fdpic.c
1229--- linux-2.6.39/arch/frv/mm/elf-fdpic.c 2011-05-19 00:06:34.000000000 -0400
1230+++ linux-2.6.39/arch/frv/mm/elf-fdpic.c 2011-05-22 19:36:30.000000000 -0400
1231@@ -73,8 +73,7 @@ unsigned long arch_get_unmapped_area(str
1232 if (addr) {
1233 addr = PAGE_ALIGN(addr);
1234 vma = find_vma(current->mm, addr);
1235- if (TASK_SIZE - len >= addr &&
1236- (!vma || addr + len <= vma->vm_start))
1237+ if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len))
1238 goto success;
1239 }
1240
1241@@ -89,7 +88,7 @@ unsigned long arch_get_unmapped_area(str
1242 for (; vma; vma = vma->vm_next) {
1243 if (addr > limit)
1244 break;
1245- if (addr + len <= vma->vm_start)
1246+ if (check_heap_stack_gap(vma, addr, len))
1247 goto success;
1248 addr = vma->vm_end;
1249 }
1250@@ -104,7 +103,7 @@ unsigned long arch_get_unmapped_area(str
1251 for (; vma; vma = vma->vm_next) {
1252 if (addr > limit)
1253 break;
1254- if (addr + len <= vma->vm_start)
1255+ if (check_heap_stack_gap(vma, addr, len))
1256 goto success;
1257 addr = vma->vm_end;
1258 }
1259diff -urNp linux-2.6.39/arch/ia64/hp/common/hwsw_iommu.c linux-2.6.39/arch/ia64/hp/common/hwsw_iommu.c
1260--- linux-2.6.39/arch/ia64/hp/common/hwsw_iommu.c 2011-05-19 00:06:34.000000000 -0400
1261+++ linux-2.6.39/arch/ia64/hp/common/hwsw_iommu.c 2011-05-22 19:36:30.000000000 -0400
1262@@ -17,7 +17,7 @@
1263 #include <linux/swiotlb.h>
1264 #include <asm/machvec.h>
1265
1266-extern struct dma_map_ops sba_dma_ops, swiotlb_dma_ops;
1267+extern const struct dma_map_ops sba_dma_ops, swiotlb_dma_ops;
1268
1269 /* swiotlb declarations & definitions: */
1270 extern int swiotlb_late_init_with_default_size (size_t size);
1271@@ -33,7 +33,7 @@ static inline int use_swiotlb(struct dev
1272 !sba_dma_ops.dma_supported(dev, *dev->dma_mask);
1273 }
1274
1275-struct dma_map_ops *hwsw_dma_get_ops(struct device *dev)
1276+const struct dma_map_ops *hwsw_dma_get_ops(struct device *dev)
1277 {
1278 if (use_swiotlb(dev))
1279 return &swiotlb_dma_ops;
1280diff -urNp linux-2.6.39/arch/ia64/hp/common/sba_iommu.c linux-2.6.39/arch/ia64/hp/common/sba_iommu.c
1281--- linux-2.6.39/arch/ia64/hp/common/sba_iommu.c 2011-05-19 00:06:34.000000000 -0400
1282+++ linux-2.6.39/arch/ia64/hp/common/sba_iommu.c 2011-05-22 19:36:30.000000000 -0400
1283@@ -2097,7 +2097,7 @@ static struct acpi_driver acpi_sba_ioc_d
1284 },
1285 };
1286
1287-extern struct dma_map_ops swiotlb_dma_ops;
1288+extern const struct dma_map_ops swiotlb_dma_ops;
1289
1290 static int __init
1291 sba_init(void)
1292@@ -2211,7 +2211,7 @@ sba_page_override(char *str)
1293
1294 __setup("sbapagesize=",sba_page_override);
1295
1296-struct dma_map_ops sba_dma_ops = {
1297+const struct dma_map_ops sba_dma_ops = {
1298 .alloc_coherent = sba_alloc_coherent,
1299 .free_coherent = sba_free_coherent,
1300 .map_page = sba_map_page,
1301diff -urNp linux-2.6.39/arch/ia64/include/asm/dma-mapping.h linux-2.6.39/arch/ia64/include/asm/dma-mapping.h
1302--- linux-2.6.39/arch/ia64/include/asm/dma-mapping.h 2011-05-19 00:06:34.000000000 -0400
1303+++ linux-2.6.39/arch/ia64/include/asm/dma-mapping.h 2011-05-22 19:36:30.000000000 -0400
1304@@ -14,7 +14,7 @@
1305
1306 #define DMA_ERROR_CODE 0
1307
1308-extern struct dma_map_ops *dma_ops;
1309+extern const struct dma_map_ops *dma_ops;
1310 extern struct ia64_machine_vector ia64_mv;
1311 extern void set_iommu_machvec(void);
1312
1313@@ -26,7 +26,7 @@ extern void machvec_dma_sync_sg(struct d
1314 static inline void *dma_alloc_coherent(struct device *dev, size_t size,
1315 dma_addr_t *daddr, gfp_t gfp)
1316 {
1317- struct dma_map_ops *ops = platform_dma_get_ops(dev);
1318+ const struct dma_map_ops *ops = platform_dma_get_ops(dev);
1319 void *caddr;
1320
1321 caddr = ops->alloc_coherent(dev, size, daddr, gfp);
1322@@ -37,7 +37,7 @@ static inline void *dma_alloc_coherent(s
1323 static inline void dma_free_coherent(struct device *dev, size_t size,
1324 void *caddr, dma_addr_t daddr)
1325 {
1326- struct dma_map_ops *ops = platform_dma_get_ops(dev);
1327+ const struct dma_map_ops *ops = platform_dma_get_ops(dev);
1328 debug_dma_free_coherent(dev, size, caddr, daddr);
1329 ops->free_coherent(dev, size, caddr, daddr);
1330 }
1331@@ -51,13 +51,13 @@ static inline void dma_free_coherent(str
1332
1333 static inline int dma_mapping_error(struct device *dev, dma_addr_t daddr)
1334 {
1335- struct dma_map_ops *ops = platform_dma_get_ops(dev);
1336+ const struct dma_map_ops *ops = platform_dma_get_ops(dev);
1337 return ops->mapping_error(dev, daddr);
1338 }
1339
1340 static inline int dma_supported(struct device *dev, u64 mask)
1341 {
1342- struct dma_map_ops *ops = platform_dma_get_ops(dev);
1343+ const struct dma_map_ops *ops = platform_dma_get_ops(dev);
1344 return ops->dma_supported(dev, mask);
1345 }
1346
1347diff -urNp linux-2.6.39/arch/ia64/include/asm/elf.h linux-2.6.39/arch/ia64/include/asm/elf.h
1348--- linux-2.6.39/arch/ia64/include/asm/elf.h 2011-05-19 00:06:34.000000000 -0400
1349+++ linux-2.6.39/arch/ia64/include/asm/elf.h 2011-05-22 19:36:30.000000000 -0400
1350@@ -42,6 +42,13 @@
1351 */
1352 #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE + 0x800000000UL)
1353
1354+#ifdef CONFIG_PAX_ASLR
1355+#define PAX_ELF_ET_DYN_BASE (current->personality == PER_LINUX32 ? 0x08048000UL : 0x4000000000000000UL)
1356+
1357+#define PAX_DELTA_MMAP_LEN (current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
1358+#define PAX_DELTA_STACK_LEN (current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
1359+#endif
1360+
1361 #define PT_IA_64_UNWIND 0x70000001
1362
1363 /* IA-64 relocations: */
1364diff -urNp linux-2.6.39/arch/ia64/include/asm/machvec.h linux-2.6.39/arch/ia64/include/asm/machvec.h
1365--- linux-2.6.39/arch/ia64/include/asm/machvec.h 2011-05-19 00:06:34.000000000 -0400
1366+++ linux-2.6.39/arch/ia64/include/asm/machvec.h 2011-05-22 19:36:30.000000000 -0400
1367@@ -45,7 +45,7 @@ typedef void ia64_mv_kernel_launch_event
1368 /* DMA-mapping interface: */
1369 typedef void ia64_mv_dma_init (void);
1370 typedef u64 ia64_mv_dma_get_required_mask (struct device *);
1371-typedef struct dma_map_ops *ia64_mv_dma_get_ops(struct device *);
1372+typedef const struct dma_map_ops *ia64_mv_dma_get_ops(struct device *);
1373
1374 /*
1375 * WARNING: The legacy I/O space is _architected_. Platforms are
1376@@ -251,7 +251,7 @@ extern void machvec_init_from_cmdline(co
1377 # endif /* CONFIG_IA64_GENERIC */
1378
1379 extern void swiotlb_dma_init(void);
1380-extern struct dma_map_ops *dma_get_ops(struct device *);
1381+extern const struct dma_map_ops *dma_get_ops(struct device *);
1382
1383 /*
1384 * Define default versions so we can extend machvec for new platforms without having
1385diff -urNp linux-2.6.39/arch/ia64/include/asm/pgtable.h linux-2.6.39/arch/ia64/include/asm/pgtable.h
1386--- linux-2.6.39/arch/ia64/include/asm/pgtable.h 2011-05-19 00:06:34.000000000 -0400
1387+++ linux-2.6.39/arch/ia64/include/asm/pgtable.h 2011-05-22 19:36:30.000000000 -0400
1388@@ -12,7 +12,7 @@
1389 * David Mosberger-Tang <davidm@hpl.hp.com>
1390 */
1391
1392-
1393+#include <linux/const.h>
1394 #include <asm/mman.h>
1395 #include <asm/page.h>
1396 #include <asm/processor.h>
1397@@ -143,6 +143,17 @@
1398 #define PAGE_READONLY __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
1399 #define PAGE_COPY __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
1400 #define PAGE_COPY_EXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_RX)
1401+
1402+#ifdef CONFIG_PAX_PAGEEXEC
1403+# define PAGE_SHARED_NOEXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_RW)
1404+# define PAGE_READONLY_NOEXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
1405+# define PAGE_COPY_NOEXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
1406+#else
1407+# define PAGE_SHARED_NOEXEC PAGE_SHARED
1408+# define PAGE_READONLY_NOEXEC PAGE_READONLY
1409+# define PAGE_COPY_NOEXEC PAGE_COPY
1410+#endif
1411+
1412 #define PAGE_GATE __pgprot(__ACCESS_BITS | _PAGE_PL_0 | _PAGE_AR_X_RX)
1413 #define PAGE_KERNEL __pgprot(__DIRTY_BITS | _PAGE_PL_0 | _PAGE_AR_RWX)
1414 #define PAGE_KERNELRX __pgprot(__ACCESS_BITS | _PAGE_PL_0 | _PAGE_AR_RX)
1415diff -urNp linux-2.6.39/arch/ia64/include/asm/spinlock.h linux-2.6.39/arch/ia64/include/asm/spinlock.h
1416--- linux-2.6.39/arch/ia64/include/asm/spinlock.h 2011-05-19 00:06:34.000000000 -0400
1417+++ linux-2.6.39/arch/ia64/include/asm/spinlock.h 2011-05-22 19:36:30.000000000 -0400
1418@@ -72,7 +72,7 @@ static __always_inline void __ticket_spi
1419 unsigned short *p = (unsigned short *)&lock->lock + 1, tmp;
1420
1421 asm volatile ("ld2.bias %0=[%1]" : "=r"(tmp) : "r"(p));
1422- ACCESS_ONCE(*p) = (tmp + 2) & ~1;
1423+ ACCESS_ONCE_RW(*p) = (tmp + 2) & ~1;
1424 }
1425
1426 static __always_inline void __ticket_spin_unlock_wait(arch_spinlock_t *lock)
1427diff -urNp linux-2.6.39/arch/ia64/include/asm/uaccess.h linux-2.6.39/arch/ia64/include/asm/uaccess.h
1428--- linux-2.6.39/arch/ia64/include/asm/uaccess.h 2011-05-19 00:06:34.000000000 -0400
1429+++ linux-2.6.39/arch/ia64/include/asm/uaccess.h 2011-05-22 19:36:30.000000000 -0400
1430@@ -257,7 +257,7 @@ __copy_from_user (void *to, const void _
1431 const void *__cu_from = (from); \
1432 long __cu_len = (n); \
1433 \
1434- if (__access_ok(__cu_to, __cu_len, get_fs())) \
1435+ if (__cu_len > 0 && __cu_len <= INT_MAX && __access_ok(__cu_to, __cu_len, get_fs())) \
1436 __cu_len = __copy_user(__cu_to, (__force void __user *) __cu_from, __cu_len); \
1437 __cu_len; \
1438 })
1439@@ -269,7 +269,7 @@ __copy_from_user (void *to, const void _
1440 long __cu_len = (n); \
1441 \
1442 __chk_user_ptr(__cu_from); \
1443- if (__access_ok(__cu_from, __cu_len, get_fs())) \
1444+ if (__cu_len > 0 && __cu_len <= INT_MAX && __access_ok(__cu_from, __cu_len, get_fs())) \
1445 __cu_len = __copy_user((__force void __user *) __cu_to, __cu_from, __cu_len); \
1446 __cu_len; \
1447 })
1448diff -urNp linux-2.6.39/arch/ia64/kernel/dma-mapping.c linux-2.6.39/arch/ia64/kernel/dma-mapping.c
1449--- linux-2.6.39/arch/ia64/kernel/dma-mapping.c 2011-05-19 00:06:34.000000000 -0400
1450+++ linux-2.6.39/arch/ia64/kernel/dma-mapping.c 2011-05-22 19:36:30.000000000 -0400
1451@@ -3,7 +3,7 @@
1452 /* Set this to 1 if there is a HW IOMMU in the system */
1453 int iommu_detected __read_mostly;
1454
1455-struct dma_map_ops *dma_ops;
1456+const struct dma_map_ops *dma_ops;
1457 EXPORT_SYMBOL(dma_ops);
1458
1459 #define PREALLOC_DMA_DEBUG_ENTRIES (1 << 16)
1460@@ -16,7 +16,7 @@ static int __init dma_init(void)
1461 }
1462 fs_initcall(dma_init);
1463
1464-struct dma_map_ops *dma_get_ops(struct device *dev)
1465+const struct dma_map_ops *dma_get_ops(struct device *dev)
1466 {
1467 return dma_ops;
1468 }
1469diff -urNp linux-2.6.39/arch/ia64/kernel/module.c linux-2.6.39/arch/ia64/kernel/module.c
1470--- linux-2.6.39/arch/ia64/kernel/module.c 2011-05-19 00:06:34.000000000 -0400
1471+++ linux-2.6.39/arch/ia64/kernel/module.c 2011-05-22 19:36:30.000000000 -0400
1472@@ -315,8 +315,7 @@ module_alloc (unsigned long size)
1473 void
1474 module_free (struct module *mod, void *module_region)
1475 {
1476- if (mod && mod->arch.init_unw_table &&
1477- module_region == mod->module_init) {
1478+ if (mod && mod->arch.init_unw_table && module_region == mod->module_init_rx) {
1479 unw_remove_unwind_table(mod->arch.init_unw_table);
1480 mod->arch.init_unw_table = NULL;
1481 }
1482@@ -502,15 +501,39 @@ module_frob_arch_sections (Elf_Ehdr *ehd
1483 }
1484
1485 static inline int
1486+in_init_rx (const struct module *mod, uint64_t addr)
1487+{
1488+ return addr - (uint64_t) mod->module_init_rx < mod->init_size_rx;
1489+}
1490+
1491+static inline int
1492+in_init_rw (const struct module *mod, uint64_t addr)
1493+{
1494+ return addr - (uint64_t) mod->module_init_rw < mod->init_size_rw;
1495+}
1496+
1497+static inline int
1498 in_init (const struct module *mod, uint64_t addr)
1499 {
1500- return addr - (uint64_t) mod->module_init < mod->init_size;
1501+ return in_init_rx(mod, addr) || in_init_rw(mod, addr);
1502+}
1503+
1504+static inline int
1505+in_core_rx (const struct module *mod, uint64_t addr)
1506+{
1507+ return addr - (uint64_t) mod->module_core_rx < mod->core_size_rx;
1508+}
1509+
1510+static inline int
1511+in_core_rw (const struct module *mod, uint64_t addr)
1512+{
1513+ return addr - (uint64_t) mod->module_core_rw < mod->core_size_rw;
1514 }
1515
1516 static inline int
1517 in_core (const struct module *mod, uint64_t addr)
1518 {
1519- return addr - (uint64_t) mod->module_core < mod->core_size;
1520+ return in_core_rx(mod, addr) || in_core_rw(mod, addr);
1521 }
1522
1523 static inline int
1524@@ -693,7 +716,14 @@ do_reloc (struct module *mod, uint8_t r_
1525 break;
1526
1527 case RV_BDREL:
1528- val -= (uint64_t) (in_init(mod, val) ? mod->module_init : mod->module_core);
1529+ if (in_init_rx(mod, val))
1530+ val -= (uint64_t) mod->module_init_rx;
1531+ else if (in_init_rw(mod, val))
1532+ val -= (uint64_t) mod->module_init_rw;
1533+ else if (in_core_rx(mod, val))
1534+ val -= (uint64_t) mod->module_core_rx;
1535+ else if (in_core_rw(mod, val))
1536+ val -= (uint64_t) mod->module_core_rw;
1537 break;
1538
1539 case RV_LTV:
1540@@ -828,15 +858,15 @@ apply_relocate_add (Elf64_Shdr *sechdrs,
1541 * addresses have been selected...
1542 */
1543 uint64_t gp;
1544- if (mod->core_size > MAX_LTOFF)
1545+ if (mod->core_size_rx + mod->core_size_rw > MAX_LTOFF)
1546 /*
1547 * This takes advantage of fact that SHF_ARCH_SMALL gets allocated
1548 * at the end of the module.
1549 */
1550- gp = mod->core_size - MAX_LTOFF / 2;
1551+ gp = mod->core_size_rx + mod->core_size_rw - MAX_LTOFF / 2;
1552 else
1553- gp = mod->core_size / 2;
1554- gp = (uint64_t) mod->module_core + ((gp + 7) & -8);
1555+ gp = (mod->core_size_rx + mod->core_size_rw) / 2;
1556+ gp = (uint64_t) mod->module_core_rx + ((gp + 7) & -8);
1557 mod->arch.gp = gp;
1558 DEBUGP("%s: placing gp at 0x%lx\n", __func__, gp);
1559 }
1560diff -urNp linux-2.6.39/arch/ia64/kernel/pci-dma.c linux-2.6.39/arch/ia64/kernel/pci-dma.c
1561--- linux-2.6.39/arch/ia64/kernel/pci-dma.c 2011-05-19 00:06:34.000000000 -0400
1562+++ linux-2.6.39/arch/ia64/kernel/pci-dma.c 2011-05-22 19:36:30.000000000 -0400
1563@@ -43,7 +43,7 @@ struct device fallback_dev = {
1564 .dma_mask = &fallback_dev.coherent_dma_mask,
1565 };
1566
1567-extern struct dma_map_ops intel_dma_ops;
1568+extern const struct dma_map_ops intel_dma_ops;
1569
1570 static int __init pci_iommu_init(void)
1571 {
1572diff -urNp linux-2.6.39/arch/ia64/kernel/pci-swiotlb.c linux-2.6.39/arch/ia64/kernel/pci-swiotlb.c
1573--- linux-2.6.39/arch/ia64/kernel/pci-swiotlb.c 2011-05-19 00:06:34.000000000 -0400
1574+++ linux-2.6.39/arch/ia64/kernel/pci-swiotlb.c 2011-05-22 19:36:30.000000000 -0400
1575@@ -22,7 +22,7 @@ static void *ia64_swiotlb_alloc_coherent
1576 return swiotlb_alloc_coherent(dev, size, dma_handle, gfp);
1577 }
1578
1579-struct dma_map_ops swiotlb_dma_ops = {
1580+const struct dma_map_ops swiotlb_dma_ops = {
1581 .alloc_coherent = ia64_swiotlb_alloc_coherent,
1582 .free_coherent = swiotlb_free_coherent,
1583 .map_page = swiotlb_map_page,
1584diff -urNp linux-2.6.39/arch/ia64/kernel/sys_ia64.c linux-2.6.39/arch/ia64/kernel/sys_ia64.c
1585--- linux-2.6.39/arch/ia64/kernel/sys_ia64.c 2011-05-19 00:06:34.000000000 -0400
1586+++ linux-2.6.39/arch/ia64/kernel/sys_ia64.c 2011-05-22 19:36:30.000000000 -0400
1587@@ -43,6 +43,13 @@ arch_get_unmapped_area (struct file *fil
1588 if (REGION_NUMBER(addr) == RGN_HPAGE)
1589 addr = 0;
1590 #endif
1591+
1592+#ifdef CONFIG_PAX_RANDMMAP
1593+ if (mm->pax_flags & MF_PAX_RANDMMAP)
1594+ addr = mm->free_area_cache;
1595+ else
1596+#endif
1597+
1598 if (!addr)
1599 addr = mm->free_area_cache;
1600
1601@@ -61,14 +68,14 @@ arch_get_unmapped_area (struct file *fil
1602 for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
1603 /* At this point: (!vma || addr < vma->vm_end). */
1604 if (TASK_SIZE - len < addr || RGN_MAP_LIMIT - len < REGION_OFFSET(addr)) {
1605- if (start_addr != TASK_UNMAPPED_BASE) {
1606+ if (start_addr != mm->mmap_base) {
1607 /* Start a new search --- just in case we missed some holes. */
1608- addr = TASK_UNMAPPED_BASE;
1609+ addr = mm->mmap_base;
1610 goto full_search;
1611 }
1612 return -ENOMEM;
1613 }
1614- if (!vma || addr + len <= vma->vm_start) {
1615+ if (check_heap_stack_gap(vma, addr, len)) {
1616 /* Remember the address where we stopped this search: */
1617 mm->free_area_cache = addr + len;
1618 return addr;
1619diff -urNp linux-2.6.39/arch/ia64/kernel/vmlinux.lds.S linux-2.6.39/arch/ia64/kernel/vmlinux.lds.S
1620--- linux-2.6.39/arch/ia64/kernel/vmlinux.lds.S 2011-05-19 00:06:34.000000000 -0400
1621+++ linux-2.6.39/arch/ia64/kernel/vmlinux.lds.S 2011-05-22 19:36:30.000000000 -0400
1622@@ -199,7 +199,7 @@ SECTIONS {
1623 /* Per-cpu data: */
1624 . = ALIGN(PERCPU_PAGE_SIZE);
1625 PERCPU_VADDR(SMP_CACHE_BYTES, PERCPU_ADDR, :percpu)
1626- __phys_per_cpu_start = __per_cpu_load;
1627+ __phys_per_cpu_start = per_cpu_load;
1628 /*
1629 * ensure percpu data fits
1630 * into percpu page size
1631diff -urNp linux-2.6.39/arch/ia64/mm/fault.c linux-2.6.39/arch/ia64/mm/fault.c
1632--- linux-2.6.39/arch/ia64/mm/fault.c 2011-05-19 00:06:34.000000000 -0400
1633+++ linux-2.6.39/arch/ia64/mm/fault.c 2011-05-22 19:36:30.000000000 -0400
1634@@ -72,6 +72,23 @@ mapped_kernel_page_is_present (unsigned
1635 return pte_present(pte);
1636 }
1637
1638+#ifdef CONFIG_PAX_PAGEEXEC
1639+void pax_report_insns(void *pc, void *sp)
1640+{
1641+ unsigned long i;
1642+
1643+ printk(KERN_ERR "PAX: bytes at PC: ");
1644+ for (i = 0; i < 8; i++) {
1645+ unsigned int c;
1646+ if (get_user(c, (unsigned int *)pc+i))
1647+ printk(KERN_CONT "???????? ");
1648+ else
1649+ printk(KERN_CONT "%08x ", c);
1650+ }
1651+ printk("\n");
1652+}
1653+#endif
1654+
1655 void __kprobes
1656 ia64_do_page_fault (unsigned long address, unsigned long isr, struct pt_regs *regs)
1657 {
1658@@ -145,9 +162,23 @@ ia64_do_page_fault (unsigned long addres
1659 mask = ( (((isr >> IA64_ISR_X_BIT) & 1UL) << VM_EXEC_BIT)
1660 | (((isr >> IA64_ISR_W_BIT) & 1UL) << VM_WRITE_BIT));
1661
1662- if ((vma->vm_flags & mask) != mask)
1663+ if ((vma->vm_flags & mask) != mask) {
1664+
1665+#ifdef CONFIG_PAX_PAGEEXEC
1666+ if (!(vma->vm_flags & VM_EXEC) && (mask & VM_EXEC)) {
1667+ if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || address != regs->cr_iip)
1668+ goto bad_area;
1669+
1670+ up_read(&mm->mmap_sem);
1671+ pax_report_fault(regs, (void *)regs->cr_iip, (void *)regs->r12);
1672+ do_group_exit(SIGKILL);
1673+ }
1674+#endif
1675+
1676 goto bad_area;
1677
1678+ }
1679+
1680 /*
1681 * If for any reason at all we couldn't handle the fault, make
1682 * sure we exit gracefully rather than endlessly redo the
1683diff -urNp linux-2.6.39/arch/ia64/mm/hugetlbpage.c linux-2.6.39/arch/ia64/mm/hugetlbpage.c
1684--- linux-2.6.39/arch/ia64/mm/hugetlbpage.c 2011-05-19 00:06:34.000000000 -0400
1685+++ linux-2.6.39/arch/ia64/mm/hugetlbpage.c 2011-05-22 19:36:30.000000000 -0400
1686@@ -171,7 +171,7 @@ unsigned long hugetlb_get_unmapped_area(
1687 /* At this point: (!vmm || addr < vmm->vm_end). */
1688 if (REGION_OFFSET(addr) + len > RGN_MAP_LIMIT)
1689 return -ENOMEM;
1690- if (!vmm || (addr + len) <= vmm->vm_start)
1691+ if (check_heap_stack_gap(vmm, addr, len))
1692 return addr;
1693 addr = ALIGN(vmm->vm_end, HPAGE_SIZE);
1694 }
1695diff -urNp linux-2.6.39/arch/ia64/mm/init.c linux-2.6.39/arch/ia64/mm/init.c
1696--- linux-2.6.39/arch/ia64/mm/init.c 2011-05-19 00:06:34.000000000 -0400
1697+++ linux-2.6.39/arch/ia64/mm/init.c 2011-05-22 19:36:30.000000000 -0400
1698@@ -122,6 +122,19 @@ ia64_init_addr_space (void)
1699 vma->vm_start = current->thread.rbs_bot & PAGE_MASK;
1700 vma->vm_end = vma->vm_start + PAGE_SIZE;
1701 vma->vm_flags = VM_DATA_DEFAULT_FLAGS|VM_GROWSUP|VM_ACCOUNT;
1702+
1703+#ifdef CONFIG_PAX_PAGEEXEC
1704+ if (current->mm->pax_flags & MF_PAX_PAGEEXEC) {
1705+ vma->vm_flags &= ~VM_EXEC;
1706+
1707+#ifdef CONFIG_PAX_MPROTECT
1708+ if (current->mm->pax_flags & MF_PAX_MPROTECT)
1709+ vma->vm_flags &= ~VM_MAYEXEC;
1710+#endif
1711+
1712+ }
1713+#endif
1714+
1715 vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
1716 down_write(&current->mm->mmap_sem);
1717 if (insert_vm_struct(current->mm, vma)) {
1718diff -urNp linux-2.6.39/arch/ia64/pci/pci.c linux-2.6.39/arch/ia64/pci/pci.c
1719--- linux-2.6.39/arch/ia64/pci/pci.c 2011-05-19 00:06:34.000000000 -0400
1720+++ linux-2.6.39/arch/ia64/pci/pci.c 2011-05-22 19:36:30.000000000 -0400
1721@@ -109,7 +109,7 @@ static int pci_write(struct pci_bus *bus
1722 devfn, where, size, value);
1723 }
1724
1725-struct pci_ops pci_root_ops = {
1726+const struct pci_ops pci_root_ops = {
1727 .read = pci_read,
1728 .write = pci_write,
1729 };
1730diff -urNp linux-2.6.39/arch/ia64/sn/pci/pci_dma.c linux-2.6.39/arch/ia64/sn/pci/pci_dma.c
1731--- linux-2.6.39/arch/ia64/sn/pci/pci_dma.c 2011-05-19 00:06:34.000000000 -0400
1732+++ linux-2.6.39/arch/ia64/sn/pci/pci_dma.c 2011-05-22 19:36:30.000000000 -0400
1733@@ -465,7 +465,7 @@ int sn_pci_legacy_write(struct pci_bus *
1734 return ret;
1735 }
1736
1737-static struct dma_map_ops sn_dma_ops = {
1738+static const struct dma_map_ops sn_dma_ops = {
1739 .alloc_coherent = sn_dma_alloc_coherent,
1740 .free_coherent = sn_dma_free_coherent,
1741 .map_page = sn_dma_map_page,
1742diff -urNp linux-2.6.39/arch/m32r/lib/usercopy.c linux-2.6.39/arch/m32r/lib/usercopy.c
1743--- linux-2.6.39/arch/m32r/lib/usercopy.c 2011-05-19 00:06:34.000000000 -0400
1744+++ linux-2.6.39/arch/m32r/lib/usercopy.c 2011-05-22 19:36:30.000000000 -0400
1745@@ -14,6 +14,9 @@
1746 unsigned long
1747 __generic_copy_to_user(void __user *to, const void *from, unsigned long n)
1748 {
1749+ if ((long)n < 0)
1750+ return n;
1751+
1752 prefetch(from);
1753 if (access_ok(VERIFY_WRITE, to, n))
1754 __copy_user(to,from,n);
1755@@ -23,6 +26,9 @@ __generic_copy_to_user(void __user *to,
1756 unsigned long
1757 __generic_copy_from_user(void *to, const void __user *from, unsigned long n)
1758 {
1759+ if ((long)n < 0)
1760+ return n;
1761+
1762 prefetchw(to);
1763 if (access_ok(VERIFY_READ, from, n))
1764 __copy_user_zeroing(to,from,n);
1765diff -urNp linux-2.6.39/arch/microblaze/include/asm/device.h linux-2.6.39/arch/microblaze/include/asm/device.h
1766--- linux-2.6.39/arch/microblaze/include/asm/device.h 2011-05-19 00:06:34.000000000 -0400
1767+++ linux-2.6.39/arch/microblaze/include/asm/device.h 2011-05-22 19:36:30.000000000 -0400
1768@@ -13,7 +13,7 @@ struct device_node;
1769
1770 struct dev_archdata {
1771 /* DMA operations on that device */
1772- struct dma_map_ops *dma_ops;
1773+ const struct dma_map_ops *dma_ops;
1774 void *dma_data;
1775 };
1776
1777diff -urNp linux-2.6.39/arch/microblaze/include/asm/dma-mapping.h linux-2.6.39/arch/microblaze/include/asm/dma-mapping.h
1778--- linux-2.6.39/arch/microblaze/include/asm/dma-mapping.h 2011-05-19 00:06:34.000000000 -0400
1779+++ linux-2.6.39/arch/microblaze/include/asm/dma-mapping.h 2011-05-22 19:36:30.000000000 -0400
1780@@ -43,14 +43,14 @@ static inline unsigned long device_to_ma
1781 return 0xfffffffful;
1782 }
1783
1784-extern struct dma_map_ops *dma_ops;
1785+extern const struct dma_map_ops *dma_ops;
1786
1787 /*
1788 * Available generic sets of operations
1789 */
1790-extern struct dma_map_ops dma_direct_ops;
1791+extern const struct dma_map_ops dma_direct_ops;
1792
1793-static inline struct dma_map_ops *get_dma_ops(struct device *dev)
1794+static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
1795 {
1796 /* We don't handle the NULL dev case for ISA for now. We could
1797 * do it via an out of line call but it is not needed for now. The
1798@@ -63,14 +63,14 @@ static inline struct dma_map_ops *get_dm
1799 return dev->archdata.dma_ops;
1800 }
1801
1802-static inline void set_dma_ops(struct device *dev, struct dma_map_ops *ops)
1803+static inline void set_dma_ops(struct device *dev, const struct dma_map_ops *ops)
1804 {
1805 dev->archdata.dma_ops = ops;
1806 }
1807
1808 static inline int dma_supported(struct device *dev, u64 mask)
1809 {
1810- struct dma_map_ops *ops = get_dma_ops(dev);
1811+ const struct dma_map_ops *ops = get_dma_ops(dev);
1812
1813 if (unlikely(!ops))
1814 return 0;
1815@@ -81,7 +81,7 @@ static inline int dma_supported(struct d
1816
1817 static inline int dma_set_mask(struct device *dev, u64 dma_mask)
1818 {
1819- struct dma_map_ops *ops = get_dma_ops(dev);
1820+ const struct dma_map_ops *ops = get_dma_ops(dev);
1821
1822 if (unlikely(ops == NULL))
1823 return -EIO;
1824@@ -97,7 +97,7 @@ static inline int dma_set_mask(struct de
1825
1826 static inline int dma_mapping_error(struct device *dev, dma_addr_t dma_addr)
1827 {
1828- struct dma_map_ops *ops = get_dma_ops(dev);
1829+ const struct dma_map_ops *ops = get_dma_ops(dev);
1830 if (ops->mapping_error)
1831 return ops->mapping_error(dev, dma_addr);
1832
1833@@ -110,7 +110,7 @@ static inline int dma_mapping_error(stru
1834 static inline void *dma_alloc_coherent(struct device *dev, size_t size,
1835 dma_addr_t *dma_handle, gfp_t flag)
1836 {
1837- struct dma_map_ops *ops = get_dma_ops(dev);
1838+ const struct dma_map_ops *ops = get_dma_ops(dev);
1839 void *memory;
1840
1841 BUG_ON(!ops);
1842@@ -124,7 +124,7 @@ static inline void *dma_alloc_coherent(s
1843 static inline void dma_free_coherent(struct device *dev, size_t size,
1844 void *cpu_addr, dma_addr_t dma_handle)
1845 {
1846- struct dma_map_ops *ops = get_dma_ops(dev);
1847+ const struct dma_map_ops *ops = get_dma_ops(dev);
1848
1849 BUG_ON(!ops);
1850 debug_dma_free_coherent(dev, size, cpu_addr, dma_handle);
1851diff -urNp linux-2.6.39/arch/microblaze/include/asm/pci.h linux-2.6.39/arch/microblaze/include/asm/pci.h
1852--- linux-2.6.39/arch/microblaze/include/asm/pci.h 2011-05-19 00:06:34.000000000 -0400
1853+++ linux-2.6.39/arch/microblaze/include/asm/pci.h 2011-05-22 19:36:30.000000000 -0400
1854@@ -54,8 +54,8 @@ static inline void pcibios_penalize_isa_
1855 }
1856
1857 #ifdef CONFIG_PCI
1858-extern void set_pci_dma_ops(struct dma_map_ops *dma_ops);
1859-extern struct dma_map_ops *get_pci_dma_ops(void);
1860+extern void set_pci_dma_ops(const struct dma_map_ops *dma_ops);
1861+extern const struct dma_map_ops *get_pci_dma_ops(void);
1862 #else /* CONFIG_PCI */
1863 #define set_pci_dma_ops(d)
1864 #define get_pci_dma_ops() NULL
1865diff -urNp linux-2.6.39/arch/microblaze/kernel/dma.c linux-2.6.39/arch/microblaze/kernel/dma.c
1866--- linux-2.6.39/arch/microblaze/kernel/dma.c 2011-05-19 00:06:34.000000000 -0400
1867+++ linux-2.6.39/arch/microblaze/kernel/dma.c 2011-05-22 19:36:30.000000000 -0400
1868@@ -134,7 +134,7 @@ static inline void dma_direct_unmap_page
1869 __dma_sync_page(dma_address, 0 , size, direction);
1870 }
1871
1872-struct dma_map_ops dma_direct_ops = {
1873+const struct dma_map_ops dma_direct_ops = {
1874 .alloc_coherent = dma_direct_alloc_coherent,
1875 .free_coherent = dma_direct_free_coherent,
1876 .map_sg = dma_direct_map_sg,
1877diff -urNp linux-2.6.39/arch/microblaze/kernel/kgdb.c linux-2.6.39/arch/microblaze/kernel/kgdb.c
1878--- linux-2.6.39/arch/microblaze/kernel/kgdb.c 2011-05-19 00:06:34.000000000 -0400
1879+++ linux-2.6.39/arch/microblaze/kernel/kgdb.c 2011-05-22 19:36:30.000000000 -0400
1880@@ -141,7 +141,7 @@ void kgdb_arch_exit(void)
1881 /*
1882 * Global data
1883 */
1884-struct kgdb_arch arch_kgdb_ops = {
1885+const struct kgdb_arch arch_kgdb_ops = {
1886 #ifdef __MICROBLAZEEL__
1887 .gdb_bpt_instr = {0x18, 0x00, 0x0c, 0xba}, /* brki r16, 0x18 */
1888 #else
1889diff -urNp linux-2.6.39/arch/microblaze/pci/indirect_pci.c linux-2.6.39/arch/microblaze/pci/indirect_pci.c
1890--- linux-2.6.39/arch/microblaze/pci/indirect_pci.c 2011-05-19 00:06:34.000000000 -0400
1891+++ linux-2.6.39/arch/microblaze/pci/indirect_pci.c 2011-05-22 19:36:30.000000000 -0400
1892@@ -140,7 +140,7 @@ indirect_write_config(struct pci_bus *bu
1893 return PCIBIOS_SUCCESSFUL;
1894 }
1895
1896-static struct pci_ops indirect_pci_ops = {
1897+static const struct pci_ops indirect_pci_ops = {
1898 .read = indirect_read_config,
1899 .write = indirect_write_config,
1900 };
1901diff -urNp linux-2.6.39/arch/microblaze/pci/pci-common.c linux-2.6.39/arch/microblaze/pci/pci-common.c
1902--- linux-2.6.39/arch/microblaze/pci/pci-common.c 2011-05-19 00:06:34.000000000 -0400
1903+++ linux-2.6.39/arch/microblaze/pci/pci-common.c 2011-05-22 19:36:30.000000000 -0400
1904@@ -48,14 +48,14 @@ resource_size_t isa_mem_base;
1905 /* Default PCI flags is 0 on ppc32, modified at boot on ppc64 */
1906 unsigned int pci_flags;
1907
1908-static struct dma_map_ops *pci_dma_ops = &dma_direct_ops;
1909+static const struct dma_map_ops *pci_dma_ops = &dma_direct_ops;
1910
1911-void set_pci_dma_ops(struct dma_map_ops *dma_ops)
1912+void set_pci_dma_ops(const struct dma_map_ops *dma_ops)
1913 {
1914 pci_dma_ops = dma_ops;
1915 }
1916
1917-struct dma_map_ops *get_pci_dma_ops(void)
1918+const struct dma_map_ops *get_pci_dma_ops(void)
1919 {
1920 return pci_dma_ops;
1921 }
1922@@ -1583,7 +1583,7 @@ null_write_config(struct pci_bus *bus, u
1923 return PCIBIOS_DEVICE_NOT_FOUND;
1924 }
1925
1926-static struct pci_ops null_pci_ops = {
1927+static const struct pci_ops null_pci_ops = {
1928 .read = null_read_config,
1929 .write = null_write_config,
1930 };
1931diff -urNp linux-2.6.39/arch/mips/alchemy/common/pci.c linux-2.6.39/arch/mips/alchemy/common/pci.c
1932--- linux-2.6.39/arch/mips/alchemy/common/pci.c 2011-05-19 00:06:34.000000000 -0400
1933+++ linux-2.6.39/arch/mips/alchemy/common/pci.c 2011-05-22 19:36:30.000000000 -0400
1934@@ -51,7 +51,7 @@ static struct resource pci_mem_resource
1935 .flags = IORESOURCE_MEM
1936 };
1937
1938-extern struct pci_ops au1x_pci_ops;
1939+extern const struct pci_ops au1x_pci_ops;
1940
1941 static struct pci_controller au1x_controller = {
1942 .pci_ops = &au1x_pci_ops,
1943diff -urNp linux-2.6.39/arch/mips/cavium-octeon/dma-octeon.c linux-2.6.39/arch/mips/cavium-octeon/dma-octeon.c
1944--- linux-2.6.39/arch/mips/cavium-octeon/dma-octeon.c 2011-05-19 00:06:34.000000000 -0400
1945+++ linux-2.6.39/arch/mips/cavium-octeon/dma-octeon.c 2011-05-22 19:36:30.000000000 -0400
1946@@ -202,7 +202,7 @@ static phys_addr_t octeon_unity_dma_to_p
1947 }
1948
1949 struct octeon_dma_map_ops {
1950- struct dma_map_ops dma_map_ops;
1951+ const struct dma_map_ops dma_map_ops;
1952 dma_addr_t (*phys_to_dma)(struct device *dev, phys_addr_t paddr);
1953 phys_addr_t (*dma_to_phys)(struct device *dev, dma_addr_t daddr);
1954 };
1955@@ -324,7 +324,7 @@ static struct octeon_dma_map_ops _octeon
1956 },
1957 };
1958
1959-struct dma_map_ops *octeon_pci_dma_map_ops;
1960+const struct dma_map_ops *octeon_pci_dma_map_ops;
1961
1962 void __init octeon_pci_dma_init(void)
1963 {
1964diff -urNp linux-2.6.39/arch/mips/cobalt/pci.c linux-2.6.39/arch/mips/cobalt/pci.c
1965--- linux-2.6.39/arch/mips/cobalt/pci.c 2011-05-19 00:06:34.000000000 -0400
1966+++ linux-2.6.39/arch/mips/cobalt/pci.c 2011-05-22 19:36:30.000000000 -0400
1967@@ -14,7 +14,7 @@
1968
1969 #include <asm/gt64120.h>
1970
1971-extern struct pci_ops gt64xxx_pci0_ops;
1972+extern const struct pci_ops gt64xxx_pci0_ops;
1973
1974 static struct resource cobalt_mem_resource = {
1975 .start = GT_DEF_PCI0_MEM0_BASE,
1976diff -urNp linux-2.6.39/arch/mips/include/asm/device.h linux-2.6.39/arch/mips/include/asm/device.h
1977--- linux-2.6.39/arch/mips/include/asm/device.h 2011-05-19 00:06:34.000000000 -0400
1978+++ linux-2.6.39/arch/mips/include/asm/device.h 2011-05-22 19:36:30.000000000 -0400
1979@@ -10,7 +10,7 @@ struct dma_map_ops;
1980
1981 struct dev_archdata {
1982 /* DMA operations on that device */
1983- struct dma_map_ops *dma_ops;
1984+ const struct dma_map_ops *dma_ops;
1985 };
1986
1987 struct pdev_archdata {
1988diff -urNp linux-2.6.39/arch/mips/include/asm/dma-mapping.h linux-2.6.39/arch/mips/include/asm/dma-mapping.h
1989--- linux-2.6.39/arch/mips/include/asm/dma-mapping.h 2011-05-19 00:06:34.000000000 -0400
1990+++ linux-2.6.39/arch/mips/include/asm/dma-mapping.h 2011-05-22 19:36:30.000000000 -0400
1991@@ -9,9 +9,9 @@
1992 #include <dma-coherence.h>
1993 #endif
1994
1995-extern struct dma_map_ops *mips_dma_map_ops;
1996+extern const struct dma_map_ops *mips_dma_map_ops;
1997
1998-static inline struct dma_map_ops *get_dma_ops(struct device *dev)
1999+static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
2000 {
2001 if (dev && dev->archdata.dma_ops)
2002 return dev->archdata.dma_ops;
2003@@ -33,13 +33,13 @@ static inline void dma_mark_clean(void *
2004
2005 static inline int dma_supported(struct device *dev, u64 mask)
2006 {
2007- struct dma_map_ops *ops = get_dma_ops(dev);
2008+ const struct dma_map_ops *ops = get_dma_ops(dev);
2009 return ops->dma_supported(dev, mask);
2010 }
2011
2012 static inline int dma_mapping_error(struct device *dev, u64 mask)
2013 {
2014- struct dma_map_ops *ops = get_dma_ops(dev);
2015+ const struct dma_map_ops *ops = get_dma_ops(dev);
2016 return ops->mapping_error(dev, mask);
2017 }
2018
2019@@ -61,7 +61,7 @@ static inline void *dma_alloc_coherent(s
2020 dma_addr_t *dma_handle, gfp_t gfp)
2021 {
2022 void *ret;
2023- struct dma_map_ops *ops = get_dma_ops(dev);
2024+ const struct dma_map_ops *ops = get_dma_ops(dev);
2025
2026 ret = ops->alloc_coherent(dev, size, dma_handle, gfp);
2027
2028@@ -73,7 +73,7 @@ static inline void *dma_alloc_coherent(s
2029 static inline void dma_free_coherent(struct device *dev, size_t size,
2030 void *vaddr, dma_addr_t dma_handle)
2031 {
2032- struct dma_map_ops *ops = get_dma_ops(dev);
2033+ const struct dma_map_ops *ops = get_dma_ops(dev);
2034
2035 ops->free_coherent(dev, size, vaddr, dma_handle);
2036
2037diff -urNp linux-2.6.39/arch/mips/include/asm/elf.h linux-2.6.39/arch/mips/include/asm/elf.h
2038--- linux-2.6.39/arch/mips/include/asm/elf.h 2011-05-19 00:06:34.000000000 -0400
2039+++ linux-2.6.39/arch/mips/include/asm/elf.h 2011-05-22 19:36:30.000000000 -0400
2040@@ -372,13 +372,16 @@ extern const char *__elf_platform;
2041 #define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
2042 #endif
2043
2044+#ifdef CONFIG_PAX_ASLR
2045+#define PAX_ELF_ET_DYN_BASE (TASK_IS_32BIT_ADDR ? 0x00400000UL : 0x00400000UL)
2046+
2047+#define PAX_DELTA_MMAP_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
2048+#define PAX_DELTA_STACK_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
2049+#endif
2050+
2051 #define ARCH_HAS_SETUP_ADDITIONAL_PAGES 1
2052 struct linux_binprm;
2053 extern int arch_setup_additional_pages(struct linux_binprm *bprm,
2054 int uses_interp);
2055
2056-struct mm_struct;
2057-extern unsigned long arch_randomize_brk(struct mm_struct *mm);
2058-#define arch_randomize_brk arch_randomize_brk
2059-
2060 #endif /* _ASM_ELF_H */
2061diff -urNp linux-2.6.39/arch/mips/include/asm/mach-cavium-octeon/dma-coherence.h linux-2.6.39/arch/mips/include/asm/mach-cavium-octeon/dma-coherence.h
2062--- linux-2.6.39/arch/mips/include/asm/mach-cavium-octeon/dma-coherence.h 2011-05-19 00:06:34.000000000 -0400
2063+++ linux-2.6.39/arch/mips/include/asm/mach-cavium-octeon/dma-coherence.h 2011-05-22 19:36:30.000000000 -0400
2064@@ -66,7 +66,7 @@ dma_addr_t phys_to_dma(struct device *de
2065 phys_addr_t dma_to_phys(struct device *dev, dma_addr_t daddr);
2066
2067 struct dma_map_ops;
2068-extern struct dma_map_ops *octeon_pci_dma_map_ops;
2069+extern const struct dma_map_ops *octeon_pci_dma_map_ops;
2070 extern char *octeon_swiotlb;
2071
2072 #endif /* __ASM_MACH_CAVIUM_OCTEON_DMA_COHERENCE_H */
2073diff -urNp linux-2.6.39/arch/mips/include/asm/page.h linux-2.6.39/arch/mips/include/asm/page.h
2074--- linux-2.6.39/arch/mips/include/asm/page.h 2011-05-19 00:06:34.000000000 -0400
2075+++ linux-2.6.39/arch/mips/include/asm/page.h 2011-05-22 19:36:30.000000000 -0400
2076@@ -93,7 +93,7 @@ extern void copy_user_highpage(struct pa
2077 #ifdef CONFIG_CPU_MIPS32
2078 typedef struct { unsigned long pte_low, pte_high; } pte_t;
2079 #define pte_val(x) ((x).pte_low | ((unsigned long long)(x).pte_high << 32))
2080- #define __pte(x) ({ pte_t __pte = {(x), ((unsigned long long)(x)) >> 32}; __pte; })
2081+ #define __pte(x) ({ pte_t __pte = {(x), (x) >> 32}; __pte; })
2082 #else
2083 typedef struct { unsigned long long pte; } pte_t;
2084 #define pte_val(x) ((x).pte)
2085diff -urNp linux-2.6.39/arch/mips/include/asm/pci/bridge.h linux-2.6.39/arch/mips/include/asm/pci/bridge.h
2086--- linux-2.6.39/arch/mips/include/asm/pci/bridge.h 2011-05-19 00:06:34.000000000 -0400
2087+++ linux-2.6.39/arch/mips/include/asm/pci/bridge.h 2011-05-22 19:36:30.000000000 -0400
2088@@ -849,6 +849,6 @@ struct bridge_controller {
2089 extern void register_bridge_irq(unsigned int irq);
2090 extern int request_bridge_irq(struct bridge_controller *bc);
2091
2092-extern struct pci_ops bridge_pci_ops;
2093+extern const struct pci_ops bridge_pci_ops;
2094
2095 #endif /* _ASM_PCI_BRIDGE_H */
2096diff -urNp linux-2.6.39/arch/mips/include/asm/system.h linux-2.6.39/arch/mips/include/asm/system.h
2097--- linux-2.6.39/arch/mips/include/asm/system.h 2011-05-19 00:06:34.000000000 -0400
2098+++ linux-2.6.39/arch/mips/include/asm/system.h 2011-05-22 19:36:30.000000000 -0400
2099@@ -230,6 +230,6 @@ extern void per_cpu_trap_init(void);
2100 */
2101 #define __ARCH_WANT_UNLOCKED_CTXSW
2102
2103-extern unsigned long arch_align_stack(unsigned long sp);
2104+#define arch_align_stack(x) ((x) & ~0xfUL)
2105
2106 #endif /* _ASM_SYSTEM_H */
2107diff -urNp linux-2.6.39/arch/mips/kernel/binfmt_elfn32.c linux-2.6.39/arch/mips/kernel/binfmt_elfn32.c
2108--- linux-2.6.39/arch/mips/kernel/binfmt_elfn32.c 2011-05-19 00:06:34.000000000 -0400
2109+++ linux-2.6.39/arch/mips/kernel/binfmt_elfn32.c 2011-05-22 19:36:30.000000000 -0400
2110@@ -50,6 +50,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_N
2111 #undef ELF_ET_DYN_BASE
2112 #define ELF_ET_DYN_BASE (TASK32_SIZE / 3 * 2)
2113
2114+#ifdef CONFIG_PAX_ASLR
2115+#define PAX_ELF_ET_DYN_BASE (TASK_IS_32BIT_ADDR ? 0x00400000UL : 0x00400000UL)
2116+
2117+#define PAX_DELTA_MMAP_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
2118+#define PAX_DELTA_STACK_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
2119+#endif
2120+
2121 #include <asm/processor.h>
2122 #include <linux/module.h>
2123 #include <linux/elfcore.h>
2124diff -urNp linux-2.6.39/arch/mips/kernel/binfmt_elfo32.c linux-2.6.39/arch/mips/kernel/binfmt_elfo32.c
2125--- linux-2.6.39/arch/mips/kernel/binfmt_elfo32.c 2011-05-19 00:06:34.000000000 -0400
2126+++ linux-2.6.39/arch/mips/kernel/binfmt_elfo32.c 2011-05-22 19:36:30.000000000 -0400
2127@@ -52,6 +52,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_N
2128 #undef ELF_ET_DYN_BASE
2129 #define ELF_ET_DYN_BASE (TASK32_SIZE / 3 * 2)
2130
2131+#ifdef CONFIG_PAX_ASLR
2132+#define PAX_ELF_ET_DYN_BASE (TASK_IS_32BIT_ADDR ? 0x00400000UL : 0x00400000UL)
2133+
2134+#define PAX_DELTA_MMAP_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
2135+#define PAX_DELTA_STACK_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
2136+#endif
2137+
2138 #include <asm/processor.h>
2139
2140 /*
2141diff -urNp linux-2.6.39/arch/mips/kernel/kgdb.c linux-2.6.39/arch/mips/kernel/kgdb.c
2142--- linux-2.6.39/arch/mips/kernel/kgdb.c 2011-05-19 00:06:34.000000000 -0400
2143+++ linux-2.6.39/arch/mips/kernel/kgdb.c 2011-05-22 19:36:30.000000000 -0400
2144@@ -351,7 +351,7 @@ int kgdb_arch_handle_exception(int vecto
2145 return -1;
2146 }
2147
2148-struct kgdb_arch arch_kgdb_ops;
2149+struct kgdb_arch arch_kgdb_ops; /* cannot be const, see kgdb_arch_init */
2150
2151 /*
2152 * We use kgdb_early_setup so that functions we need to call now don't
2153diff -urNp linux-2.6.39/arch/mips/kernel/process.c linux-2.6.39/arch/mips/kernel/process.c
2154--- linux-2.6.39/arch/mips/kernel/process.c 2011-05-19 00:06:34.000000000 -0400
2155+++ linux-2.6.39/arch/mips/kernel/process.c 2011-05-22 19:36:30.000000000 -0400
2156@@ -473,15 +473,3 @@ unsigned long get_wchan(struct task_stru
2157 out:
2158 return pc;
2159 }
2160-
2161-/*
2162- * Don't forget that the stack pointer must be aligned on a 8 bytes
2163- * boundary for 32-bits ABI and 16 bytes for 64-bits ABI.
2164- */
2165-unsigned long arch_align_stack(unsigned long sp)
2166-{
2167- if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
2168- sp -= get_random_int() & ~PAGE_MASK;
2169-
2170- return sp & ALMASK;
2171-}
2172diff -urNp linux-2.6.39/arch/mips/kernel/syscall.c linux-2.6.39/arch/mips/kernel/syscall.c
2173--- linux-2.6.39/arch/mips/kernel/syscall.c 2011-05-19 00:06:34.000000000 -0400
2174+++ linux-2.6.39/arch/mips/kernel/syscall.c 2011-05-22 19:36:30.000000000 -0400
2175@@ -108,14 +108,18 @@ unsigned long arch_get_unmapped_area(str
2176 do_color_align = 0;
2177 if (filp || (flags & MAP_SHARED))
2178 do_color_align = 1;
2179+
2180+#ifdef CONFIG_PAX_RANDMMAP
2181+ if (!(current->mm->pax_flags & MF_PAX_RANDMMAP))
2182+#endif
2183+
2184 if (addr) {
2185 if (do_color_align)
2186 addr = COLOUR_ALIGN(addr, pgoff);
2187 else
2188 addr = PAGE_ALIGN(addr);
2189 vmm = find_vma(current->mm, addr);
2190- if (task_size - len >= addr &&
2191- (!vmm || addr + len <= vmm->vm_start))
2192+ if (task_size - len >= addr && check_heap_stack_gap(vmm, addr, len))
2193 return addr;
2194 }
2195 addr = current->mm->mmap_base;
2196@@ -128,7 +132,7 @@ unsigned long arch_get_unmapped_area(str
2197 /* At this point: (!vmm || addr < vmm->vm_end). */
2198 if (task_size - len < addr)
2199 return -ENOMEM;
2200- if (!vmm || addr + len <= vmm->vm_start)
2201+ if (check_heap_stack_gap(vmm, addr, len))
2202 return addr;
2203 addr = vmm->vm_end;
2204 if (do_color_align)
2205@@ -154,33 +158,6 @@ void arch_pick_mmap_layout(struct mm_str
2206 mm->unmap_area = arch_unmap_area;
2207 }
2208
2209-static inline unsigned long brk_rnd(void)
2210-{
2211- unsigned long rnd = get_random_int();
2212-
2213- rnd = rnd << PAGE_SHIFT;
2214- /* 8MB for 32bit, 256MB for 64bit */
2215- if (TASK_IS_32BIT_ADDR)
2216- rnd = rnd & 0x7ffffful;
2217- else
2218- rnd = rnd & 0xffffffful;
2219-
2220- return rnd;
2221-}
2222-
2223-unsigned long arch_randomize_brk(struct mm_struct *mm)
2224-{
2225- unsigned long base = mm->brk;
2226- unsigned long ret;
2227-
2228- ret = PAGE_ALIGN(base + brk_rnd());
2229-
2230- if (ret < mm->brk)
2231- return mm->brk;
2232-
2233- return ret;
2234-}
2235-
2236 SYSCALL_DEFINE6(mips_mmap, unsigned long, addr, unsigned long, len,
2237 unsigned long, prot, unsigned long, flags, unsigned long,
2238 fd, off_t, offset)
2239diff -urNp linux-2.6.39/arch/mips/mm/dma-default.c linux-2.6.39/arch/mips/mm/dma-default.c
2240--- linux-2.6.39/arch/mips/mm/dma-default.c 2011-05-19 00:06:34.000000000 -0400
2241+++ linux-2.6.39/arch/mips/mm/dma-default.c 2011-05-22 19:36:30.000000000 -0400
2242@@ -300,7 +300,7 @@ void dma_cache_sync(struct device *dev,
2243
2244 EXPORT_SYMBOL(dma_cache_sync);
2245
2246-static struct dma_map_ops mips_default_dma_map_ops = {
2247+static const struct dma_map_ops mips_default_dma_map_ops = {
2248 .alloc_coherent = mips_dma_alloc_coherent,
2249 .free_coherent = mips_dma_free_coherent,
2250 .map_page = mips_dma_map_page,
2251@@ -315,7 +315,7 @@ static struct dma_map_ops mips_default_d
2252 .dma_supported = mips_dma_supported
2253 };
2254
2255-struct dma_map_ops *mips_dma_map_ops = &mips_default_dma_map_ops;
2256+const struct dma_map_ops *mips_dma_map_ops = &mips_default_dma_map_ops;
2257 EXPORT_SYMBOL(mips_dma_map_ops);
2258
2259 #define PREALLOC_DMA_DEBUG_ENTRIES (1 << 16)
2260diff -urNp linux-2.6.39/arch/mips/mm/fault.c linux-2.6.39/arch/mips/mm/fault.c
2261--- linux-2.6.39/arch/mips/mm/fault.c 2011-05-19 00:06:34.000000000 -0400
2262+++ linux-2.6.39/arch/mips/mm/fault.c 2011-05-22 19:36:30.000000000 -0400
2263@@ -28,6 +28,23 @@
2264 #include <asm/highmem.h> /* For VMALLOC_END */
2265 #include <linux/kdebug.h>
2266
2267+#ifdef CONFIG_PAX_PAGEEXEC
2268+void pax_report_insns(void *pc, void *sp)
2269+{
2270+ unsigned long i;
2271+
2272+ printk(KERN_ERR "PAX: bytes at PC: ");
2273+ for (i = 0; i < 5; i++) {
2274+ unsigned int c;
2275+ if (get_user(c, (unsigned int *)pc+i))
2276+ printk(KERN_CONT "???????? ");
2277+ else
2278+ printk(KERN_CONT "%08x ", c);
2279+ }
2280+ printk("\n");
2281+}
2282+#endif
2283+
2284 /*
2285 * This routine handles page faults. It determines the address,
2286 * and the problem, and then passes it off to one of the appropriate
2287diff -urNp linux-2.6.39/arch/mips/mti-malta/malta-pci.c linux-2.6.39/arch/mips/mti-malta/malta-pci.c
2288--- linux-2.6.39/arch/mips/mti-malta/malta-pci.c 2011-05-19 00:06:34.000000000 -0400
2289+++ linux-2.6.39/arch/mips/mti-malta/malta-pci.c 2011-05-22 19:36:30.000000000 -0400
2290@@ -64,9 +64,9 @@ static struct resource msc_io_resource =
2291 .flags = IORESOURCE_IO,
2292 };
2293
2294-extern struct pci_ops bonito64_pci_ops;
2295-extern struct pci_ops gt64xxx_pci0_ops;
2296-extern struct pci_ops msc_pci_ops;
2297+extern const struct pci_ops bonito64_pci_ops;
2298+extern const struct pci_ops gt64xxx_pci0_ops;
2299+extern const struct pci_ops msc_pci_ops;
2300
2301 static struct pci_controller bonito64_controller = {
2302 .pci_ops = &bonito64_pci_ops,
2303diff -urNp linux-2.6.39/arch/mips/nxp/pnx8550/common/pci.c linux-2.6.39/arch/mips/nxp/pnx8550/common/pci.c
2304--- linux-2.6.39/arch/mips/nxp/pnx8550/common/pci.c 2011-05-19 00:06:34.000000000 -0400
2305+++ linux-2.6.39/arch/mips/nxp/pnx8550/common/pci.c 2011-05-22 19:36:30.000000000 -0400
2306@@ -40,7 +40,7 @@ static struct resource pci_mem_resource
2307 .flags = IORESOURCE_MEM
2308 };
2309
2310-extern struct pci_ops pnx8550_pci_ops;
2311+extern const struct pci_ops pnx8550_pci_ops;
2312
2313 static struct pci_controller pnx8550_controller = {
2314 .pci_ops = &pnx8550_pci_ops,
2315diff -urNp linux-2.6.39/arch/mips/pci/ops-au1000.c linux-2.6.39/arch/mips/pci/ops-au1000.c
2316--- linux-2.6.39/arch/mips/pci/ops-au1000.c 2011-05-19 00:06:34.000000000 -0400
2317+++ linux-2.6.39/arch/mips/pci/ops-au1000.c 2011-05-22 19:36:30.000000000 -0400
2318@@ -302,7 +302,7 @@ static int config_write(struct pci_bus *
2319 }
2320 }
2321
2322-struct pci_ops au1x_pci_ops = {
2323+const struct pci_ops au1x_pci_ops = {
2324 config_read,
2325 config_write
2326 };
2327diff -urNp linux-2.6.39/arch/mips/pci/ops-bcm63xx.c linux-2.6.39/arch/mips/pci/ops-bcm63xx.c
2328--- linux-2.6.39/arch/mips/pci/ops-bcm63xx.c 2011-05-19 00:06:34.000000000 -0400
2329+++ linux-2.6.39/arch/mips/pci/ops-bcm63xx.c 2011-05-22 19:36:30.000000000 -0400
2330@@ -173,7 +173,7 @@ static int bcm63xx_pci_write(struct pci_
2331 where, size, val);
2332 }
2333
2334-struct pci_ops bcm63xx_pci_ops = {
2335+const struct pci_ops bcm63xx_pci_ops = {
2336 .read = bcm63xx_pci_read,
2337 .write = bcm63xx_pci_write
2338 };
2339@@ -402,7 +402,7 @@ static int bcm63xx_cb_write(struct pci_b
2340 return PCIBIOS_DEVICE_NOT_FOUND;
2341 }
2342
2343-struct pci_ops bcm63xx_cb_ops = {
2344+const struct pci_ops bcm63xx_cb_ops = {
2345 .read = bcm63xx_cb_read,
2346 .write = bcm63xx_cb_write,
2347 };
2348diff -urNp linux-2.6.39/arch/mips/pci/ops-bonito64.c linux-2.6.39/arch/mips/pci/ops-bonito64.c
2349--- linux-2.6.39/arch/mips/pci/ops-bonito64.c 2011-05-19 00:06:34.000000000 -0400
2350+++ linux-2.6.39/arch/mips/pci/ops-bonito64.c 2011-05-22 19:36:30.000000000 -0400
2351@@ -155,7 +155,7 @@ static int bonito64_pcibios_write(struct
2352 return PCIBIOS_SUCCESSFUL;
2353 }
2354
2355-struct pci_ops bonito64_pci_ops = {
2356+const struct pci_ops bonito64_pci_ops = {
2357 .read = bonito64_pcibios_read,
2358 .write = bonito64_pcibios_write
2359 };
2360diff -urNp linux-2.6.39/arch/mips/pci/ops-bridge.c linux-2.6.39/arch/mips/pci/ops-bridge.c
2361--- linux-2.6.39/arch/mips/pci/ops-bridge.c 2011-05-19 00:06:34.000000000 -0400
2362+++ linux-2.6.39/arch/mips/pci/ops-bridge.c 2011-05-22 19:36:30.000000000 -0400
2363@@ -316,7 +316,7 @@ static int pci_write_config(struct pci_b
2364 return pci_conf0_write_config(bus, devfn, where, size, value);
2365 }
2366
2367-struct pci_ops bridge_pci_ops = {
2368+const struct pci_ops bridge_pci_ops = {
2369 .read = pci_read_config,
2370 .write = pci_write_config,
2371 };
2372diff -urNp linux-2.6.39/arch/mips/pci/ops-emma2rh.c linux-2.6.39/arch/mips/pci/ops-emma2rh.c
2373--- linux-2.6.39/arch/mips/pci/ops-emma2rh.c 2011-05-19 00:06:34.000000000 -0400
2374+++ linux-2.6.39/arch/mips/pci/ops-emma2rh.c 2011-05-22 19:36:30.000000000 -0400
2375@@ -176,7 +176,7 @@ static int pci_config_write(struct pci_b
2376 return PCIBIOS_SUCCESSFUL;
2377 }
2378
2379-struct pci_ops emma2rh_pci_ops = {
2380+const struct pci_ops emma2rh_pci_ops = {
2381 .read = pci_config_read,
2382 .write = pci_config_write,
2383 };
2384diff -urNp linux-2.6.39/arch/mips/pci/ops-gt64xxx_pci0.c linux-2.6.39/arch/mips/pci/ops-gt64xxx_pci0.c
2385--- linux-2.6.39/arch/mips/pci/ops-gt64xxx_pci0.c 2011-05-19 00:06:34.000000000 -0400
2386+++ linux-2.6.39/arch/mips/pci/ops-gt64xxx_pci0.c 2011-05-22 19:36:30.000000000 -0400
2387@@ -146,7 +146,7 @@ static int gt64xxx_pci0_pcibios_write(st
2388 return PCIBIOS_SUCCESSFUL;
2389 }
2390
2391-struct pci_ops gt64xxx_pci0_ops = {
2392+const struct pci_ops gt64xxx_pci0_ops = {
2393 .read = gt64xxx_pci0_pcibios_read,
2394 .write = gt64xxx_pci0_pcibios_write
2395 };
2396diff -urNp linux-2.6.39/arch/mips/pci/ops-loongson2.c linux-2.6.39/arch/mips/pci/ops-loongson2.c
2397--- linux-2.6.39/arch/mips/pci/ops-loongson2.c 2011-05-19 00:06:34.000000000 -0400
2398+++ linux-2.6.39/arch/mips/pci/ops-loongson2.c 2011-05-22 19:36:30.000000000 -0400
2399@@ -174,7 +174,7 @@ static int loongson_pcibios_write(struct
2400 return PCIBIOS_SUCCESSFUL;
2401 }
2402
2403-struct pci_ops loongson_pci_ops = {
2404+const struct pci_ops loongson_pci_ops = {
2405 .read = loongson_pcibios_read,
2406 .write = loongson_pcibios_write
2407 };
2408diff -urNp linux-2.6.39/arch/mips/pci/ops-mace.c linux-2.6.39/arch/mips/pci/ops-mace.c
2409--- linux-2.6.39/arch/mips/pci/ops-mace.c 2011-05-19 00:06:34.000000000 -0400
2410+++ linux-2.6.39/arch/mips/pci/ops-mace.c 2011-05-22 19:36:30.000000000 -0400
2411@@ -96,7 +96,7 @@ mace_pci_write_config(struct pci_bus *bu
2412 return PCIBIOS_SUCCESSFUL;
2413 }
2414
2415-struct pci_ops mace_pci_ops = {
2416+const struct pci_ops mace_pci_ops = {
2417 .read = mace_pci_read_config,
2418 .write = mace_pci_write_config,
2419 };
2420diff -urNp linux-2.6.39/arch/mips/pci/ops-msc.c linux-2.6.39/arch/mips/pci/ops-msc.c
2421--- linux-2.6.39/arch/mips/pci/ops-msc.c 2011-05-19 00:06:34.000000000 -0400
2422+++ linux-2.6.39/arch/mips/pci/ops-msc.c 2011-05-22 19:36:30.000000000 -0400
2423@@ -142,7 +142,7 @@ static int msc_pcibios_write(struct pci_
2424 return PCIBIOS_SUCCESSFUL;
2425 }
2426
2427-struct pci_ops msc_pci_ops = {
2428+const struct pci_ops msc_pci_ops = {
2429 .read = msc_pcibios_read,
2430 .write = msc_pcibios_write
2431 };
2432diff -urNp linux-2.6.39/arch/mips/pci/ops-nile4.c linux-2.6.39/arch/mips/pci/ops-nile4.c
2433--- linux-2.6.39/arch/mips/pci/ops-nile4.c 2011-05-19 00:06:34.000000000 -0400
2434+++ linux-2.6.39/arch/mips/pci/ops-nile4.c 2011-05-22 19:36:30.000000000 -0400
2435@@ -141,7 +141,7 @@ static int nile4_pcibios_write(struct pc
2436 return PCIBIOS_SUCCESSFUL;
2437 }
2438
2439-struct pci_ops nile4_pci_ops = {
2440+const struct pci_ops nile4_pci_ops = {
2441 .read = nile4_pcibios_read,
2442 .write = nile4_pcibios_write,
2443 };
2444diff -urNp linux-2.6.39/arch/mips/pci/ops-pmcmsp.c linux-2.6.39/arch/mips/pci/ops-pmcmsp.c
2445--- linux-2.6.39/arch/mips/pci/ops-pmcmsp.c 2011-05-19 00:06:34.000000000 -0400
2446+++ linux-2.6.39/arch/mips/pci/ops-pmcmsp.c 2011-05-22 19:36:30.000000000 -0400
2447@@ -904,7 +904,7 @@ msp_pcibios_write_config(struct pci_bus
2448 * write - function for Linux to generate PCI Configuration writes.
2449 *
2450 ****************************************************************************/
2451-struct pci_ops msp_pci_ops = {
2452+const struct pci_ops msp_pci_ops = {
2453 .read = msp_pcibios_read_config,
2454 .write = msp_pcibios_write_config
2455 };
2456diff -urNp linux-2.6.39/arch/mips/pci/ops-pnx8550.c linux-2.6.39/arch/mips/pci/ops-pnx8550.c
2457--- linux-2.6.39/arch/mips/pci/ops-pnx8550.c 2011-05-19 00:06:34.000000000 -0400
2458+++ linux-2.6.39/arch/mips/pci/ops-pnx8550.c 2011-05-22 19:36:30.000000000 -0400
2459@@ -276,7 +276,7 @@ static int config_write(struct pci_bus *
2460 }
2461 }
2462
2463-struct pci_ops pnx8550_pci_ops = {
2464+const struct pci_ops pnx8550_pci_ops = {
2465 config_read,
2466 config_write
2467 };
2468diff -urNp linux-2.6.39/arch/mips/pci/ops-rc32434.c linux-2.6.39/arch/mips/pci/ops-rc32434.c
2469--- linux-2.6.39/arch/mips/pci/ops-rc32434.c 2011-05-19 00:06:34.000000000 -0400
2470+++ linux-2.6.39/arch/mips/pci/ops-rc32434.c 2011-05-22 19:36:30.000000000 -0400
2471@@ -201,7 +201,7 @@ static int pci_config_write(struct pci_b
2472 }
2473 }
2474
2475-struct pci_ops rc32434_pci_ops = {
2476+const struct pci_ops rc32434_pci_ops = {
2477 .read = pci_config_read,
2478 .write = pci_config_write,
2479 };
2480diff -urNp linux-2.6.39/arch/mips/pci/ops-sni.c linux-2.6.39/arch/mips/pci/ops-sni.c
2481--- linux-2.6.39/arch/mips/pci/ops-sni.c 2011-05-19 00:06:34.000000000 -0400
2482+++ linux-2.6.39/arch/mips/pci/ops-sni.c 2011-05-22 19:36:30.000000000 -0400
2483@@ -83,7 +83,7 @@ static int pcimt_write(struct pci_bus *b
2484 return 0;
2485 }
2486
2487-struct pci_ops sni_pcimt_ops = {
2488+const struct pci_ops sni_pcimt_ops = {
2489 .read = pcimt_read,
2490 .write = pcimt_write,
2491 };
2492@@ -158,7 +158,7 @@ static int pcit_write(struct pci_bus *bu
2493 }
2494
2495
2496-struct pci_ops sni_pcit_ops = {
2497+const struct pci_ops sni_pcit_ops = {
2498 .read = pcit_read,
2499 .write = pcit_write,
2500 };
2501diff -urNp linux-2.6.39/arch/mips/pci/ops-titan.c linux-2.6.39/arch/mips/pci/ops-titan.c
2502--- linux-2.6.39/arch/mips/pci/ops-titan.c 2011-05-19 00:06:34.000000000 -0400
2503+++ linux-2.6.39/arch/mips/pci/ops-titan.c 2011-05-22 19:36:30.000000000 -0400
2504@@ -105,7 +105,7 @@ static int titan_write_config(struct pci
2505 /*
2506 * Titan PCI structure
2507 */
2508-struct pci_ops titan_pci_ops = {
2509+const struct pci_ops titan_pci_ops = {
2510 titan_read_config,
2511 titan_write_config,
2512 };
2513diff -urNp linux-2.6.39/arch/mips/pci/ops-titan-ht.c linux-2.6.39/arch/mips/pci/ops-titan-ht.c
2514--- linux-2.6.39/arch/mips/pci/ops-titan-ht.c 2011-05-19 00:06:34.000000000 -0400
2515+++ linux-2.6.39/arch/mips/pci/ops-titan-ht.c 2011-05-22 19:36:30.000000000 -0400
2516@@ -118,7 +118,7 @@ static int titan_ht_config_write(struct
2517 return PCIBIOS_SUCCESSFUL;
2518 }
2519
2520-struct pci_ops titan_ht_pci_ops = {
2521+const struct pci_ops titan_ht_pci_ops = {
2522 .read = titan_ht_config_read,
2523 .write = titan_ht_config_write,
2524 };
2525diff -urNp linux-2.6.39/arch/mips/pci/ops-tx3927.c linux-2.6.39/arch/mips/pci/ops-tx3927.c
2526--- linux-2.6.39/arch/mips/pci/ops-tx3927.c 2011-05-19 00:06:34.000000000 -0400
2527+++ linux-2.6.39/arch/mips/pci/ops-tx3927.c 2011-05-22 19:36:30.000000000 -0400
2528@@ -121,7 +121,7 @@ static int tx3927_pci_write_config(struc
2529 return check_abort();
2530 }
2531
2532-static struct pci_ops tx3927_pci_ops = {
2533+static const struct pci_ops tx3927_pci_ops = {
2534 .read = tx3927_pci_read_config,
2535 .write = tx3927_pci_write_config,
2536 };
2537diff -urNp linux-2.6.39/arch/mips/pci/ops-vr41xx.c linux-2.6.39/arch/mips/pci/ops-vr41xx.c
2538--- linux-2.6.39/arch/mips/pci/ops-vr41xx.c 2011-05-19 00:06:34.000000000 -0400
2539+++ linux-2.6.39/arch/mips/pci/ops-vr41xx.c 2011-05-22 19:36:30.000000000 -0400
2540@@ -120,7 +120,7 @@ static int pci_config_write(struct pci_b
2541 return PCIBIOS_SUCCESSFUL;
2542 }
2543
2544-struct pci_ops vr41xx_pci_ops = {
2545+const struct pci_ops vr41xx_pci_ops = {
2546 .read = pci_config_read,
2547 .write = pci_config_write,
2548 };
2549diff -urNp linux-2.6.39/arch/mips/pci/pci-bcm1480.c linux-2.6.39/arch/mips/pci/pci-bcm1480.c
2550--- linux-2.6.39/arch/mips/pci/pci-bcm1480.c 2011-05-19 00:06:34.000000000 -0400
2551+++ linux-2.6.39/arch/mips/pci/pci-bcm1480.c 2011-05-22 19:36:30.000000000 -0400
2552@@ -171,7 +171,7 @@ static int bcm1480_pcibios_write(struct
2553 return PCIBIOS_SUCCESSFUL;
2554 }
2555
2556-struct pci_ops bcm1480_pci_ops = {
2557+const struct pci_ops bcm1480_pci_ops = {
2558 bcm1480_pcibios_read,
2559 bcm1480_pcibios_write,
2560 };
2561diff -urNp linux-2.6.39/arch/mips/pci/pci-bcm1480ht.c linux-2.6.39/arch/mips/pci/pci-bcm1480ht.c
2562--- linux-2.6.39/arch/mips/pci/pci-bcm1480ht.c 2011-05-19 00:06:34.000000000 -0400
2563+++ linux-2.6.39/arch/mips/pci/pci-bcm1480ht.c 2011-05-22 19:36:30.000000000 -0400
2564@@ -166,7 +166,7 @@ static int bcm1480ht_pcibios_get_busno(v
2565 return 0;
2566 }
2567
2568-struct pci_ops bcm1480ht_pci_ops = {
2569+const struct pci_ops bcm1480ht_pci_ops = {
2570 .read = bcm1480ht_pcibios_read,
2571 .write = bcm1480ht_pcibios_write,
2572 };
2573diff -urNp linux-2.6.39/arch/mips/pci/pci-bcm63xx.h linux-2.6.39/arch/mips/pci/pci-bcm63xx.h
2574--- linux-2.6.39/arch/mips/pci/pci-bcm63xx.h 2011-05-19 00:06:34.000000000 -0400
2575+++ linux-2.6.39/arch/mips/pci/pci-bcm63xx.h 2011-05-22 19:36:30.000000000 -0400
2576@@ -16,8 +16,8 @@
2577 /*
2578 * defined in ops-bcm63xx.c
2579 */
2580-extern struct pci_ops bcm63xx_pci_ops;
2581-extern struct pci_ops bcm63xx_cb_ops;
2582+extern const struct pci_ops bcm63xx_pci_ops;
2583+extern const struct pci_ops bcm63xx_cb_ops;
2584
2585 /*
2586 * defined in pci-bcm63xx.c
2587diff -urNp linux-2.6.39/arch/mips/pci/pci-emma2rh.c linux-2.6.39/arch/mips/pci/pci-emma2rh.c
2588--- linux-2.6.39/arch/mips/pci/pci-emma2rh.c 2011-05-19 00:06:34.000000000 -0400
2589+++ linux-2.6.39/arch/mips/pci/pci-emma2rh.c 2011-05-22 19:36:30.000000000 -0400
2590@@ -43,7 +43,7 @@ static struct resource pci_mem_resource
2591 .flags = IORESOURCE_MEM,
2592 };
2593
2594-extern struct pci_ops emma2rh_pci_ops;
2595+extern const struct pci_ops emma2rh_pci_ops;
2596
2597 static struct pci_controller emma2rh_pci_controller = {
2598 .pci_ops = &emma2rh_pci_ops,
2599diff -urNp linux-2.6.39/arch/mips/pci/pcie-octeon.c linux-2.6.39/arch/mips/pci/pcie-octeon.c
2600--- linux-2.6.39/arch/mips/pci/pcie-octeon.c 2011-05-19 00:06:34.000000000 -0400
2601+++ linux-2.6.39/arch/mips/pci/pcie-octeon.c 2011-05-22 19:36:30.000000000 -0400
2602@@ -1237,7 +1237,7 @@ static int octeon_pcie1_write_config(str
2603 return octeon_pcie_write_config(1, bus, devfn, reg, size, val);
2604 }
2605
2606-static struct pci_ops octeon_pcie0_ops = {
2607+static const struct pci_ops octeon_pcie0_ops = {
2608 octeon_pcie0_read_config,
2609 octeon_pcie0_write_config,
2610 };
2611@@ -1258,7 +1258,7 @@ static struct pci_controller octeon_pcie
2612 .io_resource = &octeon_pcie0_io_resource,
2613 };
2614
2615-static struct pci_ops octeon_pcie1_ops = {
2616+static const struct pci_ops octeon_pcie1_ops = {
2617 octeon_pcie1_read_config,
2618 octeon_pcie1_write_config,
2619 };
2620diff -urNp linux-2.6.39/arch/mips/pci/pci-ip27.c linux-2.6.39/arch/mips/pci/pci-ip27.c
2621--- linux-2.6.39/arch/mips/pci/pci-ip27.c 2011-05-19 00:06:34.000000000 -0400
2622+++ linux-2.6.39/arch/mips/pci/pci-ip27.c 2011-05-22 19:36:30.000000000 -0400
2623@@ -39,7 +39,7 @@ static struct bridge_controller bridges[
2624 struct bridge_controller *irq_to_bridge[MAX_PCI_BUSSES * MAX_DEVICES_PER_PCIBUS];
2625 int irq_to_slot[MAX_PCI_BUSSES * MAX_DEVICES_PER_PCIBUS];
2626
2627-extern struct pci_ops bridge_pci_ops;
2628+extern const struct pci_ops bridge_pci_ops;
2629
2630 int __cpuinit bridge_probe(nasid_t nasid, int widget_id, int masterwid)
2631 {
2632diff -urNp linux-2.6.39/arch/mips/pci/pci-ip32.c linux-2.6.39/arch/mips/pci/pci-ip32.c
2633--- linux-2.6.39/arch/mips/pci/pci-ip32.c 2011-05-19 00:06:34.000000000 -0400
2634+++ linux-2.6.39/arch/mips/pci/pci-ip32.c 2011-05-22 19:36:30.000000000 -0400
2635@@ -82,7 +82,7 @@ static irqreturn_t macepci_error(int irq
2636 }
2637
2638
2639-extern struct pci_ops mace_pci_ops;
2640+extern const struct pci_ops mace_pci_ops;
2641 #ifdef CONFIG_64BIT
2642 static struct resource mace_pci_mem_resource = {
2643 .name = "SGI O2 PCI MEM",
2644diff -urNp linux-2.6.39/arch/mips/pci/pci-lasat.c linux-2.6.39/arch/mips/pci/pci-lasat.c
2645--- linux-2.6.39/arch/mips/pci/pci-lasat.c 2011-05-19 00:06:34.000000000 -0400
2646+++ linux-2.6.39/arch/mips/pci/pci-lasat.c 2011-05-22 19:36:30.000000000 -0400
2647@@ -14,8 +14,8 @@
2648
2649 #include <irq.h>
2650
2651-extern struct pci_ops nile4_pci_ops;
2652-extern struct pci_ops gt64xxx_pci0_ops;
2653+extern const struct pci_ops nile4_pci_ops;
2654+extern const struct pci_ops gt64xxx_pci0_ops;
2655 static struct resource lasat_pci_mem_resource = {
2656 .name = "LASAT PCI MEM",
2657 .start = 0x18000000,
2658diff -urNp linux-2.6.39/arch/mips/pci/pci-octeon.c linux-2.6.39/arch/mips/pci/pci-octeon.c
2659--- linux-2.6.39/arch/mips/pci/pci-octeon.c 2011-05-19 00:06:34.000000000 -0400
2660+++ linux-2.6.39/arch/mips/pci/pci-octeon.c 2011-05-22 19:36:30.000000000 -0400
2661@@ -334,7 +334,7 @@ static int octeon_write_config(struct pc
2662 }
2663
2664
2665-static struct pci_ops octeon_pci_ops = {
2666+static const struct pci_ops octeon_pci_ops = {
2667 octeon_read_config,
2668 octeon_write_config,
2669 };
2670diff -urNp linux-2.6.39/arch/mips/pci/pci-rc32434.c linux-2.6.39/arch/mips/pci/pci-rc32434.c
2671--- linux-2.6.39/arch/mips/pci/pci-rc32434.c 2011-05-19 00:06:34.000000000 -0400
2672+++ linux-2.6.39/arch/mips/pci/pci-rc32434.c 2011-05-22 19:36:30.000000000 -0400
2673@@ -75,7 +75,7 @@ static struct resource rc32434_res_pci_i
2674 .flags = IORESOURCE_IO,
2675 };
2676
2677-extern struct pci_ops rc32434_pci_ops;
2678+extern const struct pci_ops rc32434_pci_ops;
2679
2680 #define PCI_MEM1_START PCI_ADDR_START
2681 #define PCI_MEM1_END (PCI_ADDR_START + CPUTOPCI_MEM_WIN - 1)
2682diff -urNp linux-2.6.39/arch/mips/pci/pci-sb1250.c linux-2.6.39/arch/mips/pci/pci-sb1250.c
2683--- linux-2.6.39/arch/mips/pci/pci-sb1250.c 2011-05-19 00:06:34.000000000 -0400
2684+++ linux-2.6.39/arch/mips/pci/pci-sb1250.c 2011-05-22 19:36:30.000000000 -0400
2685@@ -181,7 +181,7 @@ static int sb1250_pcibios_write(struct p
2686 return PCIBIOS_SUCCESSFUL;
2687 }
2688
2689-struct pci_ops sb1250_pci_ops = {
2690+const struct pci_ops sb1250_pci_ops = {
2691 .read = sb1250_pcibios_read,
2692 .write = sb1250_pcibios_write,
2693 };
2694diff -urNp linux-2.6.39/arch/mips/pci/pci-vr41xx.c linux-2.6.39/arch/mips/pci/pci-vr41xx.c
2695--- linux-2.6.39/arch/mips/pci/pci-vr41xx.c 2011-05-19 00:06:34.000000000 -0400
2696+++ linux-2.6.39/arch/mips/pci/pci-vr41xx.c 2011-05-22 19:36:30.000000000 -0400
2697@@ -36,7 +36,7 @@
2698
2699 #include "pci-vr41xx.h"
2700
2701-extern struct pci_ops vr41xx_pci_ops;
2702+extern const struct pci_ops vr41xx_pci_ops;
2703
2704 static void __iomem *pciu_base;
2705
2706diff -urNp linux-2.6.39/arch/mips/pci/pci-yosemite.c linux-2.6.39/arch/mips/pci/pci-yosemite.c
2707--- linux-2.6.39/arch/mips/pci/pci-yosemite.c 2011-05-19 00:06:34.000000000 -0400
2708+++ linux-2.6.39/arch/mips/pci/pci-yosemite.c 2011-05-22 19:36:30.000000000 -0400
2709@@ -11,7 +11,7 @@
2710 #include <linux/pci.h>
2711 #include <asm/titan_dep.h>
2712
2713-extern struct pci_ops titan_pci_ops;
2714+extern const struct pci_ops titan_pci_ops;
2715
2716 static struct resource py_mem_resource = {
2717 .start = 0xe0000000UL,
2718diff -urNp linux-2.6.39/arch/mips/pmc-sierra/yosemite/ht.c linux-2.6.39/arch/mips/pmc-sierra/yosemite/ht.c
2719--- linux-2.6.39/arch/mips/pmc-sierra/yosemite/ht.c 2011-05-19 00:06:34.000000000 -0400
2720+++ linux-2.6.39/arch/mips/pmc-sierra/yosemite/ht.c 2011-05-22 19:36:30.000000000 -0400
2721@@ -366,7 +366,7 @@ resource_size_t pcibios_align_resource(v
2722 return start;
2723 }
2724
2725-struct pci_ops titan_pci_ops = {
2726+const struct pci_ops titan_pci_ops = {
2727 titan_ht_config_read_byte,
2728 titan_ht_config_read_word,
2729 titan_ht_config_read_dword,
2730diff -urNp linux-2.6.39/arch/mips/pnx8550/common/pci.c linux-2.6.39/arch/mips/pnx8550/common/pci.c
2731--- linux-2.6.39/arch/mips/pnx8550/common/pci.c 2011-05-19 00:06:34.000000000 -0400
2732+++ linux-2.6.39/arch/mips/pnx8550/common/pci.c 2011-05-22 19:36:30.000000000 -0400
2733@@ -40,7 +40,7 @@ static struct resource pci_mem_resource
2734 .flags = IORESOURCE_MEM
2735 };
2736
2737-extern struct pci_ops pnx8550_pci_ops;
2738+extern const struct pci_ops pnx8550_pci_ops;
2739
2740 static struct pci_controller pnx8550_controller = {
2741 .pci_ops = &pnx8550_pci_ops,
2742diff -urNp linux-2.6.39/arch/mips/sni/pcimt.c linux-2.6.39/arch/mips/sni/pcimt.c
2743--- linux-2.6.39/arch/mips/sni/pcimt.c 2011-05-19 00:06:34.000000000 -0400
2744+++ linux-2.6.39/arch/mips/sni/pcimt.c 2011-05-22 19:36:30.000000000 -0400
2745@@ -183,7 +183,7 @@ static void __init sni_pcimt_resource_in
2746 request_resource(&sni_mem_resource, pcimt_mem_resources + i);
2747 }
2748
2749-extern struct pci_ops sni_pcimt_ops;
2750+extern const struct pci_ops sni_pcimt_ops;
2751
2752 static struct pci_controller sni_controller = {
2753 .pci_ops = &sni_pcimt_ops,
2754diff -urNp linux-2.6.39/arch/mips/sni/pcit.c linux-2.6.39/arch/mips/sni/pcit.c
2755--- linux-2.6.39/arch/mips/sni/pcit.c 2011-05-19 00:06:34.000000000 -0400
2756+++ linux-2.6.39/arch/mips/sni/pcit.c 2011-05-22 19:36:30.000000000 -0400
2757@@ -145,7 +145,7 @@ static void __init sni_pcit_resource_ini
2758 }
2759
2760
2761-extern struct pci_ops sni_pcit_ops;
2762+extern const struct pci_ops sni_pcit_ops;
2763
2764 static struct pci_controller sni_pcit_controller = {
2765 .pci_ops = &sni_pcit_ops,
2766diff -urNp linux-2.6.39/arch/mips/wrppmc/pci.c linux-2.6.39/arch/mips/wrppmc/pci.c
2767--- linux-2.6.39/arch/mips/wrppmc/pci.c 2011-05-19 00:06:34.000000000 -0400
2768+++ linux-2.6.39/arch/mips/wrppmc/pci.c 2011-05-22 19:36:30.000000000 -0400
2769@@ -14,7 +14,7 @@
2770
2771 #include <asm/gt64120.h>
2772
2773-extern struct pci_ops gt64xxx_pci0_ops;
2774+extern const struct pci_ops gt64xxx_pci0_ops;
2775
2776 static struct resource pci0_io_resource = {
2777 .name = "pci_0 io",
2778diff -urNp linux-2.6.39/arch/mn10300/unit-asb2305/pci-asb2305.h linux-2.6.39/arch/mn10300/unit-asb2305/pci-asb2305.h
2779--- linux-2.6.39/arch/mn10300/unit-asb2305/pci-asb2305.h 2011-05-19 00:06:34.000000000 -0400
2780+++ linux-2.6.39/arch/mn10300/unit-asb2305/pci-asb2305.h 2011-05-22 19:36:30.000000000 -0400
2781@@ -39,7 +39,7 @@ extern void pcibios_resource_survey(void
2782
2783 extern int pcibios_last_bus;
2784 extern struct pci_bus *pci_root_bus;
2785-extern struct pci_ops *pci_root_ops;
2786+extern const struct pci_ops *pci_root_ops;
2787
2788 extern struct irq_routing_table *pcibios_get_irq_routing_table(void);
2789 extern int pcibios_set_irq_routing(struct pci_dev *dev, int pin, int irq);
2790diff -urNp linux-2.6.39/arch/mn10300/unit-asb2305/pci.c linux-2.6.39/arch/mn10300/unit-asb2305/pci.c
2791--- linux-2.6.39/arch/mn10300/unit-asb2305/pci.c 2011-05-19 00:06:34.000000000 -0400
2792+++ linux-2.6.39/arch/mn10300/unit-asb2305/pci.c 2011-05-22 19:36:30.000000000 -0400
2793@@ -24,7 +24,7 @@ unsigned int pci_probe = 1;
2794
2795 int pcibios_last_bus = -1;
2796 struct pci_bus *pci_root_bus;
2797-struct pci_ops *pci_root_ops;
2798+const struct pci_ops *pci_root_ops;
2799
2800 /*
2801 * The accessible PCI window does not cover the entire CPU address space, but
2802@@ -274,7 +274,7 @@ static int pci_ampci_write_config(struct
2803 }
2804 }
2805
2806-static struct pci_ops pci_direct_ampci = {
2807+static const struct pci_ops pci_direct_ampci = {
2808 pci_ampci_read_config,
2809 pci_ampci_write_config,
2810 };
2811@@ -289,7 +289,7 @@ static struct pci_ops pci_direct_ampci =
2812 * This should be close to trivial, but it isn't, because there are buggy
2813 * chipsets (yes, you guessed it, by Intel and Compaq) that have no class ID.
2814 */
2815-static int __init pci_sanity_check(struct pci_ops *o)
2816+static int __init pci_sanity_check(const struct pci_ops *o)
2817 {
2818 struct pci_bus bus; /* Fake bus and device */
2819 u32 x;
2820diff -urNp linux-2.6.39/arch/parisc/include/asm/elf.h linux-2.6.39/arch/parisc/include/asm/elf.h
2821--- linux-2.6.39/arch/parisc/include/asm/elf.h 2011-05-19 00:06:34.000000000 -0400
2822+++ linux-2.6.39/arch/parisc/include/asm/elf.h 2011-05-22 19:36:30.000000000 -0400
2823@@ -342,6 +342,13 @@ struct pt_regs; /* forward declaration..
2824
2825 #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE + 0x01000000)
2826
2827+#ifdef CONFIG_PAX_ASLR
2828+#define PAX_ELF_ET_DYN_BASE 0x10000UL
2829+
2830+#define PAX_DELTA_MMAP_LEN 16
2831+#define PAX_DELTA_STACK_LEN 16
2832+#endif
2833+
2834 /* This yields a mask that user programs can use to figure out what
2835 instruction set this CPU supports. This could be done in user space,
2836 but it's not easy, and we've already done it here. */
2837diff -urNp linux-2.6.39/arch/parisc/include/asm/pgtable.h linux-2.6.39/arch/parisc/include/asm/pgtable.h
2838--- linux-2.6.39/arch/parisc/include/asm/pgtable.h 2011-05-19 00:06:34.000000000 -0400
2839+++ linux-2.6.39/arch/parisc/include/asm/pgtable.h 2011-05-22 19:36:30.000000000 -0400
2840@@ -207,6 +207,17 @@ struct vm_area_struct;
2841 #define PAGE_EXECREAD __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_EXEC |_PAGE_ACCESSED)
2842 #define PAGE_COPY PAGE_EXECREAD
2843 #define PAGE_RWX __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_WRITE | _PAGE_EXEC |_PAGE_ACCESSED)
2844+
2845+#ifdef CONFIG_PAX_PAGEEXEC
2846+# define PAGE_SHARED_NOEXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_WRITE | _PAGE_ACCESSED)
2847+# define PAGE_COPY_NOEXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_ACCESSED)
2848+# define PAGE_READONLY_NOEXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_ACCESSED)
2849+#else
2850+# define PAGE_SHARED_NOEXEC PAGE_SHARED
2851+# define PAGE_COPY_NOEXEC PAGE_COPY
2852+# define PAGE_READONLY_NOEXEC PAGE_READONLY
2853+#endif
2854+
2855 #define PAGE_KERNEL __pgprot(_PAGE_KERNEL)
2856 #define PAGE_KERNEL_RO __pgprot(_PAGE_KERNEL & ~_PAGE_WRITE)
2857 #define PAGE_KERNEL_UNC __pgprot(_PAGE_KERNEL | _PAGE_NO_CACHE)
2858diff -urNp linux-2.6.39/arch/parisc/kernel/module.c linux-2.6.39/arch/parisc/kernel/module.c
2859--- linux-2.6.39/arch/parisc/kernel/module.c 2011-05-19 00:06:34.000000000 -0400
2860+++ linux-2.6.39/arch/parisc/kernel/module.c 2011-05-22 19:36:30.000000000 -0400
2861@@ -96,16 +96,38 @@
2862
2863 /* three functions to determine where in the module core
2864 * or init pieces the location is */
2865+static inline int in_init_rx(struct module *me, void *loc)
2866+{
2867+ return (loc >= me->module_init_rx &&
2868+ loc < (me->module_init_rx + me->init_size_rx));
2869+}
2870+
2871+static inline int in_init_rw(struct module *me, void *loc)
2872+{
2873+ return (loc >= me->module_init_rw &&
2874+ loc < (me->module_init_rw + me->init_size_rw));
2875+}
2876+
2877 static inline int in_init(struct module *me, void *loc)
2878 {
2879- return (loc >= me->module_init &&
2880- loc <= (me->module_init + me->init_size));
2881+ return in_init_rx(me, loc) || in_init_rw(me, loc);
2882+}
2883+
2884+static inline int in_core_rx(struct module *me, void *loc)
2885+{
2886+ return (loc >= me->module_core_rx &&
2887+ loc < (me->module_core_rx + me->core_size_rx));
2888+}
2889+
2890+static inline int in_core_rw(struct module *me, void *loc)
2891+{
2892+ return (loc >= me->module_core_rw &&
2893+ loc < (me->module_core_rw + me->core_size_rw));
2894 }
2895
2896 static inline int in_core(struct module *me, void *loc)
2897 {
2898- return (loc >= me->module_core &&
2899- loc <= (me->module_core + me->core_size));
2900+ return in_core_rx(me, loc) || in_core_rw(me, loc);
2901 }
2902
2903 static inline int in_local(struct module *me, void *loc)
2904@@ -365,13 +387,13 @@ int module_frob_arch_sections(CONST Elf_
2905 }
2906
2907 /* align things a bit */
2908- me->core_size = ALIGN(me->core_size, 16);
2909- me->arch.got_offset = me->core_size;
2910- me->core_size += gots * sizeof(struct got_entry);
2911-
2912- me->core_size = ALIGN(me->core_size, 16);
2913- me->arch.fdesc_offset = me->core_size;
2914- me->core_size += fdescs * sizeof(Elf_Fdesc);
2915+ me->core_size_rw = ALIGN(me->core_size_rw, 16);
2916+ me->arch.got_offset = me->core_size_rw;
2917+ me->core_size_rw += gots * sizeof(struct got_entry);
2918+
2919+ me->core_size_rw = ALIGN(me->core_size_rw, 16);
2920+ me->arch.fdesc_offset = me->core_size_rw;
2921+ me->core_size_rw += fdescs * sizeof(Elf_Fdesc);
2922
2923 me->arch.got_max = gots;
2924 me->arch.fdesc_max = fdescs;
2925@@ -389,7 +411,7 @@ static Elf64_Word get_got(struct module
2926
2927 BUG_ON(value == 0);
2928
2929- got = me->module_core + me->arch.got_offset;
2930+ got = me->module_core_rw + me->arch.got_offset;
2931 for (i = 0; got[i].addr; i++)
2932 if (got[i].addr == value)
2933 goto out;
2934@@ -407,7 +429,7 @@ static Elf64_Word get_got(struct module
2935 #ifdef CONFIG_64BIT
2936 static Elf_Addr get_fdesc(struct module *me, unsigned long value)
2937 {
2938- Elf_Fdesc *fdesc = me->module_core + me->arch.fdesc_offset;
2939+ Elf_Fdesc *fdesc = me->module_core_rw + me->arch.fdesc_offset;
2940
2941 if (!value) {
2942 printk(KERN_ERR "%s: zero OPD requested!\n", me->name);
2943@@ -425,7 +447,7 @@ static Elf_Addr get_fdesc(struct module
2944
2945 /* Create new one */
2946 fdesc->addr = value;
2947- fdesc->gp = (Elf_Addr)me->module_core + me->arch.got_offset;
2948+ fdesc->gp = (Elf_Addr)me->module_core_rw + me->arch.got_offset;
2949 return (Elf_Addr)fdesc;
2950 }
2951 #endif /* CONFIG_64BIT */
2952@@ -849,7 +871,7 @@ register_unwind_table(struct module *me,
2953
2954 table = (unsigned char *)sechdrs[me->arch.unwind_section].sh_addr;
2955 end = table + sechdrs[me->arch.unwind_section].sh_size;
2956- gp = (Elf_Addr)me->module_core + me->arch.got_offset;
2957+ gp = (Elf_Addr)me->module_core_rw + me->arch.got_offset;
2958
2959 DEBUGP("register_unwind_table(), sect = %d at 0x%p - 0x%p (gp=0x%lx)\n",
2960 me->arch.unwind_section, table, end, gp);
2961diff -urNp linux-2.6.39/arch/parisc/kernel/sys_parisc.c linux-2.6.39/arch/parisc/kernel/sys_parisc.c
2962--- linux-2.6.39/arch/parisc/kernel/sys_parisc.c 2011-05-19 00:06:34.000000000 -0400
2963+++ linux-2.6.39/arch/parisc/kernel/sys_parisc.c 2011-05-22 19:36:30.000000000 -0400
2964@@ -43,7 +43,7 @@ static unsigned long get_unshared_area(u
2965 /* At this point: (!vma || addr < vma->vm_end). */
2966 if (TASK_SIZE - len < addr)
2967 return -ENOMEM;
2968- if (!vma || addr + len <= vma->vm_start)
2969+ if (check_heap_stack_gap(vma, addr, len))
2970 return addr;
2971 addr = vma->vm_end;
2972 }
2973@@ -79,7 +79,7 @@ static unsigned long get_shared_area(str
2974 /* At this point: (!vma || addr < vma->vm_end). */
2975 if (TASK_SIZE - len < addr)
2976 return -ENOMEM;
2977- if (!vma || addr + len <= vma->vm_start)
2978+ if (check_heap_stack_gap(vma, addr, len))
2979 return addr;
2980 addr = DCACHE_ALIGN(vma->vm_end - offset) + offset;
2981 if (addr < vma->vm_end) /* handle wraparound */
2982@@ -98,7 +98,7 @@ unsigned long arch_get_unmapped_area(str
2983 if (flags & MAP_FIXED)
2984 return addr;
2985 if (!addr)
2986- addr = TASK_UNMAPPED_BASE;
2987+ addr = current->mm->mmap_base;
2988
2989 if (filp) {
2990 addr = get_shared_area(filp->f_mapping, addr, len, pgoff);
2991diff -urNp linux-2.6.39/arch/parisc/kernel/traps.c linux-2.6.39/arch/parisc/kernel/traps.c
2992--- linux-2.6.39/arch/parisc/kernel/traps.c 2011-05-19 00:06:34.000000000 -0400
2993+++ linux-2.6.39/arch/parisc/kernel/traps.c 2011-05-22 19:36:30.000000000 -0400
2994@@ -733,9 +733,7 @@ void notrace handle_interruption(int cod
2995
2996 down_read(&current->mm->mmap_sem);
2997 vma = find_vma(current->mm,regs->iaoq[0]);
2998- if (vma && (regs->iaoq[0] >= vma->vm_start)
2999- && (vma->vm_flags & VM_EXEC)) {
3000-
3001+ if (vma && (regs->iaoq[0] >= vma->vm_start)) {
3002 fault_address = regs->iaoq[0];
3003 fault_space = regs->iasq[0];
3004
3005diff -urNp linux-2.6.39/arch/parisc/mm/fault.c linux-2.6.39/arch/parisc/mm/fault.c
3006--- linux-2.6.39/arch/parisc/mm/fault.c 2011-05-19 00:06:34.000000000 -0400
3007+++ linux-2.6.39/arch/parisc/mm/fault.c 2011-05-22 19:36:30.000000000 -0400
3008@@ -15,6 +15,7 @@
3009 #include <linux/sched.h>
3010 #include <linux/interrupt.h>
3011 #include <linux/module.h>
3012+#include <linux/unistd.h>
3013
3014 #include <asm/uaccess.h>
3015 #include <asm/traps.h>
3016@@ -52,7 +53,7 @@ DEFINE_PER_CPU(struct exception_data, ex
3017 static unsigned long
3018 parisc_acctyp(unsigned long code, unsigned int inst)
3019 {
3020- if (code == 6 || code == 16)
3021+ if (code == 6 || code == 7 || code == 16)
3022 return VM_EXEC;
3023
3024 switch (inst & 0xf0000000) {
3025@@ -138,6 +139,116 @@ parisc_acctyp(unsigned long code, unsign
3026 }
3027 #endif
3028
3029+#ifdef CONFIG_PAX_PAGEEXEC
3030+/*
3031+ * PaX: decide what to do with offenders (instruction_pointer(regs) = fault address)
3032+ *
3033+ * returns 1 when task should be killed
3034+ * 2 when rt_sigreturn trampoline was detected
3035+ * 3 when unpatched PLT trampoline was detected
3036+ */
3037+static int pax_handle_fetch_fault(struct pt_regs *regs)
3038+{
3039+
3040+#ifdef CONFIG_PAX_EMUPLT
3041+ int err;
3042+
3043+ do { /* PaX: unpatched PLT emulation */
3044+ unsigned int bl, depwi;
3045+
3046+ err = get_user(bl, (unsigned int *)instruction_pointer(regs));
3047+ err |= get_user(depwi, (unsigned int *)(instruction_pointer(regs)+4));
3048+
3049+ if (err)
3050+ break;
3051+
3052+ if (bl == 0xEA9F1FDDU && depwi == 0xD6801C1EU) {
3053+ unsigned int ldw, bv, ldw2, addr = instruction_pointer(regs)-12;
3054+
3055+ err = get_user(ldw, (unsigned int *)addr);
3056+ err |= get_user(bv, (unsigned int *)(addr+4));
3057+ err |= get_user(ldw2, (unsigned int *)(addr+8));
3058+
3059+ if (err)
3060+ break;
3061+
3062+ if (ldw == 0x0E801096U &&
3063+ bv == 0xEAC0C000U &&
3064+ ldw2 == 0x0E881095U)
3065+ {
3066+ unsigned int resolver, map;
3067+
3068+ err = get_user(resolver, (unsigned int *)(instruction_pointer(regs)+8));
3069+ err |= get_user(map, (unsigned int *)(instruction_pointer(regs)+12));
3070+ if (err)
3071+ break;
3072+
3073+ regs->gr[20] = instruction_pointer(regs)+8;
3074+ regs->gr[21] = map;
3075+ regs->gr[22] = resolver;
3076+ regs->iaoq[0] = resolver | 3UL;
3077+ regs->iaoq[1] = regs->iaoq[0] + 4;
3078+ return 3;
3079+ }
3080+ }
3081+ } while (0);
3082+#endif
3083+
3084+#ifdef CONFIG_PAX_EMUTRAMP
3085+
3086+#ifndef CONFIG_PAX_EMUSIGRT
3087+ if (!(current->mm->pax_flags & MF_PAX_EMUTRAMP))
3088+ return 1;
3089+#endif
3090+
3091+ do { /* PaX: rt_sigreturn emulation */
3092+ unsigned int ldi1, ldi2, bel, nop;
3093+
3094+ err = get_user(ldi1, (unsigned int *)instruction_pointer(regs));
3095+ err |= get_user(ldi2, (unsigned int *)(instruction_pointer(regs)+4));
3096+ err |= get_user(bel, (unsigned int *)(instruction_pointer(regs)+8));
3097+ err |= get_user(nop, (unsigned int *)(instruction_pointer(regs)+12));
3098+
3099+ if (err)
3100+ break;
3101+
3102+ if ((ldi1 == 0x34190000U || ldi1 == 0x34190002U) &&
3103+ ldi2 == 0x3414015AU &&
3104+ bel == 0xE4008200U &&
3105+ nop == 0x08000240U)
3106+ {
3107+ regs->gr[25] = (ldi1 & 2) >> 1;
3108+ regs->gr[20] = __NR_rt_sigreturn;
3109+ regs->gr[31] = regs->iaoq[1] + 16;
3110+ regs->sr[0] = regs->iasq[1];
3111+ regs->iaoq[0] = 0x100UL;
3112+ regs->iaoq[1] = regs->iaoq[0] + 4;
3113+ regs->iasq[0] = regs->sr[2];
3114+ regs->iasq[1] = regs->sr[2];
3115+ return 2;
3116+ }
3117+ } while (0);
3118+#endif
3119+
3120+ return 1;
3121+}
3122+
3123+void pax_report_insns(void *pc, void *sp)
3124+{
3125+ unsigned long i;
3126+
3127+ printk(KERN_ERR "PAX: bytes at PC: ");
3128+ for (i = 0; i < 5; i++) {
3129+ unsigned int c;
3130+ if (get_user(c, (unsigned int *)pc+i))
3131+ printk(KERN_CONT "???????? ");
3132+ else
3133+ printk(KERN_CONT "%08x ", c);
3134+ }
3135+ printk("\n");
3136+}
3137+#endif
3138+
3139 int fixup_exception(struct pt_regs *regs)
3140 {
3141 const struct exception_table_entry *fix;
3142@@ -192,8 +303,33 @@ good_area:
3143
3144 acc_type = parisc_acctyp(code,regs->iir);
3145
3146- if ((vma->vm_flags & acc_type) != acc_type)
3147+ if ((vma->vm_flags & acc_type) != acc_type) {
3148+
3149+#ifdef CONFIG_PAX_PAGEEXEC
3150+ if ((mm->pax_flags & MF_PAX_PAGEEXEC) && (acc_type & VM_EXEC) &&
3151+ (address & ~3UL) == instruction_pointer(regs))
3152+ {
3153+ up_read(&mm->mmap_sem);
3154+ switch (pax_handle_fetch_fault(regs)) {
3155+
3156+#ifdef CONFIG_PAX_EMUPLT
3157+ case 3:
3158+ return;
3159+#endif
3160+
3161+#ifdef CONFIG_PAX_EMUTRAMP
3162+ case 2:
3163+ return;
3164+#endif
3165+
3166+ }
3167+ pax_report_fault(regs, (void *)instruction_pointer(regs), (void *)regs->gr[30]);
3168+ do_group_exit(SIGKILL);
3169+ }
3170+#endif
3171+
3172 goto bad_area;
3173+ }
3174
3175 /*
3176 * If for any reason at all we couldn't handle the fault, make
3177diff -urNp linux-2.6.39/arch/powerpc/include/asm/device.h linux-2.6.39/arch/powerpc/include/asm/device.h
3178--- linux-2.6.39/arch/powerpc/include/asm/device.h 2011-05-19 00:06:34.000000000 -0400
3179+++ linux-2.6.39/arch/powerpc/include/asm/device.h 2011-05-22 19:36:30.000000000 -0400
3180@@ -17,7 +17,7 @@ struct device_node;
3181 */
3182 struct dev_archdata {
3183 /* DMA operations on that device */
3184- struct dma_map_ops *dma_ops;
3185+ const struct dma_map_ops *dma_ops;
3186
3187 /*
3188 * When an iommu is in use, dma_data is used as a ptr to the base of the
3189diff -urNp linux-2.6.39/arch/powerpc/include/asm/dma-mapping.h linux-2.6.39/arch/powerpc/include/asm/dma-mapping.h
3190--- linux-2.6.39/arch/powerpc/include/asm/dma-mapping.h 2011-05-19 00:06:34.000000000 -0400
3191+++ linux-2.6.39/arch/powerpc/include/asm/dma-mapping.h 2011-05-22 19:36:30.000000000 -0400
3192@@ -67,12 +67,13 @@ static inline unsigned long device_to_ma
3193 /*
3194 * Available generic sets of operations
3195 */
3196+/* cannot be const */
3197 #ifdef CONFIG_PPC64
3198-extern struct dma_map_ops dma_iommu_ops;
3199+extern const struct dma_map_ops dma_iommu_ops;
3200 #endif
3201-extern struct dma_map_ops dma_direct_ops;
3202+extern const struct dma_map_ops dma_direct_ops;
3203
3204-static inline struct dma_map_ops *get_dma_ops(struct device *dev)
3205+static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
3206 {
3207 /* We don't handle the NULL dev case for ISA for now. We could
3208 * do it via an out of line call but it is not needed for now. The
3209@@ -85,7 +86,7 @@ static inline struct dma_map_ops *get_dm
3210 return dev->archdata.dma_ops;
3211 }
3212
3213-static inline void set_dma_ops(struct device *dev, struct dma_map_ops *ops)
3214+static inline void set_dma_ops(struct device *dev, const struct dma_map_ops *ops)
3215 {
3216 dev->archdata.dma_ops = ops;
3217 }
3218@@ -119,7 +120,7 @@ static inline void set_dma_offset(struct
3219
3220 static inline int dma_supported(struct device *dev, u64 mask)
3221 {
3222- struct dma_map_ops *dma_ops = get_dma_ops(dev);
3223+ const struct dma_map_ops *dma_ops = get_dma_ops(dev);
3224
3225 if (unlikely(dma_ops == NULL))
3226 return 0;
3227@@ -133,7 +134,7 @@ extern int dma_set_mask(struct device *d
3228 static inline void *dma_alloc_coherent(struct device *dev, size_t size,
3229 dma_addr_t *dma_handle, gfp_t flag)
3230 {
3231- struct dma_map_ops *dma_ops = get_dma_ops(dev);
3232+ const struct dma_map_ops *dma_ops = get_dma_ops(dev);
3233 void *cpu_addr;
3234
3235 BUG_ON(!dma_ops);
3236@@ -148,7 +149,7 @@ static inline void *dma_alloc_coherent(s
3237 static inline void dma_free_coherent(struct device *dev, size_t size,
3238 void *cpu_addr, dma_addr_t dma_handle)
3239 {
3240- struct dma_map_ops *dma_ops = get_dma_ops(dev);
3241+ const struct dma_map_ops *dma_ops = get_dma_ops(dev);
3242
3243 BUG_ON(!dma_ops);
3244
3245@@ -159,7 +160,7 @@ static inline void dma_free_coherent(str
3246
3247 static inline int dma_mapping_error(struct device *dev, dma_addr_t dma_addr)
3248 {
3249- struct dma_map_ops *dma_ops = get_dma_ops(dev);
3250+ const struct dma_map_ops *dma_ops = get_dma_ops(dev);
3251
3252 if (dma_ops->mapping_error)
3253 return dma_ops->mapping_error(dev, dma_addr);
3254diff -urNp linux-2.6.39/arch/powerpc/include/asm/elf.h linux-2.6.39/arch/powerpc/include/asm/elf.h
3255--- linux-2.6.39/arch/powerpc/include/asm/elf.h 2011-05-19 00:06:34.000000000 -0400
3256+++ linux-2.6.39/arch/powerpc/include/asm/elf.h 2011-05-22 19:36:30.000000000 -0400
3257@@ -178,8 +178,19 @@ typedef elf_fpreg_t elf_vsrreghalf_t32[E
3258 the loader. We need to make sure that it is out of the way of the program
3259 that it will "exec", and that there is sufficient room for the brk. */
3260
3261-extern unsigned long randomize_et_dyn(unsigned long base);
3262-#define ELF_ET_DYN_BASE (randomize_et_dyn(0x20000000))
3263+#define ELF_ET_DYN_BASE (0x20000000)
3264+
3265+#ifdef CONFIG_PAX_ASLR
3266+#define PAX_ELF_ET_DYN_BASE (0x10000000UL)
3267+
3268+#ifdef __powerpc64__
3269+#define PAX_DELTA_MMAP_LEN (is_32bit_task() ? 16 : 28)
3270+#define PAX_DELTA_STACK_LEN (is_32bit_task() ? 16 : 28)
3271+#else
3272+#define PAX_DELTA_MMAP_LEN 15
3273+#define PAX_DELTA_STACK_LEN 15
3274+#endif
3275+#endif
3276
3277 /*
3278 * Our registers are always unsigned longs, whether we're a 32 bit
3279@@ -274,9 +285,6 @@ extern int arch_setup_additional_pages(s
3280 (0x7ff >> (PAGE_SHIFT - 12)) : \
3281 (0x3ffff >> (PAGE_SHIFT - 12)))
3282
3283-extern unsigned long arch_randomize_brk(struct mm_struct *mm);
3284-#define arch_randomize_brk arch_randomize_brk
3285-
3286 #endif /* __KERNEL__ */
3287
3288 /*
3289diff -urNp linux-2.6.39/arch/powerpc/include/asm/iommu.h linux-2.6.39/arch/powerpc/include/asm/iommu.h
3290--- linux-2.6.39/arch/powerpc/include/asm/iommu.h 2011-05-19 00:06:34.000000000 -0400
3291+++ linux-2.6.39/arch/powerpc/include/asm/iommu.h 2011-05-22 19:36:30.000000000 -0400
3292@@ -116,6 +116,9 @@ extern void iommu_init_early_iSeries(voi
3293 extern void iommu_init_early_dart(void);
3294 extern void iommu_init_early_pasemi(void);
3295
3296+/* dma-iommu.c */
3297+extern int dma_iommu_dma_supported(struct device *dev, u64 mask);
3298+
3299 #ifdef CONFIG_PCI
3300 extern void pci_iommu_init(void);
3301 extern void pci_direct_iommu_init(void);
3302diff -urNp linux-2.6.39/arch/powerpc/include/asm/kmap_types.h linux-2.6.39/arch/powerpc/include/asm/kmap_types.h
3303--- linux-2.6.39/arch/powerpc/include/asm/kmap_types.h 2011-05-19 00:06:34.000000000 -0400
3304+++ linux-2.6.39/arch/powerpc/include/asm/kmap_types.h 2011-05-22 19:36:30.000000000 -0400
3305@@ -27,6 +27,7 @@ enum km_type {
3306 KM_PPC_SYNC_PAGE,
3307 KM_PPC_SYNC_ICACHE,
3308 KM_KDB,
3309+ KM_CLEARPAGE,
3310 KM_TYPE_NR
3311 };
3312
3313diff -urNp linux-2.6.39/arch/powerpc/include/asm/page_64.h linux-2.6.39/arch/powerpc/include/asm/page_64.h
3314--- linux-2.6.39/arch/powerpc/include/asm/page_64.h 2011-05-19 00:06:34.000000000 -0400
3315+++ linux-2.6.39/arch/powerpc/include/asm/page_64.h 2011-05-22 19:36:30.000000000 -0400
3316@@ -172,15 +172,18 @@ do { \
3317 * stack by default, so in the absence of a PT_GNU_STACK program header
3318 * we turn execute permission off.
3319 */
3320-#define VM_STACK_DEFAULT_FLAGS32 (VM_READ | VM_WRITE | VM_EXEC | \
3321- VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
3322+#define VM_STACK_DEFAULT_FLAGS32 \
3323+ (((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0) | \
3324+ VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
3325
3326 #define VM_STACK_DEFAULT_FLAGS64 (VM_READ | VM_WRITE | \
3327 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
3328
3329+#ifndef CONFIG_PAX_PAGEEXEC
3330 #define VM_STACK_DEFAULT_FLAGS \
3331 (is_32bit_task() ? \
3332 VM_STACK_DEFAULT_FLAGS32 : VM_STACK_DEFAULT_FLAGS64)
3333+#endif
3334
3335 #include <asm-generic/getorder.h>
3336
3337diff -urNp linux-2.6.39/arch/powerpc/include/asm/page.h linux-2.6.39/arch/powerpc/include/asm/page.h
3338--- linux-2.6.39/arch/powerpc/include/asm/page.h 2011-05-19 00:06:34.000000000 -0400
3339+++ linux-2.6.39/arch/powerpc/include/asm/page.h 2011-05-22 19:36:30.000000000 -0400
3340@@ -129,8 +129,9 @@ extern phys_addr_t kernstart_addr;
3341 * and needs to be executable. This means the whole heap ends
3342 * up being executable.
3343 */
3344-#define VM_DATA_DEFAULT_FLAGS32 (VM_READ | VM_WRITE | VM_EXEC | \
3345- VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
3346+#define VM_DATA_DEFAULT_FLAGS32 \
3347+ (((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0) | \
3348+ VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
3349
3350 #define VM_DATA_DEFAULT_FLAGS64 (VM_READ | VM_WRITE | \
3351 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
3352@@ -158,6 +159,9 @@ extern phys_addr_t kernstart_addr;
3353 #define is_kernel_addr(x) ((x) >= PAGE_OFFSET)
3354 #endif
3355
3356+#define ktla_ktva(addr) (addr)
3357+#define ktva_ktla(addr) (addr)
3358+
3359 #ifndef __ASSEMBLY__
3360
3361 #undef STRICT_MM_TYPECHECKS
3362diff -urNp linux-2.6.39/arch/powerpc/include/asm/pci.h linux-2.6.39/arch/powerpc/include/asm/pci.h
3363--- linux-2.6.39/arch/powerpc/include/asm/pci.h 2011-05-19 00:06:34.000000000 -0400
3364+++ linux-2.6.39/arch/powerpc/include/asm/pci.h 2011-05-22 19:36:30.000000000 -0400
3365@@ -65,8 +65,8 @@ static inline int pci_get_legacy_ide_irq
3366 }
3367
3368 #ifdef CONFIG_PCI
3369-extern void set_pci_dma_ops(struct dma_map_ops *dma_ops);
3370-extern struct dma_map_ops *get_pci_dma_ops(void);
3371+extern void set_pci_dma_ops(const struct dma_map_ops *dma_ops);
3372+extern const struct dma_map_ops *get_pci_dma_ops(void);
3373 #else /* CONFIG_PCI */
3374 #define set_pci_dma_ops(d)
3375 #define get_pci_dma_ops() NULL
3376diff -urNp linux-2.6.39/arch/powerpc/include/asm/pgtable.h linux-2.6.39/arch/powerpc/include/asm/pgtable.h
3377--- linux-2.6.39/arch/powerpc/include/asm/pgtable.h 2011-05-19 00:06:34.000000000 -0400
3378+++ linux-2.6.39/arch/powerpc/include/asm/pgtable.h 2011-05-22 19:36:30.000000000 -0400
3379@@ -2,6 +2,7 @@
3380 #define _ASM_POWERPC_PGTABLE_H
3381 #ifdef __KERNEL__
3382
3383+#include <linux/const.h>
3384 #ifndef __ASSEMBLY__
3385 #include <asm/processor.h> /* For TASK_SIZE */
3386 #include <asm/mmu.h>
3387diff -urNp linux-2.6.39/arch/powerpc/include/asm/pte-hash32.h linux-2.6.39/arch/powerpc/include/asm/pte-hash32.h
3388--- linux-2.6.39/arch/powerpc/include/asm/pte-hash32.h 2011-05-19 00:06:34.000000000 -0400
3389+++ linux-2.6.39/arch/powerpc/include/asm/pte-hash32.h 2011-05-22 19:36:30.000000000 -0400
3390@@ -21,6 +21,7 @@
3391 #define _PAGE_FILE 0x004 /* when !present: nonlinear file mapping */
3392 #define _PAGE_USER 0x004 /* usermode access allowed */
3393 #define _PAGE_GUARDED 0x008 /* G: prohibit speculative access */
3394+#define _PAGE_EXEC _PAGE_GUARDED
3395 #define _PAGE_COHERENT 0x010 /* M: enforce memory coherence (SMP systems) */
3396 #define _PAGE_NO_CACHE 0x020 /* I: cache inhibit */
3397 #define _PAGE_WRITETHRU 0x040 /* W: cache write-through */
3398diff -urNp linux-2.6.39/arch/powerpc/include/asm/reg.h linux-2.6.39/arch/powerpc/include/asm/reg.h
3399--- linux-2.6.39/arch/powerpc/include/asm/reg.h 2011-05-19 00:06:34.000000000 -0400
3400+++ linux-2.6.39/arch/powerpc/include/asm/reg.h 2011-05-22 19:36:30.000000000 -0400
3401@@ -201,6 +201,7 @@
3402 #define SPRN_DBCR 0x136 /* e300 Data Breakpoint Control Reg */
3403 #define SPRN_DSISR 0x012 /* Data Storage Interrupt Status Register */
3404 #define DSISR_NOHPTE 0x40000000 /* no translation found */
3405+#define DSISR_GUARDED 0x10000000 /* fetch from guarded storage */
3406 #define DSISR_PROTFAULT 0x08000000 /* protection fault */
3407 #define DSISR_ISSTORE 0x02000000 /* access was a store */
3408 #define DSISR_DABRMATCH 0x00400000 /* hit data breakpoint */
3409diff -urNp linux-2.6.39/arch/powerpc/include/asm/swiotlb.h linux-2.6.39/arch/powerpc/include/asm/swiotlb.h
3410--- linux-2.6.39/arch/powerpc/include/asm/swiotlb.h 2011-05-19 00:06:34.000000000 -0400
3411+++ linux-2.6.39/arch/powerpc/include/asm/swiotlb.h 2011-05-22 19:36:30.000000000 -0400
3412@@ -13,7 +13,7 @@
3413
3414 #include <linux/swiotlb.h>
3415
3416-extern struct dma_map_ops swiotlb_dma_ops;
3417+extern const struct dma_map_ops swiotlb_dma_ops;
3418
3419 static inline void dma_mark_clean(void *addr, size_t size) {}
3420
3421diff -urNp linux-2.6.39/arch/powerpc/include/asm/system.h linux-2.6.39/arch/powerpc/include/asm/system.h
3422--- linux-2.6.39/arch/powerpc/include/asm/system.h 2011-05-19 00:06:34.000000000 -0400
3423+++ linux-2.6.39/arch/powerpc/include/asm/system.h 2011-05-22 19:36:30.000000000 -0400
3424@@ -533,7 +533,7 @@ __cmpxchg_local(volatile void *ptr, unsi
3425 #define cmpxchg64_local(ptr, o, n) __cmpxchg64_local_generic((ptr), (o), (n))
3426 #endif
3427
3428-extern unsigned long arch_align_stack(unsigned long sp);
3429+#define arch_align_stack(x) ((x) & ~0xfUL)
3430
3431 /* Used in very early kernel initialization. */
3432 extern unsigned long reloc_offset(void);
3433diff -urNp linux-2.6.39/arch/powerpc/include/asm/uaccess.h linux-2.6.39/arch/powerpc/include/asm/uaccess.h
3434--- linux-2.6.39/arch/powerpc/include/asm/uaccess.h 2011-05-19 00:06:34.000000000 -0400
3435+++ linux-2.6.39/arch/powerpc/include/asm/uaccess.h 2011-05-22 19:36:30.000000000 -0400
3436@@ -13,6 +13,8 @@
3437 #define VERIFY_READ 0
3438 #define VERIFY_WRITE 1
3439
3440+extern void check_object_size(const void *ptr, unsigned long n, bool to);
3441+
3442 /*
3443 * The fs value determines whether argument validity checking should be
3444 * performed or not. If get_fs() == USER_DS, checking is performed, with
3445@@ -327,52 +329,6 @@ do { \
3446 extern unsigned long __copy_tofrom_user(void __user *to,
3447 const void __user *from, unsigned long size);
3448
3449-#ifndef __powerpc64__
3450-
3451-static inline unsigned long copy_from_user(void *to,
3452- const void __user *from, unsigned long n)
3453-{
3454- unsigned long over;
3455-
3456- if (access_ok(VERIFY_READ, from, n))
3457- return __copy_tofrom_user((__force void __user *)to, from, n);
3458- if ((unsigned long)from < TASK_SIZE) {
3459- over = (unsigned long)from + n - TASK_SIZE;
3460- return __copy_tofrom_user((__force void __user *)to, from,
3461- n - over) + over;
3462- }
3463- return n;
3464-}
3465-
3466-static inline unsigned long copy_to_user(void __user *to,
3467- const void *from, unsigned long n)
3468-{
3469- unsigned long over;
3470-
3471- if (access_ok(VERIFY_WRITE, to, n))
3472- return __copy_tofrom_user(to, (__force void __user *)from, n);
3473- if ((unsigned long)to < TASK_SIZE) {
3474- over = (unsigned long)to + n - TASK_SIZE;
3475- return __copy_tofrom_user(to, (__force void __user *)from,
3476- n - over) + over;
3477- }
3478- return n;
3479-}
3480-
3481-#else /* __powerpc64__ */
3482-
3483-#define __copy_in_user(to, from, size) \
3484- __copy_tofrom_user((to), (from), (size))
3485-
3486-extern unsigned long copy_from_user(void *to, const void __user *from,
3487- unsigned long n);
3488-extern unsigned long copy_to_user(void __user *to, const void *from,
3489- unsigned long n);
3490-extern unsigned long copy_in_user(void __user *to, const void __user *from,
3491- unsigned long n);
3492-
3493-#endif /* __powerpc64__ */
3494-
3495 static inline unsigned long __copy_from_user_inatomic(void *to,
3496 const void __user *from, unsigned long n)
3497 {
3498@@ -396,6 +352,10 @@ static inline unsigned long __copy_from_
3499 if (ret == 0)
3500 return 0;
3501 }
3502+
3503+ if (!__builtin_constant_p(n))
3504+ check_object_size(to, n, false);
3505+
3506 return __copy_tofrom_user((__force void __user *)to, from, n);
3507 }
3508
3509@@ -422,6 +382,10 @@ static inline unsigned long __copy_to_us
3510 if (ret == 0)
3511 return 0;
3512 }
3513+
3514+ if (!__builtin_constant_p(n))
3515+ check_object_size(from, n, true);
3516+
3517 return __copy_tofrom_user(to, (__force const void __user *)from, n);
3518 }
3519
3520@@ -439,6 +403,92 @@ static inline unsigned long __copy_to_us
3521 return __copy_to_user_inatomic(to, from, size);
3522 }
3523
3524+#ifndef __powerpc64__
3525+
3526+static inline unsigned long __must_check copy_from_user(void *to,
3527+ const void __user *from, unsigned long n)
3528+{
3529+ unsigned long over;
3530+
3531+ if ((long)n < 0)
3532+ return n;
3533+
3534+ if (access_ok(VERIFY_READ, from, n)) {
3535+ if (!__builtin_constant_p(n))
3536+ check_object_size(to, n, false);
3537+ return __copy_tofrom_user((__force void __user *)to, from, n);
3538+ }
3539+ if ((unsigned long)from < TASK_SIZE) {
3540+ over = (unsigned long)from + n - TASK_SIZE;
3541+ if (!__builtin_constant_p(n - over))
3542+ check_object_size(to, n - over, false);
3543+ return __copy_tofrom_user((__force void __user *)to, from,
3544+ n - over) + over;
3545+ }
3546+ return n;
3547+}
3548+
3549+static inline unsigned long __must_check copy_to_user(void __user *to,
3550+ const void *from, unsigned long n)
3551+{
3552+ unsigned long over;
3553+
3554+ if ((long)n < 0)
3555+ return n;
3556+
3557+ if (access_ok(VERIFY_WRITE, to, n)) {
3558+ if (!__builtin_constant_p(n))
3559+ check_object_size(from, n, true);
3560+ return __copy_tofrom_user(to, (__force void __user *)from, n);
3561+ }
3562+ if ((unsigned long)to < TASK_SIZE) {
3563+ over = (unsigned long)to + n - TASK_SIZE;
3564+ if (!__builtin_constant_p(n))
3565+ check_object_size(from, n - over, true);
3566+ return __copy_tofrom_user(to, (__force void __user *)from,
3567+ n - over) + over;
3568+ }
3569+ return n;
3570+}
3571+
3572+#else /* __powerpc64__ */
3573+
3574+#define __copy_in_user(to, from, size) \
3575+ __copy_tofrom_user((to), (from), (size))
3576+
3577+static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
3578+{
3579+ if ((long)n < 0 || n > INT_MAX)
3580+ return n;
3581+
3582+ if (!__builtin_constant_p(n))
3583+ check_object_size(to, n, false);
3584+
3585+ if (likely(access_ok(VERIFY_READ, from, n)))
3586+ n = __copy_from_user(to, from, n);
3587+ else
3588+ memset(to, 0, n);
3589+ return n;
3590+}
3591+
3592+static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n)
3593+{
3594+ if ((long)n < 0 || n > INT_MAX)
3595+ return n;
3596+
3597+ if (likely(access_ok(VERIFY_WRITE, to, n))) {
3598+ if (!__builtin_constant_p(n))
3599+ check_object_size(from, n, true);
3600+ n = __copy_to_user(to, from, n);
3601+ }
3602+ return n;
3603+}
3604+
3605+extern unsigned long copy_in_user(void __user *to, const void __user *from,
3606+ unsigned long n);
3607+
3608+#endif /* __powerpc64__ */
3609+
3610 extern unsigned long __clear_user(void __user *addr, unsigned long size);
3611
3612 static inline unsigned long clear_user(void __user *addr, unsigned long size)
3613diff -urNp linux-2.6.39/arch/powerpc/kernel/dma.c linux-2.6.39/arch/powerpc/kernel/dma.c
3614--- linux-2.6.39/arch/powerpc/kernel/dma.c 2011-05-19 00:06:34.000000000 -0400
3615+++ linux-2.6.39/arch/powerpc/kernel/dma.c 2011-05-22 19:36:30.000000000 -0400
3616@@ -136,7 +136,7 @@ static inline void dma_direct_sync_singl
3617 }
3618 #endif
3619
3620-struct dma_map_ops dma_direct_ops = {
3621+const struct dma_map_ops dma_direct_ops = {
3622 .alloc_coherent = dma_direct_alloc_coherent,
3623 .free_coherent = dma_direct_free_coherent,
3624 .map_sg = dma_direct_map_sg,
3625@@ -157,7 +157,7 @@ EXPORT_SYMBOL(dma_direct_ops);
3626
3627 int dma_set_mask(struct device *dev, u64 dma_mask)
3628 {
3629- struct dma_map_ops *dma_ops = get_dma_ops(dev);
3630+ const struct dma_map_ops *dma_ops = get_dma_ops(dev);
3631
3632 if (ppc_md.dma_set_mask)
3633 return ppc_md.dma_set_mask(dev, dma_mask);
3634diff -urNp linux-2.6.39/arch/powerpc/kernel/dma-iommu.c linux-2.6.39/arch/powerpc/kernel/dma-iommu.c
3635--- linux-2.6.39/arch/powerpc/kernel/dma-iommu.c 2011-05-19 00:06:34.000000000 -0400
3636+++ linux-2.6.39/arch/powerpc/kernel/dma-iommu.c 2011-05-22 19:36:30.000000000 -0400
3637@@ -70,7 +70,7 @@ static void dma_iommu_unmap_sg(struct de
3638 }
3639
3640 /* We support DMA to/from any memory page via the iommu */
3641-static int dma_iommu_dma_supported(struct device *dev, u64 mask)
3642+int dma_iommu_dma_supported(struct device *dev, u64 mask)
3643 {
3644 struct iommu_table *tbl = get_iommu_table_base(dev);
3645
3646@@ -90,7 +90,7 @@ static int dma_iommu_dma_supported(struc
3647 return 1;
3648 }
3649
3650-struct dma_map_ops dma_iommu_ops = {
3651+struct dma_map_ops dma_iommu_ops = { /* cannot be const, see arch/powerpc/platforms/cell/iommu.c */
3652 .alloc_coherent = dma_iommu_alloc_coherent,
3653 .free_coherent = dma_iommu_free_coherent,
3654 .map_sg = dma_iommu_map_sg,
3655diff -urNp linux-2.6.39/arch/powerpc/kernel/dma-swiotlb.c linux-2.6.39/arch/powerpc/kernel/dma-swiotlb.c
3656--- linux-2.6.39/arch/powerpc/kernel/dma-swiotlb.c 2011-05-19 00:06:34.000000000 -0400
3657+++ linux-2.6.39/arch/powerpc/kernel/dma-swiotlb.c 2011-05-22 19:36:30.000000000 -0400
3658@@ -31,7 +31,7 @@ unsigned int ppc_swiotlb_enable;
3659 * map_page, and unmap_page on highmem, use normal dma_ops
3660 * for everything else.
3661 */
3662-struct dma_map_ops swiotlb_dma_ops = {
3663+const struct dma_map_ops swiotlb_dma_ops = {
3664 .alloc_coherent = dma_direct_alloc_coherent,
3665 .free_coherent = dma_direct_free_coherent,
3666 .map_sg = swiotlb_map_sg_attrs,
3667diff -urNp linux-2.6.39/arch/powerpc/kernel/exceptions-64e.S linux-2.6.39/arch/powerpc/kernel/exceptions-64e.S
3668--- linux-2.6.39/arch/powerpc/kernel/exceptions-64e.S 2011-05-19 00:06:34.000000000 -0400
3669+++ linux-2.6.39/arch/powerpc/kernel/exceptions-64e.S 2011-05-22 19:36:30.000000000 -0400
3670@@ -495,6 +495,7 @@ storage_fault_common:
3671 std r14,_DAR(r1)
3672 std r15,_DSISR(r1)
3673 addi r3,r1,STACK_FRAME_OVERHEAD
3674+ bl .save_nvgprs
3675 mr r4,r14
3676 mr r5,r15
3677 ld r14,PACA_EXGEN+EX_R14(r13)
3678@@ -504,8 +505,7 @@ storage_fault_common:
3679 cmpdi r3,0
3680 bne- 1f
3681 b .ret_from_except_lite
3682-1: bl .save_nvgprs
3683- mr r5,r3
3684+1: mr r5,r3
3685 addi r3,r1,STACK_FRAME_OVERHEAD
3686 ld r4,_DAR(r1)
3687 bl .bad_page_fault
3688diff -urNp linux-2.6.39/arch/powerpc/kernel/exceptions-64s.S linux-2.6.39/arch/powerpc/kernel/exceptions-64s.S
3689--- linux-2.6.39/arch/powerpc/kernel/exceptions-64s.S 2011-05-19 00:06:34.000000000 -0400
3690+++ linux-2.6.39/arch/powerpc/kernel/exceptions-64s.S 2011-05-22 19:36:30.000000000 -0400
3691@@ -848,10 +848,10 @@ handle_page_fault:
3692 11: ld r4,_DAR(r1)
3693 ld r5,_DSISR(r1)
3694 addi r3,r1,STACK_FRAME_OVERHEAD
3695+ bl .save_nvgprs
3696 bl .do_page_fault
3697 cmpdi r3,0
3698 beq+ 13f
3699- bl .save_nvgprs
3700 mr r5,r3
3701 addi r3,r1,STACK_FRAME_OVERHEAD
3702 lwz r4,_DAR(r1)
3703diff -urNp linux-2.6.39/arch/powerpc/kernel/ibmebus.c linux-2.6.39/arch/powerpc/kernel/ibmebus.c
3704--- linux-2.6.39/arch/powerpc/kernel/ibmebus.c 2011-05-19 00:06:34.000000000 -0400
3705+++ linux-2.6.39/arch/powerpc/kernel/ibmebus.c 2011-05-22 19:36:30.000000000 -0400
3706@@ -128,7 +128,7 @@ static int ibmebus_dma_supported(struct
3707 return 1;
3708 }
3709
3710-static struct dma_map_ops ibmebus_dma_ops = {
3711+static const struct dma_map_ops ibmebus_dma_ops = {
3712 .alloc_coherent = ibmebus_alloc_coherent,
3713 .free_coherent = ibmebus_free_coherent,
3714 .map_sg = ibmebus_map_sg,
3715diff -urNp linux-2.6.39/arch/powerpc/kernel/kgdb.c linux-2.6.39/arch/powerpc/kernel/kgdb.c
3716--- linux-2.6.39/arch/powerpc/kernel/kgdb.c 2011-05-19 00:06:34.000000000 -0400
3717+++ linux-2.6.39/arch/powerpc/kernel/kgdb.c 2011-05-22 19:36:30.000000000 -0400
3718@@ -422,7 +422,7 @@ int kgdb_arch_handle_exception(int vecto
3719 /*
3720 * Global data
3721 */
3722-struct kgdb_arch arch_kgdb_ops = {
3723+const struct kgdb_arch arch_kgdb_ops = {
3724 .gdb_bpt_instr = {0x7d, 0x82, 0x10, 0x08},
3725 };
3726
3727diff -urNp linux-2.6.39/arch/powerpc/kernel/module_32.c linux-2.6.39/arch/powerpc/kernel/module_32.c
3728--- linux-2.6.39/arch/powerpc/kernel/module_32.c 2011-05-19 00:06:34.000000000 -0400
3729+++ linux-2.6.39/arch/powerpc/kernel/module_32.c 2011-05-22 19:36:30.000000000 -0400
3730@@ -162,7 +162,7 @@ int module_frob_arch_sections(Elf32_Ehdr
3731 me->arch.core_plt_section = i;
3732 }
3733 if (!me->arch.core_plt_section || !me->arch.init_plt_section) {
3734- printk("Module doesn't contain .plt or .init.plt sections.\n");
3735+ printk("Module %s doesn't contain .plt or .init.plt sections.\n", me->name);
3736 return -ENOEXEC;
3737 }
3738
3739@@ -203,11 +203,16 @@ static uint32_t do_plt_call(void *locati
3740
3741 DEBUGP("Doing plt for call to 0x%x at 0x%x\n", val, (unsigned int)location);
3742 /* Init, or core PLT? */
3743- if (location >= mod->module_core
3744- && location < mod->module_core + mod->core_size)
3745+ if ((location >= mod->module_core_rx && location < mod->module_core_rx + mod->core_size_rx) ||
3746+ (location >= mod->module_core_rw && location < mod->module_core_rw + mod->core_size_rw))
3747 entry = (void *)sechdrs[mod->arch.core_plt_section].sh_addr;
3748- else
3749+ else if ((location >= mod->module_init_rx && location < mod->module_init_rx + mod->init_size_rx) ||
3750+ (location >= mod->module_init_rw && location < mod->module_init_rw + mod->init_size_rw))
3751 entry = (void *)sechdrs[mod->arch.init_plt_section].sh_addr;
3752+ else {
3753+ printk(KERN_ERR "%s: invalid R_PPC_REL24 entry found\n", mod->name);
3754+ return ~0UL;
3755+ }
3756
3757 /* Find this entry, or if that fails, the next avail. entry */
3758 while (entry->jump[0]) {
3759diff -urNp linux-2.6.39/arch/powerpc/kernel/module.c linux-2.6.39/arch/powerpc/kernel/module.c
3760--- linux-2.6.39/arch/powerpc/kernel/module.c 2011-05-19 00:06:34.000000000 -0400
3761+++ linux-2.6.39/arch/powerpc/kernel/module.c 2011-05-22 19:36:30.000000000 -0400
3762@@ -31,11 +31,24 @@
3763
3764 LIST_HEAD(module_bug_list);
3765
3766+#ifdef CONFIG_PAX_KERNEXEC
3767 void *module_alloc(unsigned long size)
3768 {
3769 if (size == 0)
3770 return NULL;
3771
3772+ return vmalloc(size);
3773+}
3774+
3775+void *module_alloc_exec(unsigned long size)
3776+#else
3777+void *module_alloc(unsigned long size)
3778+#endif
3779+
3780+{
3781+ if (size == 0)
3782+ return NULL;
3783+
3784 return vmalloc_exec(size);
3785 }
3786
3787@@ -45,6 +58,13 @@ void module_free(struct module *mod, voi
3788 vfree(module_region);
3789 }
3790
3791+#ifdef CONFIG_PAX_KERNEXEC
3792+void module_free_exec(struct module *mod, void *module_region)
3793+{
3794+ module_free(mod, module_region);
3795+}
3796+#endif
3797+
3798 static const Elf_Shdr *find_section(const Elf_Ehdr *hdr,
3799 const Elf_Shdr *sechdrs,
3800 const char *name)
3801diff -urNp linux-2.6.39/arch/powerpc/kernel/pci-common.c linux-2.6.39/arch/powerpc/kernel/pci-common.c
3802--- linux-2.6.39/arch/powerpc/kernel/pci-common.c 2011-05-19 00:06:34.000000000 -0400
3803+++ linux-2.6.39/arch/powerpc/kernel/pci-common.c 2011-05-22 19:36:30.000000000 -0400
3804@@ -53,14 +53,14 @@ resource_size_t isa_mem_base;
3805 unsigned int ppc_pci_flags = 0;
3806
3807
3808-static struct dma_map_ops *pci_dma_ops = &dma_direct_ops;
3809+static const struct dma_map_ops *pci_dma_ops = &dma_direct_ops;
3810
3811-void set_pci_dma_ops(struct dma_map_ops *dma_ops)
3812+void set_pci_dma_ops(const struct dma_map_ops *dma_ops)
3813 {
3814 pci_dma_ops = dma_ops;
3815 }
3816
3817-struct dma_map_ops *get_pci_dma_ops(void)
3818+const struct dma_map_ops *get_pci_dma_ops(void)
3819 {
3820 return pci_dma_ops;
3821 }
3822@@ -1639,7 +1639,7 @@ null_write_config(struct pci_bus *bus, u
3823 return PCIBIOS_DEVICE_NOT_FOUND;
3824 }
3825
3826-static struct pci_ops null_pci_ops =
3827+static const struct pci_ops null_pci_ops =
3828 {
3829 .read = null_read_config,
3830 .write = null_write_config,
3831diff -urNp linux-2.6.39/arch/powerpc/kernel/process.c linux-2.6.39/arch/powerpc/kernel/process.c
3832--- linux-2.6.39/arch/powerpc/kernel/process.c 2011-05-19 00:06:34.000000000 -0400
3833+++ linux-2.6.39/arch/powerpc/kernel/process.c 2011-05-22 19:41:32.000000000 -0400
3834@@ -655,8 +655,8 @@ void show_regs(struct pt_regs * regs)
3835 * Lookup NIP late so we have the best change of getting the
3836 * above info out without failing
3837 */
3838- printk("NIP ["REG"] %pS\n", regs->nip, (void *)regs->nip);
3839- printk("LR ["REG"] %pS\n", regs->link, (void *)regs->link);
3840+ printk("NIP ["REG"] %pA\n", regs->nip, (void *)regs->nip);
3841+ printk("LR ["REG"] %pA\n", regs->link, (void *)regs->link);
3842 #endif
3843 show_stack(current, (unsigned long *) regs->gpr[1]);
3844 if (!user_mode(regs))
3845@@ -1146,10 +1146,10 @@ void show_stack(struct task_struct *tsk,
3846 newsp = stack[0];
3847 ip = stack[STACK_FRAME_LR_SAVE];
3848 if (!firstframe || ip != lr) {
3849- printk("["REG"] ["REG"] %pS", sp, ip, (void *)ip);
3850+ printk("["REG"] ["REG"] %pA", sp, ip, (void *)ip);
3851 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
3852 if ((ip == rth || ip == mrth) && curr_frame >= 0) {
3853- printk(" (%pS)",
3854+ printk(" (%pA)",
3855 (void *)current->ret_stack[curr_frame].ret);
3856 curr_frame--;
3857 }
3858@@ -1169,7 +1169,7 @@ void show_stack(struct task_struct *tsk,
3859 struct pt_regs *regs = (struct pt_regs *)
3860 (sp + STACK_FRAME_OVERHEAD);
3861 lr = regs->link;
3862- printk("--- Exception: %lx at %pS\n LR = %pS\n",
3863+ printk("--- Exception: %lx at %pA\n LR = %pA\n",
3864 regs->trap, (void *)regs->nip, (void *)lr);
3865 firstframe = 1;
3866 }
3867@@ -1244,58 +1244,3 @@ void thread_info_cache_init(void)
3868 }
3869
3870 #endif /* THREAD_SHIFT < PAGE_SHIFT */
3871-
3872-unsigned long arch_align_stack(unsigned long sp)
3873-{
3874- if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
3875- sp -= get_random_int() & ~PAGE_MASK;
3876- return sp & ~0xf;
3877-}
3878-
3879-static inline unsigned long brk_rnd(void)
3880-{
3881- unsigned long rnd = 0;
3882-
3883- /* 8MB for 32bit, 1GB for 64bit */
3884- if (is_32bit_task())
3885- rnd = (long)(get_random_int() % (1<<(23-PAGE_SHIFT)));
3886- else
3887- rnd = (long)(get_random_int() % (1<<(30-PAGE_SHIFT)));
3888-
3889- return rnd << PAGE_SHIFT;
3890-}
3891-
3892-unsigned long arch_randomize_brk(struct mm_struct *mm)
3893-{
3894- unsigned long base = mm->brk;
3895- unsigned long ret;
3896-
3897-#ifdef CONFIG_PPC_STD_MMU_64
3898- /*
3899- * If we are using 1TB segments and we are allowed to randomise
3900- * the heap, we can put it above 1TB so it is backed by a 1TB
3901- * segment. Otherwise the heap will be in the bottom 1TB
3902- * which always uses 256MB segments and this may result in a
3903- * performance penalty.
3904- */
3905- if (!is_32bit_task() && (mmu_highuser_ssize == MMU_SEGSIZE_1T))
3906- base = max_t(unsigned long, mm->brk, 1UL << SID_SHIFT_1T);
3907-#endif
3908-
3909- ret = PAGE_ALIGN(base + brk_rnd());
3910-
3911- if (ret < mm->brk)
3912- return mm->brk;
3913-
3914- return ret;
3915-}
3916-
3917-unsigned long randomize_et_dyn(unsigned long base)
3918-{
3919- unsigned long ret = PAGE_ALIGN(base + brk_rnd());
3920-
3921- if (ret < base)
3922- return base;
3923-
3924- return ret;
3925-}
3926diff -urNp linux-2.6.39/arch/powerpc/kernel/rtas_pci.c linux-2.6.39/arch/powerpc/kernel/rtas_pci.c
3927--- linux-2.6.39/arch/powerpc/kernel/rtas_pci.c 2011-05-19 00:06:34.000000000 -0400
3928+++ linux-2.6.39/arch/powerpc/kernel/rtas_pci.c 2011-05-22 19:36:30.000000000 -0400
3929@@ -149,7 +149,7 @@ static int rtas_pci_write_config(struct
3930 return PCIBIOS_DEVICE_NOT_FOUND;
3931 }
3932
3933-static struct pci_ops rtas_pci_ops = {
3934+static const struct pci_ops rtas_pci_ops = {
3935 .read = rtas_pci_read_config,
3936 .write = rtas_pci_write_config,
3937 };
3938diff -urNp linux-2.6.39/arch/powerpc/kernel/signal_32.c linux-2.6.39/arch/powerpc/kernel/signal_32.c
3939--- linux-2.6.39/arch/powerpc/kernel/signal_32.c 2011-05-19 00:06:34.000000000 -0400
3940+++ linux-2.6.39/arch/powerpc/kernel/signal_32.c 2011-05-22 19:36:30.000000000 -0400
3941@@ -858,7 +858,7 @@ int handle_rt_signal32(unsigned long sig
3942 /* Save user registers on the stack */
3943 frame = &rt_sf->uc.uc_mcontext;
3944 addr = frame;
3945- if (vdso32_rt_sigtramp && current->mm->context.vdso_base) {
3946+ if (vdso32_rt_sigtramp && current->mm->context.vdso_base != ~0UL) {
3947 if (save_user_regs(regs, frame, 0, 1))
3948 goto badframe;
3949 regs->link = current->mm->context.vdso_base + vdso32_rt_sigtramp;
3950diff -urNp linux-2.6.39/arch/powerpc/kernel/signal_64.c linux-2.6.39/arch/powerpc/kernel/signal_64.c
3951--- linux-2.6.39/arch/powerpc/kernel/signal_64.c 2011-05-19 00:06:34.000000000 -0400
3952+++ linux-2.6.39/arch/powerpc/kernel/signal_64.c 2011-05-22 19:36:30.000000000 -0400
3953@@ -429,7 +429,7 @@ int handle_rt_signal64(int signr, struct
3954 current->thread.fpscr.val = 0;
3955
3956 /* Set up to return from userspace. */
3957- if (vdso64_rt_sigtramp && current->mm->context.vdso_base) {
3958+ if (vdso64_rt_sigtramp && current->mm->context.vdso_base != ~0UL) {
3959 regs->link = current->mm->context.vdso_base + vdso64_rt_sigtramp;
3960 } else {
3961 err |= setup_trampoline(__NR_rt_sigreturn, &frame->tramp[0]);
3962diff -urNp linux-2.6.39/arch/powerpc/kernel/vdso.c linux-2.6.39/arch/powerpc/kernel/vdso.c
3963--- linux-2.6.39/arch/powerpc/kernel/vdso.c 2011-05-19 00:06:34.000000000 -0400
3964+++ linux-2.6.39/arch/powerpc/kernel/vdso.c 2011-05-22 19:36:30.000000000 -0400
3965@@ -36,6 +36,7 @@
3966 #include <asm/firmware.h>
3967 #include <asm/vdso.h>
3968 #include <asm/vdso_datapage.h>
3969+#include <asm/mman.h>
3970
3971 #include "setup.h"
3972
3973@@ -220,7 +221,7 @@ int arch_setup_additional_pages(struct l
3974 vdso_base = VDSO32_MBASE;
3975 #endif
3976
3977- current->mm->context.vdso_base = 0;
3978+ current->mm->context.vdso_base = ~0UL;
3979
3980 /* vDSO has a problem and was disabled, just don't "enable" it for the
3981 * process
3982@@ -240,7 +241,7 @@ int arch_setup_additional_pages(struct l
3983 vdso_base = get_unmapped_area(NULL, vdso_base,
3984 (vdso_pages << PAGE_SHIFT) +
3985 ((VDSO_ALIGNMENT - 1) & PAGE_MASK),
3986- 0, 0);
3987+ 0, MAP_PRIVATE | MAP_EXECUTABLE);
3988 if (IS_ERR_VALUE(vdso_base)) {
3989 rc = vdso_base;
3990 goto fail_mmapsem;
3991diff -urNp linux-2.6.39/arch/powerpc/kernel/vio.c linux-2.6.39/arch/powerpc/kernel/vio.c
3992--- linux-2.6.39/arch/powerpc/kernel/vio.c 2011-05-19 00:06:34.000000000 -0400
3993+++ linux-2.6.39/arch/powerpc/kernel/vio.c 2011-05-22 19:36:30.000000000 -0400
3994@@ -605,11 +605,12 @@ static int vio_dma_iommu_dma_supported(s
3995 return dma_iommu_ops.dma_supported(dev, mask);
3996 }
3997
3998-struct dma_map_ops vio_dma_mapping_ops = {
3999+const struct dma_map_ops vio_dma_mapping_ops = {
4000 .alloc_coherent = vio_dma_iommu_alloc_coherent,
4001 .free_coherent = vio_dma_iommu_free_coherent,
4002 .map_sg = vio_dma_iommu_map_sg,
4003 .unmap_sg = vio_dma_iommu_unmap_sg,
4004+ .dma_supported = dma_iommu_dma_supported,
4005 .map_page = vio_dma_iommu_map_page,
4006 .unmap_page = vio_dma_iommu_unmap_page,
4007 .dma_supported = vio_dma_iommu_dma_supported,
4008diff -urNp linux-2.6.39/arch/powerpc/lib/usercopy_64.c linux-2.6.39/arch/powerpc/lib/usercopy_64.c
4009--- linux-2.6.39/arch/powerpc/lib/usercopy_64.c 2011-05-19 00:06:34.000000000 -0400
4010+++ linux-2.6.39/arch/powerpc/lib/usercopy_64.c 2011-05-22 19:36:30.000000000 -0400
4011@@ -9,22 +9,6 @@
4012 #include <linux/module.h>
4013 #include <asm/uaccess.h>
4014
4015-unsigned long copy_from_user(void *to, const void __user *from, unsigned long n)
4016-{
4017- if (likely(access_ok(VERIFY_READ, from, n)))
4018- n = __copy_from_user(to, from, n);
4019- else
4020- memset(to, 0, n);
4021- return n;
4022-}
4023-
4024-unsigned long copy_to_user(void __user *to, const void *from, unsigned long n)
4025-{
4026- if (likely(access_ok(VERIFY_WRITE, to, n)))
4027- n = __copy_to_user(to, from, n);
4028- return n;
4029-}
4030-
4031 unsigned long copy_in_user(void __user *to, const void __user *from,
4032 unsigned long n)
4033 {
4034@@ -35,7 +19,5 @@ unsigned long copy_in_user(void __user *
4035 return n;
4036 }
4037
4038-EXPORT_SYMBOL(copy_from_user);
4039-EXPORT_SYMBOL(copy_to_user);
4040 EXPORT_SYMBOL(copy_in_user);
4041
4042diff -urNp linux-2.6.39/arch/powerpc/mm/fault.c linux-2.6.39/arch/powerpc/mm/fault.c
4043--- linux-2.6.39/arch/powerpc/mm/fault.c 2011-05-19 00:06:34.000000000 -0400
4044+++ linux-2.6.39/arch/powerpc/mm/fault.c 2011-05-22 19:36:30.000000000 -0400
4045@@ -31,6 +31,10 @@
4046 #include <linux/kdebug.h>
4047 #include <linux/perf_event.h>
4048 #include <linux/magic.h>
4049+#include <linux/slab.h>
4050+#include <linux/pagemap.h>
4051+#include <linux/compiler.h>
4052+#include <linux/unistd.h>
4053
4054 #include <asm/firmware.h>
4055 #include <asm/page.h>
4056@@ -42,6 +46,7 @@
4057 #include <asm/tlbflush.h>
4058 #include <asm/siginfo.h>
4059 #include <mm/mmu_decl.h>
4060+#include <asm/ptrace.h>
4061
4062 #ifdef CONFIG_KPROBES
4063 static inline int notify_page_fault(struct pt_regs *regs)
4064@@ -65,6 +70,33 @@ static inline int notify_page_fault(stru
4065 }
4066 #endif
4067
4068+#ifdef CONFIG_PAX_PAGEEXEC
4069+/*
4070+ * PaX: decide what to do with offenders (regs->nip = fault address)
4071+ *
4072+ * returns 1 when task should be killed
4073+ */
4074+static int pax_handle_fetch_fault(struct pt_regs *regs)
4075+{
4076+ return 1;
4077+}
4078+
4079+void pax_report_insns(void *pc, void *sp)
4080+{
4081+ unsigned long i;
4082+
4083+ printk(KERN_ERR "PAX: bytes at PC: ");
4084+ for (i = 0; i < 5; i++) {
4085+ unsigned int c;
4086+ if (get_user(c, (unsigned int __user *)pc+i))
4087+ printk(KERN_CONT "???????? ");
4088+ else
4089+ printk(KERN_CONT "%08x ", c);
4090+ }
4091+ printk("\n");
4092+}
4093+#endif
4094+
4095 /*
4096 * Check whether the instruction at regs->nip is a store using
4097 * an update addressing form which will update r1.
4098@@ -135,7 +167,7 @@ int __kprobes do_page_fault(struct pt_re
4099 * indicate errors in DSISR but can validly be set in SRR1.
4100 */
4101 if (trap == 0x400)
4102- error_code &= 0x48200000;
4103+ error_code &= 0x58200000;
4104 else
4105 is_write = error_code & DSISR_ISSTORE;
4106 #else
4107@@ -258,7 +290,7 @@ good_area:
4108 * "undefined". Of those that can be set, this is the only
4109 * one which seems bad.
4110 */
4111- if (error_code & 0x10000000)
4112+ if (error_code & DSISR_GUARDED)
4113 /* Guarded storage error. */
4114 goto bad_area;
4115 #endif /* CONFIG_8xx */
4116@@ -273,7 +305,7 @@ good_area:
4117 * processors use the same I/D cache coherency mechanism
4118 * as embedded.
4119 */
4120- if (error_code & DSISR_PROTFAULT)
4121+ if (error_code & (DSISR_PROTFAULT | DSISR_GUARDED))
4122 goto bad_area;
4123 #endif /* CONFIG_PPC_STD_MMU */
4124
4125@@ -342,6 +374,23 @@ bad_area:
4126 bad_area_nosemaphore:
4127 /* User mode accesses cause a SIGSEGV */
4128 if (user_mode(regs)) {
4129+
4130+#ifdef CONFIG_PAX_PAGEEXEC
4131+ if (mm->pax_flags & MF_PAX_PAGEEXEC) {
4132+#ifdef CONFIG_PPC_STD_MMU
4133+ if (is_exec && (error_code & (DSISR_PROTFAULT | DSISR_GUARDED))) {
4134+#else
4135+ if (is_exec && regs->nip == address) {
4136+#endif
4137+ switch (pax_handle_fetch_fault(regs)) {
4138+ }
4139+
4140+ pax_report_fault(regs, (void *)regs->nip, (void *)regs->gpr[PT_R1]);
4141+ do_group_exit(SIGKILL);
4142+ }
4143+ }
4144+#endif
4145+
4146 _exception(SIGSEGV, regs, code, address);
4147 return 0;
4148 }
4149diff -urNp linux-2.6.39/arch/powerpc/mm/mmap_64.c linux-2.6.39/arch/powerpc/mm/mmap_64.c
4150--- linux-2.6.39/arch/powerpc/mm/mmap_64.c 2011-05-19 00:06:34.000000000 -0400
4151+++ linux-2.6.39/arch/powerpc/mm/mmap_64.c 2011-05-22 19:36:30.000000000 -0400
4152@@ -99,10 +99,22 @@ void arch_pick_mmap_layout(struct mm_str
4153 */
4154 if (mmap_is_legacy()) {
4155 mm->mmap_base = TASK_UNMAPPED_BASE;
4156+
4157+#ifdef CONFIG_PAX_RANDMMAP
4158+ if (mm->pax_flags & MF_PAX_RANDMMAP)
4159+ mm->mmap_base += mm->delta_mmap;
4160+#endif
4161+
4162 mm->get_unmapped_area = arch_get_unmapped_area;
4163 mm->unmap_area = arch_unmap_area;
4164 } else {
4165 mm->mmap_base = mmap_base();
4166+
4167+#ifdef CONFIG_PAX_RANDMMAP
4168+ if (mm->pax_flags & MF_PAX_RANDMMAP)
4169+ mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
4170+#endif
4171+
4172 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
4173 mm->unmap_area = arch_unmap_area_topdown;
4174 }
4175diff -urNp linux-2.6.39/arch/powerpc/mm/slice.c linux-2.6.39/arch/powerpc/mm/slice.c
4176--- linux-2.6.39/arch/powerpc/mm/slice.c 2011-05-19 00:06:34.000000000 -0400
4177+++ linux-2.6.39/arch/powerpc/mm/slice.c 2011-05-22 19:36:30.000000000 -0400
4178@@ -98,7 +98,7 @@ static int slice_area_is_free(struct mm_
4179 if ((mm->task_size - len) < addr)
4180 return 0;
4181 vma = find_vma(mm, addr);
4182- return (!vma || (addr + len) <= vma->vm_start);
4183+ return check_heap_stack_gap(vma, addr, len);
4184 }
4185
4186 static int slice_low_has_vma(struct mm_struct *mm, unsigned long slice)
4187@@ -256,7 +256,7 @@ full_search:
4188 addr = _ALIGN_UP(addr + 1, 1ul << SLICE_HIGH_SHIFT);
4189 continue;
4190 }
4191- if (!vma || addr + len <= vma->vm_start) {
4192+ if (check_heap_stack_gap(vma, addr, len)) {
4193 /*
4194 * Remember the place where we stopped the search:
4195 */
4196@@ -313,10 +313,14 @@ static unsigned long slice_find_area_top
4197 }
4198 }
4199
4200- addr = mm->mmap_base;
4201- while (addr > len) {
4202+ if (mm->mmap_base < len)
4203+ addr = -ENOMEM;
4204+ else
4205+ addr = mm->mmap_base - len;
4206+
4207+ while (!IS_ERR_VALUE(addr)) {
4208 /* Go down by chunk size */
4209- addr = _ALIGN_DOWN(addr - len, 1ul << pshift);
4210+ addr = _ALIGN_DOWN(addr, 1ul << pshift);
4211
4212 /* Check for hit with different page size */
4213 mask = slice_range_to_mask(addr, len);
4214@@ -336,7 +340,7 @@ static unsigned long slice_find_area_top
4215 * return with success:
4216 */
4217 vma = find_vma(mm, addr);
4218- if (!vma || (addr + len) <= vma->vm_start) {
4219+ if (check_heap_stack_gap(vma, addr, len)) {
4220 /* remember the address as a hint for next time */
4221 if (use_cache)
4222 mm->free_area_cache = addr;
4223@@ -348,7 +352,7 @@ static unsigned long slice_find_area_top
4224 mm->cached_hole_size = vma->vm_start - addr;
4225
4226 /* try just below the current vma->vm_start */
4227- addr = vma->vm_start;
4228+ addr = skip_heap_stack_gap(vma, len);
4229 }
4230
4231 /*
4232@@ -426,6 +430,11 @@ unsigned long slice_get_unmapped_area(un
4233 if (fixed && addr > (mm->task_size - len))
4234 return -EINVAL;
4235
4236+#ifdef CONFIG_PAX_RANDMMAP
4237+ if (!fixed && (mm->pax_flags & MF_PAX_RANDMMAP))
4238+ addr = 0;
4239+#endif
4240+
4241 /* If hint, make sure it matches our alignment restrictions */
4242 if (!fixed && addr) {
4243 addr = _ALIGN_UP(addr, 1ul << pshift);
4244diff -urNp linux-2.6.39/arch/powerpc/platforms/52xx/efika.c linux-2.6.39/arch/powerpc/platforms/52xx/efika.c
4245--- linux-2.6.39/arch/powerpc/platforms/52xx/efika.c 2011-05-19 00:06:34.000000000 -0400
4246+++ linux-2.6.39/arch/powerpc/platforms/52xx/efika.c 2011-05-22 19:36:30.000000000 -0400
4247@@ -60,7 +60,7 @@ static int rtas_write_config(struct pci_
4248 return rval ? PCIBIOS_DEVICE_NOT_FOUND : PCIBIOS_SUCCESSFUL;
4249 }
4250
4251-static struct pci_ops rtas_pci_ops = {
4252+static const struct pci_ops rtas_pci_ops = {
4253 .read = rtas_read_config,
4254 .write = rtas_write_config,
4255 };
4256diff -urNp linux-2.6.39/arch/powerpc/platforms/cell/celleb_pci.c linux-2.6.39/arch/powerpc/platforms/cell/celleb_pci.c
4257--- linux-2.6.39/arch/powerpc/platforms/cell/celleb_pci.c 2011-05-19 00:06:34.000000000 -0400
4258+++ linux-2.6.39/arch/powerpc/platforms/cell/celleb_pci.c 2011-05-22 19:36:30.000000000 -0400
4259@@ -234,7 +234,7 @@ static int celleb_fake_pci_write_config(
4260 return PCIBIOS_SUCCESSFUL;
4261 }
4262
4263-static struct pci_ops celleb_fake_pci_ops = {
4264+static const struct pci_ops celleb_fake_pci_ops = {
4265 .read = celleb_fake_pci_read_config,
4266 .write = celleb_fake_pci_write_config,
4267 };
4268diff -urNp linux-2.6.39/arch/powerpc/platforms/cell/celleb_scc_epci.c linux-2.6.39/arch/powerpc/platforms/cell/celleb_scc_epci.c
4269--- linux-2.6.39/arch/powerpc/platforms/cell/celleb_scc_epci.c 2011-05-19 00:06:34.000000000 -0400
4270+++ linux-2.6.39/arch/powerpc/platforms/cell/celleb_scc_epci.c 2011-05-22 19:36:30.000000000 -0400
4271@@ -245,7 +245,7 @@ static int celleb_epci_write_config(stru
4272 return celleb_epci_check_abort(hose, addr);
4273 }
4274
4275-struct pci_ops celleb_epci_ops = {
4276+const struct pci_ops celleb_epci_ops = {
4277 .read = celleb_epci_read_config,
4278 .write = celleb_epci_write_config,
4279 };
4280diff -urNp linux-2.6.39/arch/powerpc/platforms/cell/celleb_scc_pciex.c linux-2.6.39/arch/powerpc/platforms/cell/celleb_scc_pciex.c
4281--- linux-2.6.39/arch/powerpc/platforms/cell/celleb_scc_pciex.c 2011-05-19 00:06:34.000000000 -0400
4282+++ linux-2.6.39/arch/powerpc/platforms/cell/celleb_scc_pciex.c 2011-05-22 19:36:30.000000000 -0400
4283@@ -399,7 +399,7 @@ static int scc_pciex_write_config(struct
4284 return PCIBIOS_SUCCESSFUL;
4285 }
4286
4287-static struct pci_ops scc_pciex_pci_ops = {
4288+static const struct pci_ops scc_pciex_pci_ops = {
4289 scc_pciex_read_config,
4290 scc_pciex_write_config,
4291 };
4292diff -urNp linux-2.6.39/arch/powerpc/platforms/cell/iommu.c linux-2.6.39/arch/powerpc/platforms/cell/iommu.c
4293--- linux-2.6.39/arch/powerpc/platforms/cell/iommu.c 2011-05-19 00:06:34.000000000 -0400
4294+++ linux-2.6.39/arch/powerpc/platforms/cell/iommu.c 2011-05-22 19:36:30.000000000 -0400
4295@@ -642,7 +642,7 @@ static int dma_fixed_dma_supported(struc
4296
4297 static int dma_set_mask_and_switch(struct device *dev, u64 dma_mask);
4298
4299-struct dma_map_ops dma_iommu_fixed_ops = {
4300+const struct dma_map_ops dma_iommu_fixed_ops = {
4301 .alloc_coherent = dma_fixed_alloc_coherent,
4302 .free_coherent = dma_fixed_free_coherent,
4303 .map_sg = dma_fixed_map_sg,
4304diff -urNp linux-2.6.39/arch/powerpc/platforms/chrp/pci.c linux-2.6.39/arch/powerpc/platforms/chrp/pci.c
4305--- linux-2.6.39/arch/powerpc/platforms/chrp/pci.c 2011-05-19 00:06:34.000000000 -0400
4306+++ linux-2.6.39/arch/powerpc/platforms/chrp/pci.c 2011-05-22 19:36:30.000000000 -0400
4307@@ -84,7 +84,7 @@ int gg2_write_config(struct pci_bus *bus
4308 return PCIBIOS_SUCCESSFUL;
4309 }
4310
4311-static struct pci_ops gg2_pci_ops =
4312+static const struct pci_ops gg2_pci_ops =
4313 {
4314 .read = gg2_read_config,
4315 .write = gg2_write_config,
4316@@ -122,7 +122,7 @@ int rtas_write_config(struct pci_bus *bu
4317 return rval? PCIBIOS_DEVICE_NOT_FOUND: PCIBIOS_SUCCESSFUL;
4318 }
4319
4320-static struct pci_ops rtas_pci_ops =
4321+static const struct pci_ops rtas_pci_ops =
4322 {
4323 .read = rtas_read_config,
4324 .write = rtas_write_config,
4325diff -urNp linux-2.6.39/arch/powerpc/platforms/iseries/pci.c linux-2.6.39/arch/powerpc/platforms/iseries/pci.c
4326--- linux-2.6.39/arch/powerpc/platforms/iseries/pci.c 2011-05-19 00:06:34.000000000 -0400
4327+++ linux-2.6.39/arch/powerpc/platforms/iseries/pci.c 2011-05-22 19:36:30.000000000 -0400
4328@@ -533,7 +533,7 @@ static int iSeries_pci_write_config(stru
4329 return 0;
4330 }
4331
4332-static struct pci_ops iSeries_pci_ops = {
4333+static const struct pci_ops iSeries_pci_ops = {
4334 .read = iSeries_pci_read_config,
4335 .write = iSeries_pci_write_config
4336 };
4337diff -urNp linux-2.6.39/arch/powerpc/platforms/maple/pci.c linux-2.6.39/arch/powerpc/platforms/maple/pci.c
4338--- linux-2.6.39/arch/powerpc/platforms/maple/pci.c 2011-05-19 00:06:34.000000000 -0400
4339+++ linux-2.6.39/arch/powerpc/platforms/maple/pci.c 2011-05-22 19:36:30.000000000 -0400
4340@@ -180,7 +180,7 @@ static int u3_agp_write_config(struct pc
4341 return PCIBIOS_SUCCESSFUL;
4342 }
4343
4344-static struct pci_ops u3_agp_pci_ops =
4345+static const struct pci_ops u3_agp_pci_ops =
4346 {
4347 .read = u3_agp_read_config,
4348 .write = u3_agp_write_config,
4349@@ -276,7 +276,7 @@ static int u3_ht_write_config(struct pci
4350 return PCIBIOS_SUCCESSFUL;
4351 }
4352
4353-static struct pci_ops u3_ht_pci_ops =
4354+static const struct pci_ops u3_ht_pci_ops =
4355 {
4356 .read = u3_ht_read_config,
4357 .write = u3_ht_write_config,
4358@@ -381,7 +381,7 @@ static int u4_pcie_write_config(struct p
4359 return PCIBIOS_SUCCESSFUL;
4360 }
4361
4362-static struct pci_ops u4_pcie_pci_ops =
4363+static const struct pci_ops u4_pcie_pci_ops =
4364 {
4365 .read = u4_pcie_read_config,
4366 .write = u4_pcie_write_config,
4367diff -urNp linux-2.6.39/arch/powerpc/platforms/pasemi/pci.c linux-2.6.39/arch/powerpc/platforms/pasemi/pci.c
4368--- linux-2.6.39/arch/powerpc/platforms/pasemi/pci.c 2011-05-19 00:06:34.000000000 -0400
4369+++ linux-2.6.39/arch/powerpc/platforms/pasemi/pci.c 2011-05-22 19:36:30.000000000 -0400
4370@@ -176,7 +176,7 @@ static int pa_pxp_write_config(struct pc
4371 return PCIBIOS_SUCCESSFUL;
4372 }
4373
4374-static struct pci_ops pa_pxp_ops = {
4375+static const struct pci_ops pa_pxp_ops = {
4376 .read = pa_pxp_read_config,
4377 .write = pa_pxp_write_config,
4378 };
4379diff -urNp linux-2.6.39/arch/powerpc/platforms/powermac/pci.c linux-2.6.39/arch/powerpc/platforms/powermac/pci.c
4380--- linux-2.6.39/arch/powerpc/platforms/powermac/pci.c 2011-05-19 00:06:34.000000000 -0400
4381+++ linux-2.6.39/arch/powerpc/platforms/powermac/pci.c 2011-05-22 19:36:30.000000000 -0400
4382@@ -218,7 +218,7 @@ static int macrisc_write_config(struct p
4383 return PCIBIOS_SUCCESSFUL;
4384 }
4385
4386-static struct pci_ops macrisc_pci_ops =
4387+static const struct pci_ops macrisc_pci_ops =
4388 {
4389 .read = macrisc_read_config,
4390 .write = macrisc_write_config,
4391@@ -273,7 +273,7 @@ chaos_write_config(struct pci_bus *bus,
4392 return macrisc_write_config(bus, devfn, offset, len, val);
4393 }
4394
4395-static struct pci_ops chaos_pci_ops =
4396+static const struct pci_ops chaos_pci_ops =
4397 {
4398 .read = chaos_read_config,
4399 .write = chaos_write_config,
4400diff -urNp linux-2.6.39/arch/powerpc/platforms/ps3/system-bus.c linux-2.6.39/arch/powerpc/platforms/ps3/system-bus.c
4401--- linux-2.6.39/arch/powerpc/platforms/ps3/system-bus.c 2011-05-19 00:06:34.000000000 -0400
4402+++ linux-2.6.39/arch/powerpc/platforms/ps3/system-bus.c 2011-05-22 19:36:30.000000000 -0400
4403@@ -695,7 +695,7 @@ static int ps3_dma_supported(struct devi
4404 return mask >= DMA_BIT_MASK(32);
4405 }
4406
4407-static struct dma_map_ops ps3_sb_dma_ops = {
4408+static const struct dma_map_ops ps3_sb_dma_ops = {
4409 .alloc_coherent = ps3_alloc_coherent,
4410 .free_coherent = ps3_free_coherent,
4411 .map_sg = ps3_sb_map_sg,
4412@@ -705,7 +705,7 @@ static struct dma_map_ops ps3_sb_dma_ops
4413 .unmap_page = ps3_unmap_page,
4414 };
4415
4416-static struct dma_map_ops ps3_ioc0_dma_ops = {
4417+static const struct dma_map_ops ps3_ioc0_dma_ops = {
4418 .alloc_coherent = ps3_alloc_coherent,
4419 .free_coherent = ps3_free_coherent,
4420 .map_sg = ps3_ioc0_map_sg,
4421diff -urNp linux-2.6.39/arch/powerpc/sysdev/fsl_pci.c linux-2.6.39/arch/powerpc/sysdev/fsl_pci.c
4422--- linux-2.6.39/arch/powerpc/sysdev/fsl_pci.c 2011-05-19 00:06:34.000000000 -0400
4423+++ linux-2.6.39/arch/powerpc/sysdev/fsl_pci.c 2011-05-22 19:36:30.000000000 -0400
4424@@ -573,7 +573,7 @@ static int mpc83xx_pcie_write_config(str
4425 return PCIBIOS_SUCCESSFUL;
4426 }
4427
4428-static struct pci_ops mpc83xx_pcie_ops = {
4429+static const struct pci_ops mpc83xx_pcie_ops = {
4430 .read = mpc83xx_pcie_read_config,
4431 .write = mpc83xx_pcie_write_config,
4432 };
4433diff -urNp linux-2.6.39/arch/powerpc/sysdev/indirect_pci.c linux-2.6.39/arch/powerpc/sysdev/indirect_pci.c
4434--- linux-2.6.39/arch/powerpc/sysdev/indirect_pci.c 2011-05-19 00:06:34.000000000 -0400
4435+++ linux-2.6.39/arch/powerpc/sysdev/indirect_pci.c 2011-05-22 19:36:30.000000000 -0400
4436@@ -148,7 +148,7 @@ indirect_write_config(struct pci_bus *bu
4437 return PCIBIOS_SUCCESSFUL;
4438 }
4439
4440-static struct pci_ops indirect_pci_ops =
4441+static const struct pci_ops indirect_pci_ops =
4442 {
4443 .read = indirect_read_config,
4444 .write = indirect_write_config,
4445diff -urNp linux-2.6.39/arch/powerpc/sysdev/ppc4xx_pci.c linux-2.6.39/arch/powerpc/sysdev/ppc4xx_pci.c
4446--- linux-2.6.39/arch/powerpc/sysdev/ppc4xx_pci.c 2011-05-19 00:06:34.000000000 -0400
4447+++ linux-2.6.39/arch/powerpc/sysdev/ppc4xx_pci.c 2011-05-22 19:36:30.000000000 -0400
4448@@ -1514,7 +1514,7 @@ static int ppc4xx_pciex_write_config(str
4449 return PCIBIOS_SUCCESSFUL;
4450 }
4451
4452-static struct pci_ops ppc4xx_pciex_pci_ops =
4453+static const struct pci_ops ppc4xx_pciex_pci_ops =
4454 {
4455 .read = ppc4xx_pciex_read_config,
4456 .write = ppc4xx_pciex_write_config,
4457diff -urNp linux-2.6.39/arch/powerpc/sysdev/tsi108_pci.c linux-2.6.39/arch/powerpc/sysdev/tsi108_pci.c
4458--- linux-2.6.39/arch/powerpc/sysdev/tsi108_pci.c 2011-05-19 00:06:34.000000000 -0400
4459+++ linux-2.6.39/arch/powerpc/sysdev/tsi108_pci.c 2011-05-22 19:36:30.000000000 -0400
4460@@ -190,7 +190,7 @@ void tsi108_clear_pci_cfg_error(void)
4461 tsi108_clear_pci_error(tsi108_pci_cfg_phys);
4462 }
4463
4464-static struct pci_ops tsi108_direct_pci_ops = {
4465+static const struct pci_ops tsi108_direct_pci_ops = {
4466 .read = tsi108_direct_read_config,
4467 .write = tsi108_direct_write_config,
4468 };
4469diff -urNp linux-2.6.39/arch/s390/include/asm/elf.h linux-2.6.39/arch/s390/include/asm/elf.h
4470--- linux-2.6.39/arch/s390/include/asm/elf.h 2011-05-19 00:06:34.000000000 -0400
4471+++ linux-2.6.39/arch/s390/include/asm/elf.h 2011-05-22 19:36:30.000000000 -0400
4472@@ -162,8 +162,14 @@ extern unsigned int vdso_enabled;
4473 the loader. We need to make sure that it is out of the way of the program
4474 that it will "exec", and that there is sufficient room for the brk. */
4475
4476-extern unsigned long randomize_et_dyn(unsigned long base);
4477-#define ELF_ET_DYN_BASE (randomize_et_dyn(STACK_TOP / 3 * 2))
4478+#define ELF_ET_DYN_BASE (STACK_TOP / 3 * 2)
4479+
4480+#ifdef CONFIG_PAX_ASLR
4481+#define PAX_ELF_ET_DYN_BASE (test_thread_flag(TIF_31BIT) ? 0x10000UL : 0x80000000UL)
4482+
4483+#define PAX_DELTA_MMAP_LEN (test_thread_flag(TIF_31BIT) ? 15 : 26 )
4484+#define PAX_DELTA_STACK_LEN (test_thread_flag(TIF_31BIT) ? 15 : 26 )
4485+#endif
4486
4487 /* This yields a mask that user programs can use to figure out what
4488 instruction set this CPU supports. */
4489@@ -222,7 +228,4 @@ struct linux_binprm;
4490 #define ARCH_HAS_SETUP_ADDITIONAL_PAGES 1
4491 int arch_setup_additional_pages(struct linux_binprm *, int);
4492
4493-extern unsigned long arch_randomize_brk(struct mm_struct *mm);
4494-#define arch_randomize_brk arch_randomize_brk
4495-
4496 #endif
4497diff -urNp linux-2.6.39/arch/s390/include/asm/system.h linux-2.6.39/arch/s390/include/asm/system.h
4498--- linux-2.6.39/arch/s390/include/asm/system.h 2011-05-19 00:06:34.000000000 -0400
4499+++ linux-2.6.39/arch/s390/include/asm/system.h 2011-05-22 19:36:30.000000000 -0400
4500@@ -255,7 +255,7 @@ extern void (*_machine_restart)(char *co
4501 extern void (*_machine_halt)(void);
4502 extern void (*_machine_power_off)(void);
4503
4504-extern unsigned long arch_align_stack(unsigned long sp);
4505+#define arch_align_stack(x) ((x) & ~0xfUL)
4506
4507 static inline int tprot(unsigned long addr)
4508 {
4509diff -urNp linux-2.6.39/arch/s390/include/asm/uaccess.h linux-2.6.39/arch/s390/include/asm/uaccess.h
4510--- linux-2.6.39/arch/s390/include/asm/uaccess.h 2011-05-19 00:06:34.000000000 -0400
4511+++ linux-2.6.39/arch/s390/include/asm/uaccess.h 2011-05-22 19:36:30.000000000 -0400
4512@@ -234,6 +234,10 @@ static inline unsigned long __must_check
4513 copy_to_user(void __user *to, const void *from, unsigned long n)
4514 {
4515 might_fault();
4516+
4517+ if ((long)n < 0)
4518+ return n;
4519+
4520 if (access_ok(VERIFY_WRITE, to, n))
4521 n = __copy_to_user(to, from, n);
4522 return n;
4523@@ -259,6 +263,9 @@ copy_to_user(void __user *to, const void
4524 static inline unsigned long __must_check
4525 __copy_from_user(void *to, const void __user *from, unsigned long n)
4526 {
4527+ if ((long)n < 0)
4528+ return n;
4529+
4530 if (__builtin_constant_p(n) && (n <= 256))
4531 return uaccess.copy_from_user_small(n, from, to);
4532 else
4533@@ -293,6 +300,10 @@ copy_from_user(void *to, const void __us
4534 unsigned int sz = __compiletime_object_size(to);
4535
4536 might_fault();
4537+
4538+ if ((long)n < 0)
4539+ return n;
4540+
4541 if (unlikely(sz != -1 && sz < n)) {
4542 copy_from_user_overflow();
4543 return n;
4544diff -urNp linux-2.6.39/arch/s390/Kconfig linux-2.6.39/arch/s390/Kconfig
4545--- linux-2.6.39/arch/s390/Kconfig 2011-05-19 00:06:34.000000000 -0400
4546+++ linux-2.6.39/arch/s390/Kconfig 2011-05-22 19:36:30.000000000 -0400
4547@@ -234,11 +234,9 @@ config S390_EXEC_PROTECT
4548 prompt "Data execute protection"
4549 help
4550 This option allows to enable a buffer overflow protection for user
4551- space programs and it also selects the addressing mode option above.
4552- The kernel parameter noexec=on will enable this feature and also
4553- switch the addressing modes, default is disabled. Enabling this (via
4554- kernel parameter) on machines earlier than IBM System z9 this will
4555- reduce system performance.
4556+ space programs.
4557+ Enabling this (via kernel parameter) on machines earlier than IBM
4558+ System z9 this will reduce system performance.
4559
4560 comment "Code generation options"
4561
4562diff -urNp linux-2.6.39/arch/s390/kernel/module.c linux-2.6.39/arch/s390/kernel/module.c
4563--- linux-2.6.39/arch/s390/kernel/module.c 2011-05-19 00:06:34.000000000 -0400
4564+++ linux-2.6.39/arch/s390/kernel/module.c 2011-05-22 19:36:30.000000000 -0400
4565@@ -168,11 +168,11 @@ module_frob_arch_sections(Elf_Ehdr *hdr,
4566
4567 /* Increase core size by size of got & plt and set start
4568 offsets for got and plt. */
4569- me->core_size = ALIGN(me->core_size, 4);
4570- me->arch.got_offset = me->core_size;
4571- me->core_size += me->arch.got_size;
4572- me->arch.plt_offset = me->core_size;
4573- me->core_size += me->arch.plt_size;
4574+ me->core_size_rw = ALIGN(me->core_size_rw, 4);
4575+ me->arch.got_offset = me->core_size_rw;
4576+ me->core_size_rw += me->arch.got_size;
4577+ me->arch.plt_offset = me->core_size_rx;
4578+ me->core_size_rx += me->arch.plt_size;
4579 return 0;
4580 }
4581
4582@@ -258,7 +258,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
4583 if (info->got_initialized == 0) {
4584 Elf_Addr *gotent;
4585
4586- gotent = me->module_core + me->arch.got_offset +
4587+ gotent = me->module_core_rw + me->arch.got_offset +
4588 info->got_offset;
4589 *gotent = val;
4590 info->got_initialized = 1;
4591@@ -282,7 +282,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
4592 else if (r_type == R_390_GOTENT ||
4593 r_type == R_390_GOTPLTENT)
4594 *(unsigned int *) loc =
4595- (val + (Elf_Addr) me->module_core - loc) >> 1;
4596+ (val + (Elf_Addr) me->module_core_rw - loc) >> 1;
4597 else if (r_type == R_390_GOT64 ||
4598 r_type == R_390_GOTPLT64)
4599 *(unsigned long *) loc = val;
4600@@ -296,7 +296,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
4601 case R_390_PLTOFF64: /* 16 bit offset from GOT to PLT. */
4602 if (info->plt_initialized == 0) {
4603 unsigned int *ip;
4604- ip = me->module_core + me->arch.plt_offset +
4605+ ip = me->module_core_rx + me->arch.plt_offset +
4606 info->plt_offset;
4607 #ifndef CONFIG_64BIT
4608 ip[0] = 0x0d105810; /* basr 1,0; l 1,6(1); br 1 */
4609@@ -321,7 +321,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
4610 val - loc + 0xffffUL < 0x1ffffeUL) ||
4611 (r_type == R_390_PLT32DBL &&
4612 val - loc + 0xffffffffULL < 0x1fffffffeULL)))
4613- val = (Elf_Addr) me->module_core +
4614+ val = (Elf_Addr) me->module_core_rx +
4615 me->arch.plt_offset +
4616 info->plt_offset;
4617 val += rela->r_addend - loc;
4618@@ -343,7 +343,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
4619 case R_390_GOTOFF32: /* 32 bit offset to GOT. */
4620 case R_390_GOTOFF64: /* 64 bit offset to GOT. */
4621 val = val + rela->r_addend -
4622- ((Elf_Addr) me->module_core + me->arch.got_offset);
4623+ ((Elf_Addr) me->module_core_rw + me->arch.got_offset);
4624 if (r_type == R_390_GOTOFF16)
4625 *(unsigned short *) loc = val;
4626 else if (r_type == R_390_GOTOFF32)
4627@@ -353,7 +353,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
4628 break;
4629 case R_390_GOTPC: /* 32 bit PC relative offset to GOT. */
4630 case R_390_GOTPCDBL: /* 32 bit PC rel. off. to GOT shifted by 1. */
4631- val = (Elf_Addr) me->module_core + me->arch.got_offset +
4632+ val = (Elf_Addr) me->module_core_rw + me->arch.got_offset +
4633 rela->r_addend - loc;
4634 if (r_type == R_390_GOTPC)
4635 *(unsigned int *) loc = val;
4636diff -urNp linux-2.6.39/arch/s390/kernel/process.c linux-2.6.39/arch/s390/kernel/process.c
4637--- linux-2.6.39/arch/s390/kernel/process.c 2011-05-19 00:06:34.000000000 -0400
4638+++ linux-2.6.39/arch/s390/kernel/process.c 2011-05-22 19:36:30.000000000 -0400
4639@@ -334,39 +334,3 @@ unsigned long get_wchan(struct task_stru
4640 }
4641 return 0;
4642 }
4643-
4644-unsigned long arch_align_stack(unsigned long sp)
4645-{
4646- if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
4647- sp -= get_random_int() & ~PAGE_MASK;
4648- return sp & ~0xf;
4649-}
4650-
4651-static inline unsigned long brk_rnd(void)
4652-{
4653- /* 8MB for 32bit, 1GB for 64bit */
4654- if (is_32bit_task())
4655- return (get_random_int() & 0x7ffUL) << PAGE_SHIFT;
4656- else
4657- return (get_random_int() & 0x3ffffUL) << PAGE_SHIFT;
4658-}
4659-
4660-unsigned long arch_randomize_brk(struct mm_struct *mm)
4661-{
4662- unsigned long ret = PAGE_ALIGN(mm->brk + brk_rnd());
4663-
4664- if (ret < mm->brk)
4665- return mm->brk;
4666- return ret;
4667-}
4668-
4669-unsigned long randomize_et_dyn(unsigned long base)
4670-{
4671- unsigned long ret = PAGE_ALIGN(base + brk_rnd());
4672-
4673- if (!(current->flags & PF_RANDOMIZE))
4674- return base;
4675- if (ret < base)
4676- return base;
4677- return ret;
4678-}
4679diff -urNp linux-2.6.39/arch/s390/kernel/setup.c linux-2.6.39/arch/s390/kernel/setup.c
4680--- linux-2.6.39/arch/s390/kernel/setup.c 2011-05-19 00:06:34.000000000 -0400
4681+++ linux-2.6.39/arch/s390/kernel/setup.c 2011-05-22 19:36:30.000000000 -0400
4682@@ -271,7 +271,7 @@ static int __init early_parse_mem(char *
4683 }
4684 early_param("mem", early_parse_mem);
4685
4686-unsigned int user_mode = HOME_SPACE_MODE;
4687+unsigned int user_mode = SECONDARY_SPACE_MODE;
4688 EXPORT_SYMBOL_GPL(user_mode);
4689
4690 static int set_amode_and_uaccess(unsigned long user_amode,
4691@@ -300,17 +300,6 @@ static int set_amode_and_uaccess(unsigne
4692 }
4693 }
4694
4695-/*
4696- * Switch kernel/user addressing modes?
4697- */
4698-static int __init early_parse_switch_amode(char *p)
4699-{
4700- if (user_mode != SECONDARY_SPACE_MODE)
4701- user_mode = PRIMARY_SPACE_MODE;
4702- return 0;
4703-}
4704-early_param("switch_amode", early_parse_switch_amode);
4705-
4706 static int __init early_parse_user_mode(char *p)
4707 {
4708 if (p && strcmp(p, "primary") == 0)
4709@@ -327,20 +316,6 @@ static int __init early_parse_user_mode(
4710 }
4711 early_param("user_mode", early_parse_user_mode);
4712
4713-#ifdef CONFIG_S390_EXEC_PROTECT
4714-/*
4715- * Enable execute protection?
4716- */
4717-static int __init early_parse_noexec(char *p)
4718-{
4719- if (!strncmp(p, "off", 3))
4720- return 0;
4721- user_mode = SECONDARY_SPACE_MODE;
4722- return 0;
4723-}
4724-early_param("noexec", early_parse_noexec);
4725-#endif /* CONFIG_S390_EXEC_PROTECT */
4726-
4727 static void setup_addressing_mode(void)
4728 {
4729 if (user_mode == SECONDARY_SPACE_MODE) {
4730diff -urNp linux-2.6.39/arch/s390/mm/maccess.c linux-2.6.39/arch/s390/mm/maccess.c
4731--- linux-2.6.39/arch/s390/mm/maccess.c 2011-05-19 00:06:34.000000000 -0400
4732+++ linux-2.6.39/arch/s390/mm/maccess.c 2011-05-22 19:36:30.000000000 -0400
4733@@ -45,7 +45,7 @@ static long probe_kernel_write_odd(void
4734 return rc ? rc : count;
4735 }
4736
4737-long probe_kernel_write(void *dst, void *src, size_t size)
4738+long probe_kernel_write(void *dst, const void *src, size_t size)
4739 {
4740 long copied = 0;
4741
4742diff -urNp linux-2.6.39/arch/s390/mm/mmap.c linux-2.6.39/arch/s390/mm/mmap.c
4743--- linux-2.6.39/arch/s390/mm/mmap.c 2011-05-19 00:06:34.000000000 -0400
4744+++ linux-2.6.39/arch/s390/mm/mmap.c 2011-05-22 19:36:30.000000000 -0400
4745@@ -91,10 +91,22 @@ void arch_pick_mmap_layout(struct mm_str
4746 */
4747 if (mmap_is_legacy()) {
4748 mm->mmap_base = TASK_UNMAPPED_BASE;
4749+
4750+#ifdef CONFIG_PAX_RANDMMAP
4751+ if (mm->pax_flags & MF_PAX_RANDMMAP)
4752+ mm->mmap_base += mm->delta_mmap;
4753+#endif
4754+
4755 mm->get_unmapped_area = arch_get_unmapped_area;
4756 mm->unmap_area = arch_unmap_area;
4757 } else {
4758 mm->mmap_base = mmap_base();
4759+
4760+#ifdef CONFIG_PAX_RANDMMAP
4761+ if (mm->pax_flags & MF_PAX_RANDMMAP)
4762+ mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
4763+#endif
4764+
4765 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
4766 mm->unmap_area = arch_unmap_area_topdown;
4767 }
4768@@ -166,10 +178,22 @@ void arch_pick_mmap_layout(struct mm_str
4769 */
4770 if (mmap_is_legacy()) {
4771 mm->mmap_base = TASK_UNMAPPED_BASE;
4772+
4773+#ifdef CONFIG_PAX_RANDMMAP
4774+ if (mm->pax_flags & MF_PAX_RANDMMAP)
4775+ mm->mmap_base += mm->delta_mmap;
4776+#endif
4777+
4778 mm->get_unmapped_area = s390_get_unmapped_area;
4779 mm->unmap_area = arch_unmap_area;
4780 } else {
4781 mm->mmap_base = mmap_base();
4782+
4783+#ifdef CONFIG_PAX_RANDMMAP
4784+ if (mm->pax_flags & MF_PAX_RANDMMAP)
4785+ mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
4786+#endif
4787+
4788 mm->get_unmapped_area = s390_get_unmapped_area_topdown;
4789 mm->unmap_area = arch_unmap_area_topdown;
4790 }
4791diff -urNp linux-2.6.39/arch/score/include/asm/system.h linux-2.6.39/arch/score/include/asm/system.h
4792--- linux-2.6.39/arch/score/include/asm/system.h 2011-05-19 00:06:34.000000000 -0400
4793+++ linux-2.6.39/arch/score/include/asm/system.h 2011-05-22 19:36:30.000000000 -0400
4794@@ -17,7 +17,7 @@ do { \
4795 #define finish_arch_switch(prev) do {} while (0)
4796
4797 typedef void (*vi_handler_t)(void);
4798-extern unsigned long arch_align_stack(unsigned long sp);
4799+#define arch_align_stack(x) (x)
4800
4801 #define mb() barrier()
4802 #define rmb() barrier()
4803diff -urNp linux-2.6.39/arch/score/kernel/process.c linux-2.6.39/arch/score/kernel/process.c
4804--- linux-2.6.39/arch/score/kernel/process.c 2011-05-19 00:06:34.000000000 -0400
4805+++ linux-2.6.39/arch/score/kernel/process.c 2011-05-22 19:36:30.000000000 -0400
4806@@ -161,8 +161,3 @@ unsigned long get_wchan(struct task_stru
4807
4808 return task_pt_regs(task)->cp0_epc;
4809 }
4810-
4811-unsigned long arch_align_stack(unsigned long sp)
4812-{
4813- return sp;
4814-}
4815diff -urNp linux-2.6.39/arch/sh/drivers/pci/ops-dreamcast.c linux-2.6.39/arch/sh/drivers/pci/ops-dreamcast.c
4816--- linux-2.6.39/arch/sh/drivers/pci/ops-dreamcast.c 2011-05-19 00:06:34.000000000 -0400
4817+++ linux-2.6.39/arch/sh/drivers/pci/ops-dreamcast.c 2011-05-22 19:36:30.000000000 -0400
4818@@ -76,7 +76,7 @@ static int gapspci_write(struct pci_bus
4819 return PCIBIOS_SUCCESSFUL;
4820 }
4821
4822-struct pci_ops gapspci_pci_ops = {
4823+const struct pci_ops gapspci_pci_ops = {
4824 .read = gapspci_read,
4825 .write = gapspci_write,
4826 };
4827diff -urNp linux-2.6.39/arch/sh/drivers/pci/ops-sh4.c linux-2.6.39/arch/sh/drivers/pci/ops-sh4.c
4828--- linux-2.6.39/arch/sh/drivers/pci/ops-sh4.c 2011-05-19 00:06:34.000000000 -0400
4829+++ linux-2.6.39/arch/sh/drivers/pci/ops-sh4.c 2011-05-22 19:36:30.000000000 -0400
4830@@ -96,7 +96,7 @@ static int sh4_pci_write(struct pci_bus
4831 return PCIBIOS_SUCCESSFUL;
4832 }
4833
4834-struct pci_ops sh4_pci_ops = {
4835+const struct pci_ops sh4_pci_ops = {
4836 .read = sh4_pci_read,
4837 .write = sh4_pci_write,
4838 };
4839diff -urNp linux-2.6.39/arch/sh/drivers/pci/ops-sh5.c linux-2.6.39/arch/sh/drivers/pci/ops-sh5.c
4840--- linux-2.6.39/arch/sh/drivers/pci/ops-sh5.c 2011-05-19 00:06:34.000000000 -0400
4841+++ linux-2.6.39/arch/sh/drivers/pci/ops-sh5.c 2011-05-22 19:36:30.000000000 -0400
4842@@ -62,7 +62,7 @@ static int sh5pci_write(struct pci_bus *
4843 return PCIBIOS_SUCCESSFUL;
4844 }
4845
4846-struct pci_ops sh5_pci_ops = {
4847+const struct pci_ops sh5_pci_ops = {
4848 .read = sh5pci_read,
4849 .write = sh5pci_write,
4850 };
4851diff -urNp linux-2.6.39/arch/sh/drivers/pci/ops-sh7786.c linux-2.6.39/arch/sh/drivers/pci/ops-sh7786.c
4852--- linux-2.6.39/arch/sh/drivers/pci/ops-sh7786.c 2011-05-19 00:06:34.000000000 -0400
4853+++ linux-2.6.39/arch/sh/drivers/pci/ops-sh7786.c 2011-05-22 19:36:30.000000000 -0400
4854@@ -165,7 +165,7 @@ out:
4855 return ret;
4856 }
4857
4858-struct pci_ops sh7786_pci_ops = {
4859+const struct pci_ops sh7786_pci_ops = {
4860 .read = sh7786_pcie_read,
4861 .write = sh7786_pcie_write,
4862 };
4863diff -urNp linux-2.6.39/arch/sh/drivers/pci/pcie-sh7786.c linux-2.6.39/arch/sh/drivers/pci/pcie-sh7786.c
4864--- linux-2.6.39/arch/sh/drivers/pci/pcie-sh7786.c 2011-05-19 00:06:34.000000000 -0400
4865+++ linux-2.6.39/arch/sh/drivers/pci/pcie-sh7786.c 2011-05-22 19:36:30.000000000 -0400
4866@@ -109,7 +109,7 @@ static struct resource sh7786_pci2_resou
4867 },
4868 };
4869
4870-extern struct pci_ops sh7786_pci_ops;
4871+extern const struct pci_ops sh7786_pci_ops;
4872
4873 #define DEFINE_CONTROLLER(start, idx) \
4874 { \
4875diff -urNp linux-2.6.39/arch/sh/drivers/pci/pci-sh4.h linux-2.6.39/arch/sh/drivers/pci/pci-sh4.h
4876--- linux-2.6.39/arch/sh/drivers/pci/pci-sh4.h 2011-05-19 00:06:34.000000000 -0400
4877+++ linux-2.6.39/arch/sh/drivers/pci/pci-sh4.h 2011-05-22 19:36:30.000000000 -0400
4878@@ -161,7 +161,7 @@
4879 #define SH4_PCIPDR 0x220 /* Port IO Data Register */
4880
4881 /* arch/sh/kernel/drivers/pci/ops-sh4.c */
4882-extern struct pci_ops sh4_pci_ops;
4883+extern const struct pci_ops sh4_pci_ops;
4884 int pci_fixup_pcic(struct pci_channel *chan);
4885
4886 struct sh4_pci_address_space {
4887diff -urNp linux-2.6.39/arch/sh/drivers/pci/pci-sh5.h linux-2.6.39/arch/sh/drivers/pci/pci-sh5.h
4888--- linux-2.6.39/arch/sh/drivers/pci/pci-sh5.h 2011-05-19 00:06:34.000000000 -0400
4889+++ linux-2.6.39/arch/sh/drivers/pci/pci-sh5.h 2011-05-22 19:36:30.000000000 -0400
4890@@ -105,6 +105,6 @@ extern unsigned long pcicr_virt;
4891 #define PCISH5_MEM_SIZCONV(x) (((x / 0x40000) - 1) << 18)
4892 #define PCISH5_IO_SIZCONV(x) (((x / 0x40000) - 1) << 18)
4893
4894-extern struct pci_ops sh5_pci_ops;
4895+extern const struct pci_ops sh5_pci_ops;
4896
4897 #endif /* __PCI_SH5_H */
4898diff -urNp linux-2.6.39/arch/sh/include/asm/dma-mapping.h linux-2.6.39/arch/sh/include/asm/dma-mapping.h
4899--- linux-2.6.39/arch/sh/include/asm/dma-mapping.h 2011-05-19 00:06:34.000000000 -0400
4900+++ linux-2.6.39/arch/sh/include/asm/dma-mapping.h 2011-05-22 19:36:30.000000000 -0400
4901@@ -1,10 +1,10 @@
4902 #ifndef __ASM_SH_DMA_MAPPING_H
4903 #define __ASM_SH_DMA_MAPPING_H
4904
4905-extern struct dma_map_ops *dma_ops;
4906+extern const struct dma_map_ops *dma_ops;
4907 extern void no_iommu_init(void);
4908
4909-static inline struct dma_map_ops *get_dma_ops(struct device *dev)
4910+static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
4911 {
4912 return dma_ops;
4913 }
4914@@ -14,7 +14,7 @@ static inline struct dma_map_ops *get_dm
4915
4916 static inline int dma_supported(struct device *dev, u64 mask)
4917 {
4918- struct dma_map_ops *ops = get_dma_ops(dev);
4919+ const struct dma_map_ops *ops = get_dma_ops(dev);
4920
4921 if (ops->dma_supported)
4922 return ops->dma_supported(dev, mask);
4923@@ -24,7 +24,7 @@ static inline int dma_supported(struct d
4924
4925 static inline int dma_set_mask(struct device *dev, u64 mask)
4926 {
4927- struct dma_map_ops *ops = get_dma_ops(dev);
4928+ const struct dma_map_ops *ops = get_dma_ops(dev);
4929
4930 if (!dev->dma_mask || !dma_supported(dev, mask))
4931 return -EIO;
4932@@ -44,7 +44,7 @@ void dma_cache_sync(struct device *dev,
4933
4934 static inline int dma_mapping_error(struct device *dev, dma_addr_t dma_addr)
4935 {
4936- struct dma_map_ops *ops = get_dma_ops(dev);
4937+ const struct dma_map_ops *ops = get_dma_ops(dev);
4938
4939 if (ops->mapping_error)
4940 return ops->mapping_error(dev, dma_addr);
4941@@ -55,7 +55,7 @@ static inline int dma_mapping_error(stru
4942 static inline void *dma_alloc_coherent(struct device *dev, size_t size,
4943 dma_addr_t *dma_handle, gfp_t gfp)
4944 {
4945- struct dma_map_ops *ops = get_dma_ops(dev);
4946+ const struct dma_map_ops *ops = get_dma_ops(dev);
4947 void *memory;
4948
4949 if (dma_alloc_from_coherent(dev, size, dma_handle, &memory))
4950@@ -72,7 +72,7 @@ static inline void *dma_alloc_coherent(s
4951 static inline void dma_free_coherent(struct device *dev, size_t size,
4952 void *vaddr, dma_addr_t dma_handle)
4953 {
4954- struct dma_map_ops *ops = get_dma_ops(dev);
4955+ const struct dma_map_ops *ops = get_dma_ops(dev);
4956
4957 if (dma_release_from_coherent(dev, get_order(size), vaddr))
4958 return;
4959diff -urNp linux-2.6.39/arch/sh/kernel/dma-nommu.c linux-2.6.39/arch/sh/kernel/dma-nommu.c
4960--- linux-2.6.39/arch/sh/kernel/dma-nommu.c 2011-05-19 00:06:34.000000000 -0400
4961+++ linux-2.6.39/arch/sh/kernel/dma-nommu.c 2011-05-22 19:36:30.000000000 -0400
4962@@ -62,7 +62,7 @@ static void nommu_sync_sg(struct device
4963 }
4964 #endif
4965
4966-struct dma_map_ops nommu_dma_ops = {
4967+const struct dma_map_ops nommu_dma_ops = {
4968 .alloc_coherent = dma_generic_alloc_coherent,
4969 .free_coherent = dma_generic_free_coherent,
4970 .map_page = nommu_map_page,
4971diff -urNp linux-2.6.39/arch/sh/kernel/kgdb.c linux-2.6.39/arch/sh/kernel/kgdb.c
4972--- linux-2.6.39/arch/sh/kernel/kgdb.c 2011-05-19 00:06:34.000000000 -0400
4973+++ linux-2.6.39/arch/sh/kernel/kgdb.c 2011-05-22 19:36:30.000000000 -0400
4974@@ -319,7 +319,7 @@ void kgdb_arch_exit(void)
4975 unregister_die_notifier(&kgdb_notifier);
4976 }
4977
4978-struct kgdb_arch arch_kgdb_ops = {
4979+const struct kgdb_arch arch_kgdb_ops = {
4980 /* Breakpoint instruction: trapa #0x3c */
4981 #ifdef CONFIG_CPU_LITTLE_ENDIAN
4982 .gdb_bpt_instr = { 0x3c, 0xc3 },
4983diff -urNp linux-2.6.39/arch/sh/mm/consistent.c linux-2.6.39/arch/sh/mm/consistent.c
4984--- linux-2.6.39/arch/sh/mm/consistent.c 2011-05-19 00:06:34.000000000 -0400
4985+++ linux-2.6.39/arch/sh/mm/consistent.c 2011-05-22 19:36:30.000000000 -0400
4986@@ -22,7 +22,7 @@
4987
4988 #define PREALLOC_DMA_DEBUG_ENTRIES 4096
4989
4990-struct dma_map_ops *dma_ops;
4991+const struct dma_map_ops *dma_ops;
4992 EXPORT_SYMBOL(dma_ops);
4993
4994 static int __init dma_init(void)
4995diff -urNp linux-2.6.39/arch/sh/mm/mmap.c linux-2.6.39/arch/sh/mm/mmap.c
4996--- linux-2.6.39/arch/sh/mm/mmap.c 2011-05-19 00:06:34.000000000 -0400
4997+++ linux-2.6.39/arch/sh/mm/mmap.c 2011-05-22 19:36:30.000000000 -0400
4998@@ -74,8 +74,7 @@ unsigned long arch_get_unmapped_area(str
4999 addr = PAGE_ALIGN(addr);
5000
5001 vma = find_vma(mm, addr);
5002- if (TASK_SIZE - len >= addr &&
5003- (!vma || addr + len <= vma->vm_start))
5004+ if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len))
5005 return addr;
5006 }
5007
5008@@ -106,7 +105,7 @@ full_search:
5009 }
5010 return -ENOMEM;
5011 }
5012- if (likely(!vma || addr + len <= vma->vm_start)) {
5013+ if (likely(check_heap_stack_gap(vma, addr, len))) {
5014 /*
5015 * Remember the place where we stopped the search:
5016 */
5017@@ -157,8 +156,7 @@ arch_get_unmapped_area_topdown(struct fi
5018 addr = PAGE_ALIGN(addr);
5019
5020 vma = find_vma(mm, addr);
5021- if (TASK_SIZE - len >= addr &&
5022- (!vma || addr + len <= vma->vm_start))
5023+ if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len))
5024 return addr;
5025 }
5026
5027@@ -179,7 +177,7 @@ arch_get_unmapped_area_topdown(struct fi
5028 /* make sure it can fit in the remaining address space */
5029 if (likely(addr > len)) {
5030 vma = find_vma(mm, addr-len);
5031- if (!vma || addr <= vma->vm_start) {
5032+ if (check_heap_stack_gap(vma, addr - len, len)) {
5033 /* remember the address as a hint for next time */
5034 return (mm->free_area_cache = addr-len);
5035 }
5036@@ -188,18 +186,18 @@ arch_get_unmapped_area_topdown(struct fi
5037 if (unlikely(mm->mmap_base < len))
5038 goto bottomup;
5039
5040- addr = mm->mmap_base-len;
5041- if (do_colour_align)
5042- addr = COLOUR_ALIGN_DOWN(addr, pgoff);
5043+ addr = mm->mmap_base - len;
5044
5045 do {
5046+ if (do_colour_align)
5047+ addr = COLOUR_ALIGN_DOWN(addr, pgoff);
5048 /*
5049 * Lookup failure means no vma is above this address,
5050 * else if new region fits below vma->vm_start,
5051 * return with success:
5052 */
5053 vma = find_vma(mm, addr);
5054- if (likely(!vma || addr+len <= vma->vm_start)) {
5055+ if (likely(check_heap_stack_gap(vma, addr, len))) {
5056 /* remember the address as a hint for next time */
5057 return (mm->free_area_cache = addr);
5058 }
5059@@ -209,10 +207,8 @@ arch_get_unmapped_area_topdown(struct fi
5060 mm->cached_hole_size = vma->vm_start - addr;
5061
5062 /* try just below the current vma->vm_start */
5063- addr = vma->vm_start-len;
5064- if (do_colour_align)
5065- addr = COLOUR_ALIGN_DOWN(addr, pgoff);
5066- } while (likely(len < vma->vm_start));
5067+ addr = skip_heap_stack_gap(vma, len);
5068+ } while (!IS_ERR_VALUE(addr));
5069
5070 bottomup:
5071 /*
5072diff -urNp linux-2.6.39/arch/sparc/include/asm/atomic_64.h linux-2.6.39/arch/sparc/include/asm/atomic_64.h
5073--- linux-2.6.39/arch/sparc/include/asm/atomic_64.h 2011-05-19 00:06:34.000000000 -0400
5074+++ linux-2.6.39/arch/sparc/include/asm/atomic_64.h 2011-05-22 19:36:30.000000000 -0400
5075@@ -14,18 +14,40 @@
5076 #define ATOMIC64_INIT(i) { (i) }
5077
5078 #define atomic_read(v) (*(volatile int *)&(v)->counter)
5079+static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
5080+{
5081+ return v->counter;
5082+}
5083 #define atomic64_read(v) (*(volatile long *)&(v)->counter)
5084+static inline long atomic64_read_unchecked(const atomic64_unchecked_t *v)
5085+{
5086+ return v->counter;
5087+}
5088
5089 #define atomic_set(v, i) (((v)->counter) = i)
5090+static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
5091+{
5092+ v->counter = i;
5093+}
5094 #define atomic64_set(v, i) (((v)->counter) = i)
5095+static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long i)
5096+{
5097+ v->counter = i;
5098+}
5099
5100 extern void atomic_add(int, atomic_t *);
5101+extern void atomic_add_unchecked(int, atomic_unchecked_t *);
5102 extern void atomic64_add(long, atomic64_t *);
5103+extern void atomic64_add_unchecked(long, atomic64_unchecked_t *);
5104 extern void atomic_sub(int, atomic_t *);
5105+extern void atomic_sub_unchecked(int, atomic_unchecked_t *);
5106 extern void atomic64_sub(long, atomic64_t *);
5107+extern void atomic64_sub_unchecked(long, atomic64_unchecked_t *);
5108
5109 extern int atomic_add_ret(int, atomic_t *);
5110+extern int atomic_add_ret_unchecked(int, atomic_unchecked_t *);
5111 extern long atomic64_add_ret(long, atomic64_t *);
5112+extern long atomic64_add_ret_unchecked(long, atomic64_unchecked_t *);
5113 extern int atomic_sub_ret(int, atomic_t *);
5114 extern long atomic64_sub_ret(long, atomic64_t *);
5115
5116@@ -33,12 +55,24 @@ extern long atomic64_sub_ret(long, atomi
5117 #define atomic64_dec_return(v) atomic64_sub_ret(1, v)
5118
5119 #define atomic_inc_return(v) atomic_add_ret(1, v)
5120+static inline int atomic_inc_return_unchecked(atomic_unchecked_t *v)
5121+{
5122+ return atomic_add_ret_unchecked(1, v);
5123+}
5124 #define atomic64_inc_return(v) atomic64_add_ret(1, v)
5125+static inline long atomic64_inc_return_unchecked(atomic64_unchecked_t *v)
5126+{
5127+ return atomic64_add_ret_unchecked(1, v);
5128+}
5129
5130 #define atomic_sub_return(i, v) atomic_sub_ret(i, v)
5131 #define atomic64_sub_return(i, v) atomic64_sub_ret(i, v)
5132
5133 #define atomic_add_return(i, v) atomic_add_ret(i, v)
5134+static inline int atomic_add_return_unchecked(int i, atomic_unchecked_t *v)
5135+{
5136+ return atomic_add_ret_unchecked(i, v);
5137+}
5138 #define atomic64_add_return(i, v) atomic64_add_ret(i, v)
5139
5140 /*
5141@@ -50,6 +84,7 @@ extern long atomic64_sub_ret(long, atomi
5142 * other cases.
5143 */
5144 #define atomic_inc_and_test(v) (atomic_inc_return(v) == 0)
5145+#define atomic_inc_and_test_unchecked(v) (atomic_inc_return_unchecked(v) == 0)
5146 #define atomic64_inc_and_test(v) (atomic64_inc_return(v) == 0)
5147
5148 #define atomic_sub_and_test(i, v) (atomic_sub_ret(i, v) == 0)
5149@@ -59,30 +94,59 @@ extern long atomic64_sub_ret(long, atomi
5150 #define atomic64_dec_and_test(v) (atomic64_sub_ret(1, v) == 0)
5151
5152 #define atomic_inc(v) atomic_add(1, v)
5153+static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
5154+{
5155+ atomic_add_unchecked(1, v);
5156+}
5157 #define atomic64_inc(v) atomic64_add(1, v)
5158+static inline void atomic64_inc_unchecked(atomic64_unchecked_t *v)
5159+{
5160+ atomic64_add_unchecked(1, v);
5161+}
5162
5163 #define atomic_dec(v) atomic_sub(1, v)
5164+static inline void atomic_dec_unchecked(atomic_unchecked_t *v)
5165+{
5166+ atomic_sub_unchecked(1, v);
5167+}
5168 #define atomic64_dec(v) atomic64_sub(1, v)
5169+static inline void atomic64_dec_unchecked(atomic64_unchecked_t *v)
5170+{
5171+ atomic64_sub_unchecked(1, v);
5172+}
5173
5174 #define atomic_add_negative(i, v) (atomic_add_ret(i, v) < 0)
5175 #define atomic64_add_negative(i, v) (atomic64_add_ret(i, v) < 0)
5176
5177 #define atomic_cmpxchg(v, o, n) (cmpxchg(&((v)->counter), (o), (n)))
5178+#define atomic_cmpxchg_unchecked(v, o, n) (cmpxchg(&((v)->counter), (o), (n)))
5179 #define atomic_xchg(v, new) (xchg(&((v)->counter), new))
5180+#define atomic_xchg_unchecked(v, new) (xchg(&((v)->counter), new))
5181
5182 static inline int atomic_add_unless(atomic_t *v, int a, int u)
5183 {
5184- int c, old;
5185+ int c, old, new;
5186 c = atomic_read(v);
5187 for (;;) {
5188- if (unlikely(c == (u)))
5189+ if (unlikely(c == u))
5190 break;
5191- old = atomic_cmpxchg((v), c, c + (a));
5192+
5193+ asm volatile("addcc %2, %0, %0\n"
5194+
5195+#ifdef CONFIG_PAX_REFCOUNT
5196+ "tvs %%icc, 6\n"
5197+#endif
5198+
5199+ : "=r" (new)
5200+ : "0" (c), "ir" (a)
5201+ : "cc");
5202+
5203+ old = atomic_cmpxchg(v, c, new);
5204 if (likely(old == c))
5205 break;
5206 c = old;
5207 }
5208- return c != (u);
5209+ return c != u;
5210 }
5211
5212 #define atomic_inc_not_zero(v) atomic_add_unless((v), 1, 0)
5213@@ -93,17 +157,28 @@ static inline int atomic_add_unless(atom
5214
5215 static inline long atomic64_add_unless(atomic64_t *v, long a, long u)
5216 {
5217- long c, old;
5218+ long c, old, new;
5219 c = atomic64_read(v);
5220 for (;;) {
5221- if (unlikely(c == (u)))
5222+ if (unlikely(c == u))
5223 break;
5224- old = atomic64_cmpxchg((v), c, c + (a));
5225+
5226+ asm volatile("addcc %2, %0, %0\n"
5227+
5228+#ifdef CONFIG_PAX_REFCOUNT
5229+ "tvs %%xcc, 6\n"
5230+#endif
5231+
5232+ : "=r" (new)
5233+ : "0" (c), "ir" (a)
5234+ : "cc");
5235+
5236+ old = atomic64_cmpxchg(v, c, new);
5237 if (likely(old == c))
5238 break;
5239 c = old;
5240 }
5241- return c != (u);
5242+ return c != u;
5243 }
5244
5245 #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
5246diff -urNp linux-2.6.39/arch/sparc/include/asm/cache.h linux-2.6.39/arch/sparc/include/asm/cache.h
5247--- linux-2.6.39/arch/sparc/include/asm/cache.h 2011-05-19 00:06:34.000000000 -0400
5248+++ linux-2.6.39/arch/sparc/include/asm/cache.h 2011-05-22 19:36:30.000000000 -0400
5249@@ -10,7 +10,7 @@
5250 #define ARCH_SLAB_MINALIGN __alignof__(unsigned long long)
5251
5252 #define L1_CACHE_SHIFT 5
5253-#define L1_CACHE_BYTES 32
5254+#define L1_CACHE_BYTES 32U
5255
5256 #ifdef CONFIG_SPARC32
5257 #define SMP_CACHE_BYTES_SHIFT 5
5258diff -urNp linux-2.6.39/arch/sparc/include/asm/dma-mapping.h linux-2.6.39/arch/sparc/include/asm/dma-mapping.h
5259--- linux-2.6.39/arch/sparc/include/asm/dma-mapping.h 2011-05-19 00:06:34.000000000 -0400
5260+++ linux-2.6.39/arch/sparc/include/asm/dma-mapping.h 2011-05-22 19:36:30.000000000 -0400
5261@@ -12,10 +12,10 @@ extern int dma_supported(struct device *
5262 #define dma_alloc_noncoherent(d, s, h, f) dma_alloc_coherent(d, s, h, f)
5263 #define dma_free_noncoherent(d, s, v, h) dma_free_coherent(d, s, v, h)
5264
5265-extern struct dma_map_ops *dma_ops, pci32_dma_ops;
5266+extern const struct dma_map_ops *dma_ops, pci32_dma_ops;
5267 extern struct bus_type pci_bus_type;
5268
5269-static inline struct dma_map_ops *get_dma_ops(struct device *dev)
5270+static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
5271 {
5272 #if defined(CONFIG_SPARC32) && defined(CONFIG_PCI)
5273 if (dev->bus == &pci_bus_type)
5274@@ -29,7 +29,7 @@ static inline struct dma_map_ops *get_dm
5275 static inline void *dma_alloc_coherent(struct device *dev, size_t size,
5276 dma_addr_t *dma_handle, gfp_t flag)
5277 {
5278- struct dma_map_ops *ops = get_dma_ops(dev);
5279+ const struct dma_map_ops *ops = get_dma_ops(dev);
5280 void *cpu_addr;
5281
5282 cpu_addr = ops->alloc_coherent(dev, size, dma_handle, flag);
5283@@ -40,7 +40,7 @@ static inline void *dma_alloc_coherent(s
5284 static inline void dma_free_coherent(struct device *dev, size_t size,
5285 void *cpu_addr, dma_addr_t dma_handle)
5286 {
5287- struct dma_map_ops *ops = get_dma_ops(dev);
5288+ const struct dma_map_ops *ops = get_dma_ops(dev);
5289
5290 debug_dma_free_coherent(dev, size, cpu_addr, dma_handle);
5291 ops->free_coherent(dev, size, cpu_addr, dma_handle);
5292diff -urNp linux-2.6.39/arch/sparc/include/asm/elf_32.h linux-2.6.39/arch/sparc/include/asm/elf_32.h
5293--- linux-2.6.39/arch/sparc/include/asm/elf_32.h 2011-05-19 00:06:34.000000000 -0400
5294+++ linux-2.6.39/arch/sparc/include/asm/elf_32.h 2011-05-22 19:36:30.000000000 -0400
5295@@ -114,6 +114,13 @@ typedef struct {
5296
5297 #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE)
5298
5299+#ifdef CONFIG_PAX_ASLR
5300+#define PAX_ELF_ET_DYN_BASE 0x10000UL
5301+
5302+#define PAX_DELTA_MMAP_LEN 16
5303+#define PAX_DELTA_STACK_LEN 16
5304+#endif
5305+
5306 /* This yields a mask that user programs can use to figure out what
5307 instruction set this cpu supports. This can NOT be done in userspace
5308 on Sparc. */
5309diff -urNp linux-2.6.39/arch/sparc/include/asm/elf_64.h linux-2.6.39/arch/sparc/include/asm/elf_64.h
5310--- linux-2.6.39/arch/sparc/include/asm/elf_64.h 2011-05-19 00:06:34.000000000 -0400
5311+++ linux-2.6.39/arch/sparc/include/asm/elf_64.h 2011-05-22 19:36:30.000000000 -0400
5312@@ -162,6 +162,12 @@ typedef struct {
5313 #define ELF_ET_DYN_BASE 0x0000010000000000UL
5314 #define COMPAT_ELF_ET_DYN_BASE 0x0000000070000000UL
5315
5316+#ifdef CONFIG_PAX_ASLR
5317+#define PAX_ELF_ET_DYN_BASE (test_thread_flag(TIF_32BIT) ? 0x10000UL : 0x100000UL)
5318+
5319+#define PAX_DELTA_MMAP_LEN (test_thread_flag(TIF_32BIT) ? 14 : 28)
5320+#define PAX_DELTA_STACK_LEN (test_thread_flag(TIF_32BIT) ? 15 : 29)
5321+#endif
5322
5323 /* This yields a mask that user programs can use to figure out what
5324 instruction set this cpu supports. */
5325diff -urNp linux-2.6.39/arch/sparc/include/asm/pgtable_32.h linux-2.6.39/arch/sparc/include/asm/pgtable_32.h
5326--- linux-2.6.39/arch/sparc/include/asm/pgtable_32.h 2011-05-19 00:06:34.000000000 -0400
5327+++ linux-2.6.39/arch/sparc/include/asm/pgtable_32.h 2011-05-22 19:36:30.000000000 -0400
5328@@ -43,6 +43,13 @@ BTFIXUPDEF_SIMM13(user_ptrs_per_pgd)
5329 BTFIXUPDEF_INT(page_none)
5330 BTFIXUPDEF_INT(page_copy)
5331 BTFIXUPDEF_INT(page_readonly)
5332+
5333+#ifdef CONFIG_PAX_PAGEEXEC
5334+BTFIXUPDEF_INT(page_shared_noexec)
5335+BTFIXUPDEF_INT(page_copy_noexec)
5336+BTFIXUPDEF_INT(page_readonly_noexec)
5337+#endif
5338+
5339 BTFIXUPDEF_INT(page_kernel)
5340
5341 #define PMD_SHIFT SUN4C_PMD_SHIFT
5342@@ -64,6 +71,16 @@ extern pgprot_t PAGE_SHARED;
5343 #define PAGE_COPY __pgprot(BTFIXUP_INT(page_copy))
5344 #define PAGE_READONLY __pgprot(BTFIXUP_INT(page_readonly))
5345
5346+#ifdef CONFIG_PAX_PAGEEXEC
5347+extern pgprot_t PAGE_SHARED_NOEXEC;
5348+# define PAGE_COPY_NOEXEC __pgprot(BTFIXUP_INT(page_copy_noexec))
5349+# define PAGE_READONLY_NOEXEC __pgprot(BTFIXUP_INT(page_readonly_noexec))
5350+#else
5351+# define PAGE_SHARED_NOEXEC PAGE_SHARED
5352+# define PAGE_COPY_NOEXEC PAGE_COPY
5353+# define PAGE_READONLY_NOEXEC PAGE_READONLY
5354+#endif
5355+
5356 extern unsigned long page_kernel;
5357
5358 #ifdef MODULE
5359diff -urNp linux-2.6.39/arch/sparc/include/asm/pgtsrmmu.h linux-2.6.39/arch/sparc/include/asm/pgtsrmmu.h
5360--- linux-2.6.39/arch/sparc/include/asm/pgtsrmmu.h 2011-05-19 00:06:34.000000000 -0400
5361+++ linux-2.6.39/arch/sparc/include/asm/pgtsrmmu.h 2011-05-22 19:36:30.000000000 -0400
5362@@ -115,6 +115,13 @@
5363 SRMMU_EXEC | SRMMU_REF)
5364 #define SRMMU_PAGE_RDONLY __pgprot(SRMMU_VALID | SRMMU_CACHE | \
5365 SRMMU_EXEC | SRMMU_REF)
5366+
5367+#ifdef CONFIG_PAX_PAGEEXEC
5368+#define SRMMU_PAGE_SHARED_NOEXEC __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_WRITE | SRMMU_REF)
5369+#define SRMMU_PAGE_COPY_NOEXEC __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_REF)
5370+#define SRMMU_PAGE_RDONLY_NOEXEC __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_REF)
5371+#endif
5372+
5373 #define SRMMU_PAGE_KERNEL __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_PRIV | \
5374 SRMMU_DIRTY | SRMMU_REF)
5375
5376diff -urNp linux-2.6.39/arch/sparc/include/asm/spinlock_64.h linux-2.6.39/arch/sparc/include/asm/spinlock_64.h
5377--- linux-2.6.39/arch/sparc/include/asm/spinlock_64.h 2011-05-19 00:06:34.000000000 -0400
5378+++ linux-2.6.39/arch/sparc/include/asm/spinlock_64.h 2011-05-22 19:36:30.000000000 -0400
5379@@ -92,14 +92,19 @@ static inline void arch_spin_lock_flags(
5380
5381 /* Multi-reader locks, these are much saner than the 32-bit Sparc ones... */
5382
5383-static void inline arch_read_lock(arch_rwlock_t *lock)
5384+static inline void arch_read_lock(arch_rwlock_t *lock)
5385 {
5386 unsigned long tmp1, tmp2;
5387
5388 __asm__ __volatile__ (
5389 "1: ldsw [%2], %0\n"
5390 " brlz,pn %0, 2f\n"
5391-"4: add %0, 1, %1\n"
5392+"4: addcc %0, 1, %1\n"
5393+
5394+#ifdef CONFIG_PAX_REFCOUNT
5395+" tvs %%icc, 6\n"
5396+#endif
5397+
5398 " cas [%2], %0, %1\n"
5399 " cmp %0, %1\n"
5400 " bne,pn %%icc, 1b\n"
5401@@ -112,10 +117,10 @@ static void inline arch_read_lock(arch_r
5402 " .previous"
5403 : "=&r" (tmp1), "=&r" (tmp2)
5404 : "r" (lock)
5405- : "memory");
5406+ : "memory", "cc");
5407 }
5408
5409-static int inline arch_read_trylock(arch_rwlock_t *lock)
5410+static inline int arch_read_trylock(arch_rwlock_t *lock)
5411 {
5412 int tmp1, tmp2;
5413
5414@@ -123,7 +128,12 @@ static int inline arch_read_trylock(arch
5415 "1: ldsw [%2], %0\n"
5416 " brlz,a,pn %0, 2f\n"
5417 " mov 0, %0\n"
5418-" add %0, 1, %1\n"
5419+" addcc %0, 1, %1\n"
5420+
5421+#ifdef CONFIG_PAX_REFCOUNT
5422+" tvs %%icc, 6\n"
5423+#endif
5424+
5425 " cas [%2], %0, %1\n"
5426 " cmp %0, %1\n"
5427 " bne,pn %%icc, 1b\n"
5428@@ -136,13 +146,18 @@ static int inline arch_read_trylock(arch
5429 return tmp1;
5430 }
5431
5432-static void inline arch_read_unlock(arch_rwlock_t *lock)
5433+static inline void arch_read_unlock(arch_rwlock_t *lock)
5434 {
5435 unsigned long tmp1, tmp2;
5436
5437 __asm__ __volatile__(
5438 "1: lduw [%2], %0\n"
5439-" sub %0, 1, %1\n"
5440+" subcc %0, 1, %1\n"
5441+
5442+#ifdef CONFIG_PAX_REFCOUNT
5443+" tvs %%icc, 6\n"
5444+#endif
5445+
5446 " cas [%2], %0, %1\n"
5447 " cmp %0, %1\n"
5448 " bne,pn %%xcc, 1b\n"
5449@@ -152,7 +167,7 @@ static void inline arch_read_unlock(arch
5450 : "memory");
5451 }
5452
5453-static void inline arch_write_lock(arch_rwlock_t *lock)
5454+static inline void arch_write_lock(arch_rwlock_t *lock)
5455 {
5456 unsigned long mask, tmp1, tmp2;
5457
5458@@ -177,7 +192,7 @@ static void inline arch_write_lock(arch_
5459 : "memory");
5460 }
5461
5462-static void inline arch_write_unlock(arch_rwlock_t *lock)
5463+static inline void arch_write_unlock(arch_rwlock_t *lock)
5464 {
5465 __asm__ __volatile__(
5466 " stw %%g0, [%0]"
5467@@ -186,7 +201,7 @@ static void inline arch_write_unlock(arc
5468 : "memory");
5469 }
5470
5471-static int inline arch_write_trylock(arch_rwlock_t *lock)
5472+static inline int arch_write_trylock(arch_rwlock_t *lock)
5473 {
5474 unsigned long mask, tmp1, tmp2, result;
5475
5476diff -urNp linux-2.6.39/arch/sparc/include/asm/uaccess_32.h linux-2.6.39/arch/sparc/include/asm/uaccess_32.h
5477--- linux-2.6.39/arch/sparc/include/asm/uaccess_32.h 2011-05-19 00:06:34.000000000 -0400
5478+++ linux-2.6.39/arch/sparc/include/asm/uaccess_32.h 2011-05-22 19:36:30.000000000 -0400
5479@@ -249,27 +249,46 @@ extern unsigned long __copy_user(void __
5480
5481 static inline unsigned long copy_to_user(void __user *to, const void *from, unsigned long n)
5482 {
5483- if (n && __access_ok((unsigned long) to, n))
5484+ if ((long)n < 0)
5485+ return n;
5486+
5487+ if (n && __access_ok((unsigned long) to, n)) {
5488+ if (!__builtin_constant_p(n))
5489+ check_object_size(from, n, true);
5490 return __copy_user(to, (__force void __user *) from, n);
5491- else
5492+ } else
5493 return n;
5494 }
5495
5496 static inline unsigned long __copy_to_user(void __user *to, const void *from, unsigned long n)
5497 {
5498+ if ((long)n < 0)
5499+ return n;
5500+
5501+ if (!__builtin_constant_p(n))
5502+ check_object_size(from, n, true);
5503+
5504 return __copy_user(to, (__force void __user *) from, n);
5505 }
5506
5507 static inline unsigned long copy_from_user(void *to, const void __user *from, unsigned long n)
5508 {
5509- if (n && __access_ok((unsigned long) from, n))
5510+ if ((long)n < 0)
5511+ return n;
5512+
5513+ if (n && __access_ok((unsigned long) from, n)) {
5514+ if (!__builtin_constant_p(n))
5515+ check_object_size(to, n, false);
5516 return __copy_user((__force void __user *) to, from, n);
5517- else
5518+ } else
5519 return n;
5520 }
5521
5522 static inline unsigned long __copy_from_user(void *to, const void __user *from, unsigned long n)
5523 {
5524+ if ((long)n < 0)
5525+ return n;
5526+
5527 return __copy_user((__force void __user *) to, from, n);
5528 }
5529
5530diff -urNp linux-2.6.39/arch/sparc/include/asm/uaccess_64.h linux-2.6.39/arch/sparc/include/asm/uaccess_64.h
5531--- linux-2.6.39/arch/sparc/include/asm/uaccess_64.h 2011-05-19 00:06:34.000000000 -0400
5532+++ linux-2.6.39/arch/sparc/include/asm/uaccess_64.h 2011-05-22 19:36:30.000000000 -0400
5533@@ -10,6 +10,7 @@
5534 #include <linux/compiler.h>
5535 #include <linux/string.h>
5536 #include <linux/thread_info.h>
5537+#include <linux/kernel.h>
5538 #include <asm/asi.h>
5539 #include <asm/system.h>
5540 #include <asm/spitfire.h>
5541@@ -213,8 +214,15 @@ extern unsigned long copy_from_user_fixu
5542 static inline unsigned long __must_check
5543 copy_from_user(void *to, const void __user *from, unsigned long size)
5544 {
5545- unsigned long ret = ___copy_from_user(to, from, size);
5546+ unsigned long ret;
5547
5548+ if ((long)size < 0 || size > INT_MAX)
5549+ return size;
5550+
5551+ if (!__builtin_constant_p(size))
5552+ check_object_size(to, size, false);
5553+
5554+ ret = ___copy_from_user(to, from, size);
5555 if (unlikely(ret))
5556 ret = copy_from_user_fixup(to, from, size);
5557
5558@@ -230,8 +238,15 @@ extern unsigned long copy_to_user_fixup(
5559 static inline unsigned long __must_check
5560 copy_to_user(void __user *to, const void *from, unsigned long size)
5561 {
5562- unsigned long ret = ___copy_to_user(to, from, size);
5563+ unsigned long ret;
5564+
5565+ if ((long)size < 0 || size > INT_MAX)
5566+ return size;
5567+
5568+ if (!__builtin_constant_p(size))
5569+ check_object_size(from, size, true);
5570
5571+ ret = ___copy_to_user(to, from, size);
5572 if (unlikely(ret))
5573 ret = copy_to_user_fixup(to, from, size);
5574 return ret;
5575diff -urNp linux-2.6.39/arch/sparc/include/asm/uaccess.h linux-2.6.39/arch/sparc/include/asm/uaccess.h
5576--- linux-2.6.39/arch/sparc/include/asm/uaccess.h 2011-05-19 00:06:34.000000000 -0400
5577+++ linux-2.6.39/arch/sparc/include/asm/uaccess.h 2011-05-22 19:36:30.000000000 -0400
5578@@ -1,5 +1,13 @@
5579 #ifndef ___ASM_SPARC_UACCESS_H
5580 #define ___ASM_SPARC_UACCESS_H
5581+
5582+#ifdef __KERNEL__
5583+#ifndef __ASSEMBLY__
5584+#include <linux/types.h>
5585+extern void check_object_size(const void *ptr, unsigned long n, bool to);
5586+#endif
5587+#endif
5588+
5589 #if defined(__sparc__) && defined(__arch64__)
5590 #include <asm/uaccess_64.h>
5591 #else
5592diff -urNp linux-2.6.39/arch/sparc/kernel/iommu.c linux-2.6.39/arch/sparc/kernel/iommu.c
5593--- linux-2.6.39/arch/sparc/kernel/iommu.c 2011-05-19 00:06:34.000000000 -0400
5594+++ linux-2.6.39/arch/sparc/kernel/iommu.c 2011-05-22 19:36:30.000000000 -0400
5595@@ -824,7 +824,7 @@ static void dma_4u_sync_sg_for_cpu(struc
5596 spin_unlock_irqrestore(&iommu->lock, flags);
5597 }
5598
5599-static struct dma_map_ops sun4u_dma_ops = {
5600+static const struct dma_map_ops sun4u_dma_ops = {
5601 .alloc_coherent = dma_4u_alloc_coherent,
5602 .free_coherent = dma_4u_free_coherent,
5603 .map_page = dma_4u_map_page,
5604@@ -835,7 +835,7 @@ static struct dma_map_ops sun4u_dma_ops
5605 .sync_sg_for_cpu = dma_4u_sync_sg_for_cpu,
5606 };
5607
5608-struct dma_map_ops *dma_ops = &sun4u_dma_ops;
5609+const struct dma_map_ops *dma_ops = &sun4u_dma_ops;
5610 EXPORT_SYMBOL(dma_ops);
5611
5612 extern int pci64_dma_supported(struct pci_dev *pdev, u64 device_mask);
5613diff -urNp linux-2.6.39/arch/sparc/kernel/ioport.c linux-2.6.39/arch/sparc/kernel/ioport.c
5614--- linux-2.6.39/arch/sparc/kernel/ioport.c 2011-05-19 00:06:34.000000000 -0400
5615+++ linux-2.6.39/arch/sparc/kernel/ioport.c 2011-05-22 19:36:30.000000000 -0400
5616@@ -402,7 +402,7 @@ static void sbus_sync_sg_for_device(stru
5617 BUG();
5618 }
5619
5620-struct dma_map_ops sbus_dma_ops = {
5621+const struct dma_map_ops sbus_dma_ops = {
5622 .alloc_coherent = sbus_alloc_coherent,
5623 .free_coherent = sbus_free_coherent,
5624 .map_page = sbus_map_page,
5625@@ -653,7 +653,7 @@ static void pci32_sync_sg_for_device(str
5626 }
5627 }
5628
5629-struct dma_map_ops pci32_dma_ops = {
5630+const struct dma_map_ops pci32_dma_ops = {
5631 .alloc_coherent = pci32_alloc_coherent,
5632 .free_coherent = pci32_free_coherent,
5633 .map_page = pci32_map_page,
5634diff -urNp linux-2.6.39/arch/sparc/kernel/kgdb_32.c linux-2.6.39/arch/sparc/kernel/kgdb_32.c
5635--- linux-2.6.39/arch/sparc/kernel/kgdb_32.c 2011-05-19 00:06:34.000000000 -0400
5636+++ linux-2.6.39/arch/sparc/kernel/kgdb_32.c 2011-05-22 19:36:30.000000000 -0400
5637@@ -164,7 +164,7 @@ void kgdb_arch_set_pc(struct pt_regs *re
5638 regs->npc = regs->pc + 4;
5639 }
5640
5641-struct kgdb_arch arch_kgdb_ops = {
5642+const struct kgdb_arch arch_kgdb_ops = {
5643 /* Breakpoint instruction: ta 0x7d */
5644 .gdb_bpt_instr = { 0x91, 0xd0, 0x20, 0x7d },
5645 };
5646diff -urNp linux-2.6.39/arch/sparc/kernel/kgdb_64.c linux-2.6.39/arch/sparc/kernel/kgdb_64.c
5647--- linux-2.6.39/arch/sparc/kernel/kgdb_64.c 2011-05-19 00:06:34.000000000 -0400
5648+++ linux-2.6.39/arch/sparc/kernel/kgdb_64.c 2011-05-22 19:36:30.000000000 -0400
5649@@ -187,7 +187,7 @@ void kgdb_arch_set_pc(struct pt_regs *re
5650 regs->tnpc = regs->tpc + 4;
5651 }
5652
5653-struct kgdb_arch arch_kgdb_ops = {
5654+const struct kgdb_arch arch_kgdb_ops = {
5655 /* Breakpoint instruction: ta 0x72 */
5656 .gdb_bpt_instr = { 0x91, 0xd0, 0x20, 0x72 },
5657 };
5658diff -urNp linux-2.6.39/arch/sparc/kernel/Makefile linux-2.6.39/arch/sparc/kernel/Makefile
5659--- linux-2.6.39/arch/sparc/kernel/Makefile 2011-05-19 00:06:34.000000000 -0400
5660+++ linux-2.6.39/arch/sparc/kernel/Makefile 2011-05-22 19:36:30.000000000 -0400
5661@@ -3,7 +3,7 @@
5662 #
5663
5664 asflags-y := -ansi
5665-ccflags-y := -Werror
5666+#ccflags-y := -Werror
5667
5668 extra-y := head_$(BITS).o
5669 extra-y += init_task.o
5670diff -urNp linux-2.6.39/arch/sparc/kernel/pcic.c linux-2.6.39/arch/sparc/kernel/pcic.c
5671--- linux-2.6.39/arch/sparc/kernel/pcic.c 2011-05-19 00:06:34.000000000 -0400
5672+++ linux-2.6.39/arch/sparc/kernel/pcic.c 2011-05-22 19:36:30.000000000 -0400
5673@@ -268,7 +268,7 @@ static int pcic_write_config(struct pci_
5674 return -EINVAL;
5675 }
5676
5677-static struct pci_ops pcic_ops = {
5678+static const struct pci_ops pcic_ops = {
5679 .read = pcic_read_config,
5680 .write = pcic_write_config,
5681 };
5682diff -urNp linux-2.6.39/arch/sparc/kernel/pci_common.c linux-2.6.39/arch/sparc/kernel/pci_common.c
5683--- linux-2.6.39/arch/sparc/kernel/pci_common.c 2011-05-19 00:06:34.000000000 -0400
5684+++ linux-2.6.39/arch/sparc/kernel/pci_common.c 2011-05-22 19:36:30.000000000 -0400
5685@@ -249,7 +249,7 @@ static int sun4u_write_pci_cfg(struct pc
5686 return PCIBIOS_SUCCESSFUL;
5687 }
5688
5689-struct pci_ops sun4u_pci_ops = {
5690+const struct pci_ops sun4u_pci_ops = {
5691 .read = sun4u_read_pci_cfg,
5692 .write = sun4u_write_pci_cfg,
5693 };
5694@@ -310,7 +310,7 @@ static int sun4v_write_pci_cfg(struct pc
5695 return PCIBIOS_SUCCESSFUL;
5696 }
5697
5698-struct pci_ops sun4v_pci_ops = {
5699+const struct pci_ops sun4v_pci_ops = {
5700 .read = sun4v_read_pci_cfg,
5701 .write = sun4v_write_pci_cfg,
5702 };
5703diff -urNp linux-2.6.39/arch/sparc/kernel/pci_impl.h linux-2.6.39/arch/sparc/kernel/pci_impl.h
5704--- linux-2.6.39/arch/sparc/kernel/pci_impl.h 2011-05-19 00:06:34.000000000 -0400
5705+++ linux-2.6.39/arch/sparc/kernel/pci_impl.h 2011-05-22 19:36:30.000000000 -0400
5706@@ -175,8 +175,8 @@ extern void pci_config_write8(u8 *addr,
5707 extern void pci_config_write16(u16 *addr, u16 val);
5708 extern void pci_config_write32(u32 *addr, u32 val);
5709
5710-extern struct pci_ops sun4u_pci_ops;
5711-extern struct pci_ops sun4v_pci_ops;
5712+extern const struct pci_ops sun4u_pci_ops;
5713+extern const struct pci_ops sun4v_pci_ops;
5714
5715 extern volatile int pci_poke_in_progress;
5716 extern volatile int pci_poke_cpu;
5717diff -urNp linux-2.6.39/arch/sparc/kernel/pci_sun4v.c linux-2.6.39/arch/sparc/kernel/pci_sun4v.c
5718--- linux-2.6.39/arch/sparc/kernel/pci_sun4v.c 2011-05-19 00:06:34.000000000 -0400
5719+++ linux-2.6.39/arch/sparc/kernel/pci_sun4v.c 2011-05-22 19:36:30.000000000 -0400
5720@@ -525,7 +525,7 @@ static void dma_4v_unmap_sg(struct devic
5721 spin_unlock_irqrestore(&iommu->lock, flags);
5722 }
5723
5724-static struct dma_map_ops sun4v_dma_ops = {
5725+static const struct dma_map_ops sun4v_dma_ops = {
5726 .alloc_coherent = dma_4v_alloc_coherent,
5727 .free_coherent = dma_4v_free_coherent,
5728 .map_page = dma_4v_map_page,
5729diff -urNp linux-2.6.39/arch/sparc/kernel/process_32.c linux-2.6.39/arch/sparc/kernel/process_32.c
5730--- linux-2.6.39/arch/sparc/kernel/process_32.c 2011-05-19 00:06:34.000000000 -0400
5731+++ linux-2.6.39/arch/sparc/kernel/process_32.c 2011-05-22 19:41:32.000000000 -0400
5732@@ -196,7 +196,7 @@ void __show_backtrace(unsigned long fp)
5733 rw->ins[4], rw->ins[5],
5734 rw->ins[6],
5735 rw->ins[7]);
5736- printk("%pS\n", (void *) rw->ins[7]);
5737+ printk("%pA\n", (void *) rw->ins[7]);
5738 rw = (struct reg_window32 *) rw->ins[6];
5739 }
5740 spin_unlock_irqrestore(&sparc_backtrace_lock, flags);
5741@@ -263,14 +263,14 @@ void show_regs(struct pt_regs *r)
5742
5743 printk("PSR: %08lx PC: %08lx NPC: %08lx Y: %08lx %s\n",
5744 r->psr, r->pc, r->npc, r->y, print_tainted());
5745- printk("PC: <%pS>\n", (void *) r->pc);
5746+ printk("PC: <%pA>\n", (void *) r->pc);
5747 printk("%%G: %08lx %08lx %08lx %08lx %08lx %08lx %08lx %08lx\n",
5748 r->u_regs[0], r->u_regs[1], r->u_regs[2], r->u_regs[3],
5749 r->u_regs[4], r->u_regs[5], r->u_regs[6], r->u_regs[7]);
5750 printk("%%O: %08lx %08lx %08lx %08lx %08lx %08lx %08lx %08lx\n",
5751 r->u_regs[8], r->u_regs[9], r->u_regs[10], r->u_regs[11],
5752 r->u_regs[12], r->u_regs[13], r->u_regs[14], r->u_regs[15]);
5753- printk("RPC: <%pS>\n", (void *) r->u_regs[15]);
5754+ printk("RPC: <%pA>\n", (void *) r->u_regs[15]);
5755
5756 printk("%%L: %08lx %08lx %08lx %08lx %08lx %08lx %08lx %08lx\n",
5757 rw->locals[0], rw->locals[1], rw->locals[2], rw->locals[3],
5758@@ -305,7 +305,7 @@ void show_stack(struct task_struct *tsk,
5759 rw = (struct reg_window32 *) fp;
5760 pc = rw->ins[7];
5761 printk("[%08lx : ", pc);
5762- printk("%pS ] ", (void *) pc);
5763+ printk("%pA ] ", (void *) pc);
5764 fp = rw->ins[6];
5765 } while (++count < 16);
5766 printk("\n");
5767diff -urNp linux-2.6.39/arch/sparc/kernel/process_64.c linux-2.6.39/arch/sparc/kernel/process_64.c
5768--- linux-2.6.39/arch/sparc/kernel/process_64.c 2011-05-19 00:06:34.000000000 -0400
5769+++ linux-2.6.39/arch/sparc/kernel/process_64.c 2011-05-22 19:41:32.000000000 -0400
5770@@ -180,14 +180,14 @@ static void show_regwindow(struct pt_reg
5771 printk("i4: %016lx i5: %016lx i6: %016lx i7: %016lx\n",
5772 rwk->ins[4], rwk->ins[5], rwk->ins[6], rwk->ins[7]);
5773 if (regs->tstate & TSTATE_PRIV)
5774- printk("I7: <%pS>\n", (void *) rwk->ins[7]);
5775+ printk("I7: <%pA>\n", (void *) rwk->ins[7]);
5776 }
5777
5778 void show_regs(struct pt_regs *regs)
5779 {
5780 printk("TSTATE: %016lx TPC: %016lx TNPC: %016lx Y: %08x %s\n", regs->tstate,
5781 regs->tpc, regs->tnpc, regs->y, print_tainted());
5782- printk("TPC: <%pS>\n", (void *) regs->tpc);
5783+ printk("TPC: <%pA>\n", (void *) regs->tpc);
5784 printk("g0: %016lx g1: %016lx g2: %016lx g3: %016lx\n",
5785 regs->u_regs[0], regs->u_regs[1], regs->u_regs[2],
5786 regs->u_regs[3]);
5787@@ -200,7 +200,7 @@ void show_regs(struct pt_regs *regs)
5788 printk("o4: %016lx o5: %016lx sp: %016lx ret_pc: %016lx\n",
5789 regs->u_regs[12], regs->u_regs[13], regs->u_regs[14],
5790 regs->u_regs[15]);
5791- printk("RPC: <%pS>\n", (void *) regs->u_regs[15]);
5792+ printk("RPC: <%pA>\n", (void *) regs->u_regs[15]);
5793 show_regwindow(regs);
5794 show_stack(current, (unsigned long *) regs->u_regs[UREG_FP]);
5795 }
5796@@ -285,7 +285,7 @@ void arch_trigger_all_cpu_backtrace(void
5797 ((tp && tp->task) ? tp->task->pid : -1));
5798
5799 if (gp->tstate & TSTATE_PRIV) {
5800- printk(" TPC[%pS] O7[%pS] I7[%pS] RPC[%pS]\n",
5801+ printk(" TPC[%pA] O7[%pA] I7[%pA] RPC[%pA]\n",
5802 (void *) gp->tpc,
5803 (void *) gp->o7,
5804 (void *) gp->i7,
5805diff -urNp linux-2.6.39/arch/sparc/kernel/sys_sparc_32.c linux-2.6.39/arch/sparc/kernel/sys_sparc_32.c
5806--- linux-2.6.39/arch/sparc/kernel/sys_sparc_32.c 2011-05-19 00:06:34.000000000 -0400
5807+++ linux-2.6.39/arch/sparc/kernel/sys_sparc_32.c 2011-05-22 19:36:30.000000000 -0400
5808@@ -56,7 +56,7 @@ unsigned long arch_get_unmapped_area(str
5809 if (ARCH_SUN4C && len > 0x20000000)
5810 return -ENOMEM;
5811 if (!addr)
5812- addr = TASK_UNMAPPED_BASE;
5813+ addr = current->mm->mmap_base;
5814
5815 if (flags & MAP_SHARED)
5816 addr = COLOUR_ALIGN(addr);
5817@@ -71,7 +71,7 @@ unsigned long arch_get_unmapped_area(str
5818 }
5819 if (TASK_SIZE - PAGE_SIZE - len < addr)
5820 return -ENOMEM;
5821- if (!vmm || addr + len <= vmm->vm_start)
5822+ if (check_heap_stack_gap(vmm, addr, len))
5823 return addr;
5824 addr = vmm->vm_end;
5825 if (flags & MAP_SHARED)
5826diff -urNp linux-2.6.39/arch/sparc/kernel/sys_sparc_64.c linux-2.6.39/arch/sparc/kernel/sys_sparc_64.c
5827--- linux-2.6.39/arch/sparc/kernel/sys_sparc_64.c 2011-05-19 00:06:34.000000000 -0400
5828+++ linux-2.6.39/arch/sparc/kernel/sys_sparc_64.c 2011-05-22 19:36:30.000000000 -0400
5829@@ -124,7 +124,7 @@ unsigned long arch_get_unmapped_area(str
5830 /* We do not accept a shared mapping if it would violate
5831 * cache aliasing constraints.
5832 */
5833- if ((flags & MAP_SHARED) &&
5834+ if ((filp || (flags & MAP_SHARED)) &&
5835 ((addr - (pgoff << PAGE_SHIFT)) & (SHMLBA - 1)))
5836 return -EINVAL;
5837 return addr;
5838@@ -139,6 +139,10 @@ unsigned long arch_get_unmapped_area(str
5839 if (filp || (flags & MAP_SHARED))
5840 do_color_align = 1;
5841
5842+#ifdef CONFIG_PAX_RANDMMAP
5843+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
5844+#endif
5845+
5846 if (addr) {
5847 if (do_color_align)
5848 addr = COLOUR_ALIGN(addr, pgoff);
5849@@ -146,15 +150,14 @@ unsigned long arch_get_unmapped_area(str
5850 addr = PAGE_ALIGN(addr);
5851
5852 vma = find_vma(mm, addr);
5853- if (task_size - len >= addr &&
5854- (!vma || addr + len <= vma->vm_start))
5855+ if (task_size - len >= addr && check_heap_stack_gap(vma, addr, len))
5856 return addr;
5857 }
5858
5859 if (len > mm->cached_hole_size) {
5860- start_addr = addr = mm->free_area_cache;
5861+ start_addr = addr = mm->free_area_cache;
5862 } else {
5863- start_addr = addr = TASK_UNMAPPED_BASE;
5864+ start_addr = addr = mm->mmap_base;
5865 mm->cached_hole_size = 0;
5866 }
5867
5868@@ -174,14 +177,14 @@ full_search:
5869 vma = find_vma(mm, VA_EXCLUDE_END);
5870 }
5871 if (unlikely(task_size < addr)) {
5872- if (start_addr != TASK_UNMAPPED_BASE) {
5873- start_addr = addr = TASK_UNMAPPED_BASE;
5874+ if (start_addr != mm->mmap_base) {
5875+ start_addr = addr = mm->mmap_base;
5876 mm->cached_hole_size = 0;
5877 goto full_search;
5878 }
5879 return -ENOMEM;
5880 }
5881- if (likely(!vma || addr + len <= vma->vm_start)) {
5882+ if (likely(check_heap_stack_gap(vma, addr, len))) {
5883 /*
5884 * Remember the place where we stopped the search:
5885 */
5886@@ -215,7 +218,7 @@ arch_get_unmapped_area_topdown(struct fi
5887 /* We do not accept a shared mapping if it would violate
5888 * cache aliasing constraints.
5889 */
5890- if ((flags & MAP_SHARED) &&
5891+ if ((filp || (flags & MAP_SHARED)) &&
5892 ((addr - (pgoff << PAGE_SHIFT)) & (SHMLBA - 1)))
5893 return -EINVAL;
5894 return addr;
5895@@ -236,8 +239,7 @@ arch_get_unmapped_area_topdown(struct fi
5896 addr = PAGE_ALIGN(addr);
5897
5898 vma = find_vma(mm, addr);
5899- if (task_size - len >= addr &&
5900- (!vma || addr + len <= vma->vm_start))
5901+ if (task_size - len >= addr && check_heap_stack_gap(vma, addr, len))
5902 return addr;
5903 }
5904
5905@@ -258,7 +260,7 @@ arch_get_unmapped_area_topdown(struct fi
5906 /* make sure it can fit in the remaining address space */
5907 if (likely(addr > len)) {
5908 vma = find_vma(mm, addr-len);
5909- if (!vma || addr <= vma->vm_start) {
5910+ if (check_heap_stack_gap(vma, addr - len, len)) {
5911 /* remember the address as a hint for next time */
5912 return (mm->free_area_cache = addr-len);
5913 }
5914@@ -267,18 +269,18 @@ arch_get_unmapped_area_topdown(struct fi
5915 if (unlikely(mm->mmap_base < len))
5916 goto bottomup;
5917
5918- addr = mm->mmap_base-len;
5919- if (do_color_align)
5920- addr = COLOUR_ALIGN_DOWN(addr, pgoff);
5921+ addr = mm->mmap_base - len;
5922
5923 do {
5924+ if (do_color_align)
5925+ addr = COLOUR_ALIGN_DOWN(addr, pgoff);
5926 /*
5927 * Lookup failure means no vma is above this address,
5928 * else if new region fits below vma->vm_start,
5929 * return with success:
5930 */
5931 vma = find_vma(mm, addr);
5932- if (likely(!vma || addr+len <= vma->vm_start)) {
5933+ if (likely(check_heap_stack_gap(vma, addr, len))) {
5934 /* remember the address as a hint for next time */
5935 return (mm->free_area_cache = addr);
5936 }
5937@@ -288,10 +290,8 @@ arch_get_unmapped_area_topdown(struct fi
5938 mm->cached_hole_size = vma->vm_start - addr;
5939
5940 /* try just below the current vma->vm_start */
5941- addr = vma->vm_start-len;
5942- if (do_color_align)
5943- addr = COLOUR_ALIGN_DOWN(addr, pgoff);
5944- } while (likely(len < vma->vm_start));
5945+ addr = skip_heap_stack_gap(vma, len);
5946+ } while (!IS_ERR_VALUE(addr));
5947
5948 bottomup:
5949 /*
5950@@ -390,6 +390,12 @@ void arch_pick_mmap_layout(struct mm_str
5951 gap == RLIM_INFINITY ||
5952 sysctl_legacy_va_layout) {
5953 mm->mmap_base = TASK_UNMAPPED_BASE + random_factor;
5954+
5955+#ifdef CONFIG_PAX_RANDMMAP
5956+ if (mm->pax_flags & MF_PAX_RANDMMAP)
5957+ mm->mmap_base += mm->delta_mmap;
5958+#endif
5959+
5960 mm->get_unmapped_area = arch_get_unmapped_area;
5961 mm->unmap_area = arch_unmap_area;
5962 } else {
5963@@ -402,6 +408,12 @@ void arch_pick_mmap_layout(struct mm_str
5964 gap = (task_size / 6 * 5);
5965
5966 mm->mmap_base = PAGE_ALIGN(task_size - gap - random_factor);
5967+
5968+#ifdef CONFIG_PAX_RANDMMAP
5969+ if (mm->pax_flags & MF_PAX_RANDMMAP)
5970+ mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
5971+#endif
5972+
5973 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
5974 mm->unmap_area = arch_unmap_area_topdown;
5975 }
5976diff -urNp linux-2.6.39/arch/sparc/kernel/traps_32.c linux-2.6.39/arch/sparc/kernel/traps_32.c
5977--- linux-2.6.39/arch/sparc/kernel/traps_32.c 2011-05-19 00:06:34.000000000 -0400
5978+++ linux-2.6.39/arch/sparc/kernel/traps_32.c 2011-05-22 19:41:32.000000000 -0400
5979@@ -76,7 +76,7 @@ void die_if_kernel(char *str, struct pt_
5980 count++ < 30 &&
5981 (((unsigned long) rw) >= PAGE_OFFSET) &&
5982 !(((unsigned long) rw) & 0x7)) {
5983- printk("Caller[%08lx]: %pS\n", rw->ins[7],
5984+ printk("Caller[%08lx]: %pA\n", rw->ins[7],
5985 (void *) rw->ins[7]);
5986 rw = (struct reg_window32 *)rw->ins[6];
5987 }
5988diff -urNp linux-2.6.39/arch/sparc/kernel/traps_64.c linux-2.6.39/arch/sparc/kernel/traps_64.c
5989--- linux-2.6.39/arch/sparc/kernel/traps_64.c 2011-05-19 00:06:34.000000000 -0400
5990+++ linux-2.6.39/arch/sparc/kernel/traps_64.c 2011-05-22 19:41:32.000000000 -0400
5991@@ -75,7 +75,7 @@ static void dump_tl1_traplog(struct tl1_
5992 i + 1,
5993 p->trapstack[i].tstate, p->trapstack[i].tpc,
5994 p->trapstack[i].tnpc, p->trapstack[i].tt);
5995- printk("TRAPLOG: TPC<%pS>\n", (void *) p->trapstack[i].tpc);
5996+ printk("TRAPLOG: TPC<%pA>\n", (void *) p->trapstack[i].tpc);
5997 }
5998 }
5999
6000@@ -95,6 +95,12 @@ void bad_trap(struct pt_regs *regs, long
6001
6002 lvl -= 0x100;
6003 if (regs->tstate & TSTATE_PRIV) {
6004+
6005+#ifdef CONFIG_PAX_REFCOUNT
6006+ if (lvl == 6)
6007+ pax_report_refcount_overflow(regs);
6008+#endif
6009+
6010 sprintf(buffer, "Kernel bad sw trap %lx", lvl);
6011 die_if_kernel(buffer, regs);
6012 }
6013@@ -113,11 +119,16 @@ void bad_trap(struct pt_regs *regs, long
6014 void bad_trap_tl1(struct pt_regs *regs, long lvl)
6015 {
6016 char buffer[32];
6017-
6018+
6019 if (notify_die(DIE_TRAP_TL1, "bad trap tl1", regs,
6020 0, lvl, SIGTRAP) == NOTIFY_STOP)
6021 return;
6022
6023+#ifdef CONFIG_PAX_REFCOUNT
6024+ if (lvl == 6)
6025+ pax_report_refcount_overflow(regs);
6026+#endif
6027+
6028 dump_tl1_traplog((struct tl1_traplog *)(regs + 1));
6029
6030 sprintf (buffer, "Bad trap %lx at tl>0", lvl);
6031@@ -1141,7 +1152,7 @@ static void cheetah_log_errors(struct pt
6032 regs->tpc, regs->tnpc, regs->u_regs[UREG_I7], regs->tstate);
6033 printk("%s" "ERROR(%d): ",
6034 (recoverable ? KERN_WARNING : KERN_CRIT), smp_processor_id());
6035- printk("TPC<%pS>\n", (void *) regs->tpc);
6036+ printk("TPC<%pA>\n", (void *) regs->tpc);
6037 printk("%s" "ERROR(%d): M_SYND(%lx), E_SYND(%lx)%s%s\n",
6038 (recoverable ? KERN_WARNING : KERN_CRIT), smp_processor_id(),
6039 (afsr & CHAFSR_M_SYNDROME) >> CHAFSR_M_SYNDROME_SHIFT,
6040@@ -1748,7 +1759,7 @@ void cheetah_plus_parity_error(int type,
6041 smp_processor_id(),
6042 (type & 0x1) ? 'I' : 'D',
6043 regs->tpc);
6044- printk(KERN_EMERG "TPC<%pS>\n", (void *) regs->tpc);
6045+ printk(KERN_EMERG "TPC<%pA>\n", (void *) regs->tpc);
6046 panic("Irrecoverable Cheetah+ parity error.");
6047 }
6048
6049@@ -1756,7 +1767,7 @@ void cheetah_plus_parity_error(int type,
6050 smp_processor_id(),
6051 (type & 0x1) ? 'I' : 'D',
6052 regs->tpc);
6053- printk(KERN_WARNING "TPC<%pS>\n", (void *) regs->tpc);
6054+ printk(KERN_WARNING "TPC<%pA>\n", (void *) regs->tpc);
6055 }
6056
6057 struct sun4v_error_entry {
6058@@ -1963,9 +1974,9 @@ void sun4v_itlb_error_report(struct pt_r
6059
6060 printk(KERN_EMERG "SUN4V-ITLB: Error at TPC[%lx], tl %d\n",
6061 regs->tpc, tl);
6062- printk(KERN_EMERG "SUN4V-ITLB: TPC<%pS>\n", (void *) regs->tpc);
6063+ printk(KERN_EMERG "SUN4V-ITLB: TPC<%pA>\n", (void *) regs->tpc);
6064 printk(KERN_EMERG "SUN4V-ITLB: O7[%lx]\n", regs->u_regs[UREG_I7]);
6065- printk(KERN_EMERG "SUN4V-ITLB: O7<%pS>\n",
6066+ printk(KERN_EMERG "SUN4V-ITLB: O7<%pA>\n",
6067 (void *) regs->u_regs[UREG_I7]);
6068 printk(KERN_EMERG "SUN4V-ITLB: vaddr[%lx] ctx[%lx] "
6069 "pte[%lx] error[%lx]\n",
6070@@ -1987,9 +1998,9 @@ void sun4v_dtlb_error_report(struct pt_r
6071
6072 printk(KERN_EMERG "SUN4V-DTLB: Error at TPC[%lx], tl %d\n",
6073 regs->tpc, tl);
6074- printk(KERN_EMERG "SUN4V-DTLB: TPC<%pS>\n", (void *) regs->tpc);
6075+ printk(KERN_EMERG "SUN4V-DTLB: TPC<%pA>\n", (void *) regs->tpc);
6076 printk(KERN_EMERG "SUN4V-DTLB: O7[%lx]\n", regs->u_regs[UREG_I7]);
6077- printk(KERN_EMERG "SUN4V-DTLB: O7<%pS>\n",
6078+ printk(KERN_EMERG "SUN4V-DTLB: O7<%pA>\n",
6079 (void *) regs->u_regs[UREG_I7]);
6080 printk(KERN_EMERG "SUN4V-DTLB: vaddr[%lx] ctx[%lx] "
6081 "pte[%lx] error[%lx]\n",
6082@@ -2195,13 +2206,13 @@ void show_stack(struct task_struct *tsk,
6083 fp = (unsigned long)sf->fp + STACK_BIAS;
6084 }
6085
6086- printk(" [%016lx] %pS\n", pc, (void *) pc);
6087+ printk(" [%016lx] %pA\n", pc, (void *) pc);
6088 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
6089 if ((pc + 8UL) == (unsigned long) &return_to_handler) {
6090 int index = tsk->curr_ret_stack;
6091 if (tsk->ret_stack && index >= graph) {
6092 pc = tsk->ret_stack[index - graph].ret;
6093- printk(" [%016lx] %pS\n", pc, (void *) pc);
6094+ printk(" [%016lx] %pA\n", pc, (void *) pc);
6095 graph++;
6096 }
6097 }
6098@@ -2254,7 +2265,7 @@ void die_if_kernel(char *str, struct pt_
6099 while (rw &&
6100 count++ < 30 &&
6101 kstack_valid(tp, (unsigned long) rw)) {
6102- printk("Caller[%016lx]: %pS\n", rw->ins[7],
6103+ printk("Caller[%016lx]: %pA\n", rw->ins[7],
6104 (void *) rw->ins[7]);
6105
6106 rw = kernel_stack_up(rw);
6107diff -urNp linux-2.6.39/arch/sparc/kernel/unaligned_64.c linux-2.6.39/arch/sparc/kernel/unaligned_64.c
6108--- linux-2.6.39/arch/sparc/kernel/unaligned_64.c 2011-05-19 00:06:34.000000000 -0400
6109+++ linux-2.6.39/arch/sparc/kernel/unaligned_64.c 2011-05-22 19:41:32.000000000 -0400
6110@@ -278,7 +278,7 @@ static void log_unaligned(struct pt_regs
6111 static DEFINE_RATELIMIT_STATE(ratelimit, 5 * HZ, 5);
6112
6113 if (__ratelimit(&ratelimit)) {
6114- printk("Kernel unaligned access at TPC[%lx] %pS\n",
6115+ printk("Kernel unaligned access at TPC[%lx] %pA\n",
6116 regs->tpc, (void *) regs->tpc);
6117 }
6118 }
6119diff -urNp linux-2.6.39/arch/sparc/lib/atomic_64.S linux-2.6.39/arch/sparc/lib/atomic_64.S
6120--- linux-2.6.39/arch/sparc/lib/atomic_64.S 2011-05-19 00:06:34.000000000 -0400
6121+++ linux-2.6.39/arch/sparc/lib/atomic_64.S 2011-05-22 19:36:30.000000000 -0400
6122@@ -18,7 +18,12 @@
6123 atomic_add: /* %o0 = increment, %o1 = atomic_ptr */
6124 BACKOFF_SETUP(%o2)
6125 1: lduw [%o1], %g1
6126- add %g1, %o0, %g7
6127+ addcc %g1, %o0, %g7
6128+
6129+#ifdef CONFIG_PAX_REFCOUNT
6130+ tvs %icc, 6
6131+#endif
6132+
6133 cas [%o1], %g1, %g7
6134 cmp %g1, %g7
6135 bne,pn %icc, BACKOFF_LABEL(2f, 1b)
6136@@ -28,12 +33,32 @@ atomic_add: /* %o0 = increment, %o1 = at
6137 2: BACKOFF_SPIN(%o2, %o3, 1b)
6138 .size atomic_add, .-atomic_add
6139
6140+ .globl atomic_add_unchecked
6141+ .type atomic_add_unchecked,#function
6142+atomic_add_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
6143+ BACKOFF_SETUP(%o2)
6144+1: lduw [%o1], %g1
6145+ add %g1, %o0, %g7
6146+ cas [%o1], %g1, %g7
6147+ cmp %g1, %g7
6148+ bne,pn %icc, 2f
6149+ nop
6150+ retl
6151+ nop
6152+2: BACKOFF_SPIN(%o2, %o3, 1b)
6153+ .size atomic_add_unchecked, .-atomic_add_unchecked
6154+
6155 .globl atomic_sub
6156 .type atomic_sub,#function
6157 atomic_sub: /* %o0 = decrement, %o1 = atomic_ptr */
6158 BACKOFF_SETUP(%o2)
6159 1: lduw [%o1], %g1
6160- sub %g1, %o0, %g7
6161+ subcc %g1, %o0, %g7
6162+
6163+#ifdef CONFIG_PAX_REFCOUNT
6164+ tvs %icc, 6
6165+#endif
6166+
6167 cas [%o1], %g1, %g7
6168 cmp %g1, %g7
6169 bne,pn %icc, BACKOFF_LABEL(2f, 1b)
6170@@ -43,12 +68,32 @@ atomic_sub: /* %o0 = decrement, %o1 = at
6171 2: BACKOFF_SPIN(%o2, %o3, 1b)
6172 .size atomic_sub, .-atomic_sub
6173
6174+ .globl atomic_sub_unchecked
6175+ .type atomic_sub_unchecked,#function
6176+atomic_sub_unchecked: /* %o0 = decrement, %o1 = atomic_ptr */
6177+ BACKOFF_SETUP(%o2)
6178+1: lduw [%o1], %g1
6179+ sub %g1, %o0, %g7
6180+ cas [%o1], %g1, %g7
6181+ cmp %g1, %g7
6182+ bne,pn %icc, 2f
6183+ nop
6184+ retl
6185+ nop
6186+2: BACKOFF_SPIN(%o2, %o3, 1b)
6187+ .size atomic_sub_unchecked, .-atomic_sub_unchecked
6188+
6189 .globl atomic_add_ret
6190 .type atomic_add_ret,#function
6191 atomic_add_ret: /* %o0 = increment, %o1 = atomic_ptr */
6192 BACKOFF_SETUP(%o2)
6193 1: lduw [%o1], %g1
6194- add %g1, %o0, %g7
6195+ addcc %g1, %o0, %g7
6196+
6197+#ifdef CONFIG_PAX_REFCOUNT
6198+ tvs %icc, 6
6199+#endif
6200+
6201 cas [%o1], %g1, %g7
6202 cmp %g1, %g7
6203 bne,pn %icc, BACKOFF_LABEL(2f, 1b)
6204@@ -58,12 +103,33 @@ atomic_add_ret: /* %o0 = increment, %o1
6205 2: BACKOFF_SPIN(%o2, %o3, 1b)
6206 .size atomic_add_ret, .-atomic_add_ret
6207
6208+ .globl atomic_add_ret_unchecked
6209+ .type atomic_add_ret_unchecked,#function
6210+atomic_add_ret_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
6211+ BACKOFF_SETUP(%o2)
6212+1: lduw [%o1], %g1
6213+ addcc %g1, %o0, %g7
6214+ cas [%o1], %g1, %g7
6215+ cmp %g1, %g7
6216+ bne,pn %icc, 2f
6217+ add %g7, %o0, %g7
6218+ sra %g7, 0, %o0
6219+ retl
6220+ nop
6221+2: BACKOFF_SPIN(%o2, %o3, 1b)
6222+ .size atomic_add_ret_unchecked, .-atomic_add_ret_unchecked
6223+
6224 .globl atomic_sub_ret
6225 .type atomic_sub_ret,#function
6226 atomic_sub_ret: /* %o0 = decrement, %o1 = atomic_ptr */
6227 BACKOFF_SETUP(%o2)
6228 1: lduw [%o1], %g1
6229- sub %g1, %o0, %g7
6230+ subcc %g1, %o0, %g7
6231+
6232+#ifdef CONFIG_PAX_REFCOUNT
6233+ tvs %icc, 6
6234+#endif
6235+
6236 cas [%o1], %g1, %g7
6237 cmp %g1, %g7
6238 bne,pn %icc, BACKOFF_LABEL(2f, 1b)
6239@@ -78,7 +144,12 @@ atomic_sub_ret: /* %o0 = decrement, %o1
6240 atomic64_add: /* %o0 = increment, %o1 = atomic_ptr */
6241 BACKOFF_SETUP(%o2)
6242 1: ldx [%o1], %g1
6243- add %g1, %o0, %g7
6244+ addcc %g1, %o0, %g7
6245+
6246+#ifdef CONFIG_PAX_REFCOUNT
6247+ tvs %xcc, 6
6248+#endif
6249+
6250 casx [%o1], %g1, %g7
6251 cmp %g1, %g7
6252 bne,pn %xcc, BACKOFF_LABEL(2f, 1b)
6253@@ -88,12 +159,32 @@ atomic64_add: /* %o0 = increment, %o1 =
6254 2: BACKOFF_SPIN(%o2, %o3, 1b)
6255 .size atomic64_add, .-atomic64_add
6256
6257+ .globl atomic64_add_unchecked
6258+ .type atomic64_add_unchecked,#function
6259+atomic64_add_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
6260+ BACKOFF_SETUP(%o2)
6261+1: ldx [%o1], %g1
6262+ addcc %g1, %o0, %g7
6263+ casx [%o1], %g1, %g7
6264+ cmp %g1, %g7
6265+ bne,pn %xcc, 2f
6266+ nop
6267+ retl
6268+ nop
6269+2: BACKOFF_SPIN(%o2, %o3, 1b)
6270+ .size atomic64_add_unchecked, .-atomic64_add_unchecked
6271+
6272 .globl atomic64_sub
6273 .type atomic64_sub,#function
6274 atomic64_sub: /* %o0 = decrement, %o1 = atomic_ptr */
6275 BACKOFF_SETUP(%o2)
6276 1: ldx [%o1], %g1
6277- sub %g1, %o0, %g7
6278+ subcc %g1, %o0, %g7
6279+
6280+#ifdef CONFIG_PAX_REFCOUNT
6281+ tvs %xcc, 6
6282+#endif
6283+
6284 casx [%o1], %g1, %g7
6285 cmp %g1, %g7
6286 bne,pn %xcc, BACKOFF_LABEL(2f, 1b)
6287@@ -103,12 +194,32 @@ atomic64_sub: /* %o0 = decrement, %o1 =
6288 2: BACKOFF_SPIN(%o2, %o3, 1b)
6289 .size atomic64_sub, .-atomic64_sub
6290
6291+ .globl atomic64_sub_unchecked
6292+ .type atomic64_sub_unchecked,#function
6293+atomic64_sub_unchecked: /* %o0 = decrement, %o1 = atomic_ptr */
6294+ BACKOFF_SETUP(%o2)
6295+1: ldx [%o1], %g1
6296+ subcc %g1, %o0, %g7
6297+ casx [%o1], %g1, %g7
6298+ cmp %g1, %g7
6299+ bne,pn %xcc, 2f
6300+ nop
6301+ retl
6302+ nop
6303+2: BACKOFF_SPIN(%o2, %o3, 1b)
6304+ .size atomic64_sub_unchecked, .-atomic64_sub_unchecked
6305+
6306 .globl atomic64_add_ret
6307 .type atomic64_add_ret,#function
6308 atomic64_add_ret: /* %o0 = increment, %o1 = atomic_ptr */
6309 BACKOFF_SETUP(%o2)
6310 1: ldx [%o1], %g1
6311- add %g1, %o0, %g7
6312+ addcc %g1, %o0, %g7
6313+
6314+#ifdef CONFIG_PAX_REFCOUNT
6315+ tvs %xcc, 6
6316+#endif
6317+
6318 casx [%o1], %g1, %g7
6319 cmp %g1, %g7
6320 bne,pn %xcc, BACKOFF_LABEL(2f, 1b)
6321@@ -118,12 +229,33 @@ atomic64_add_ret: /* %o0 = increment, %o
6322 2: BACKOFF_SPIN(%o2, %o3, 1b)
6323 .size atomic64_add_ret, .-atomic64_add_ret
6324
6325+ .globl atomic64_add_ret_unchecked
6326+ .type atomic64_add_ret_unchecked,#function
6327+atomic64_add_ret_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
6328+ BACKOFF_SETUP(%o2)
6329+1: ldx [%o1], %g1
6330+ addcc %g1, %o0, %g7
6331+ casx [%o1], %g1, %g7
6332+ cmp %g1, %g7
6333+ bne,pn %xcc, 2f
6334+ add %g7, %o0, %g7
6335+ mov %g7, %o0
6336+ retl
6337+ nop
6338+2: BACKOFF_SPIN(%o2, %o3, 1b)
6339+ .size atomic64_add_ret_unchecked, .-atomic64_add_ret_unchecked
6340+
6341 .globl atomic64_sub_ret
6342 .type atomic64_sub_ret,#function
6343 atomic64_sub_ret: /* %o0 = decrement, %o1 = atomic_ptr */
6344 BACKOFF_SETUP(%o2)
6345 1: ldx [%o1], %g1
6346- sub %g1, %o0, %g7
6347+ subcc %g1, %o0, %g7
6348+
6349+#ifdef CONFIG_PAX_REFCOUNT
6350+ tvs %xcc, 6
6351+#endif
6352+
6353 casx [%o1], %g1, %g7
6354 cmp %g1, %g7
6355 bne,pn %xcc, BACKOFF_LABEL(2f, 1b)
6356diff -urNp linux-2.6.39/arch/sparc/lib/ksyms.c linux-2.6.39/arch/sparc/lib/ksyms.c
6357--- linux-2.6.39/arch/sparc/lib/ksyms.c 2011-05-19 00:06:34.000000000 -0400
6358+++ linux-2.6.39/arch/sparc/lib/ksyms.c 2011-05-22 19:36:30.000000000 -0400
6359@@ -142,12 +142,17 @@ EXPORT_SYMBOL(__downgrade_write);
6360
6361 /* Atomic counter implementation. */
6362 EXPORT_SYMBOL(atomic_add);
6363+EXPORT_SYMBOL(atomic_add_unchecked);
6364 EXPORT_SYMBOL(atomic_add_ret);
6365 EXPORT_SYMBOL(atomic_sub);
6366+EXPORT_SYMBOL(atomic_sub_unchecked);
6367 EXPORT_SYMBOL(atomic_sub_ret);
6368 EXPORT_SYMBOL(atomic64_add);
6369+EXPORT_SYMBOL(atomic64_add_unchecked);
6370 EXPORT_SYMBOL(atomic64_add_ret);
6371+EXPORT_SYMBOL(atomic64_add_ret_unchecked);
6372 EXPORT_SYMBOL(atomic64_sub);
6373+EXPORT_SYMBOL(atomic64_sub_unchecked);
6374 EXPORT_SYMBOL(atomic64_sub_ret);
6375
6376 /* Atomic bit operations. */
6377diff -urNp linux-2.6.39/arch/sparc/lib/Makefile linux-2.6.39/arch/sparc/lib/Makefile
6378--- linux-2.6.39/arch/sparc/lib/Makefile 2011-05-19 00:06:34.000000000 -0400
6379+++ linux-2.6.39/arch/sparc/lib/Makefile 2011-05-22 19:36:30.000000000 -0400
6380@@ -2,7 +2,7 @@
6381 #
6382
6383 asflags-y := -ansi -DST_DIV0=0x02
6384-ccflags-y := -Werror
6385+#ccflags-y := -Werror
6386
6387 lib-$(CONFIG_SPARC32) += mul.o rem.o sdiv.o udiv.o umul.o urem.o ashrdi3.o
6388 lib-$(CONFIG_SPARC32) += memcpy.o memset.o
6389diff -urNp linux-2.6.39/arch/sparc/Makefile linux-2.6.39/arch/sparc/Makefile
6390--- linux-2.6.39/arch/sparc/Makefile 2011-05-19 00:06:34.000000000 -0400
6391+++ linux-2.6.39/arch/sparc/Makefile 2011-05-22 19:41:32.000000000 -0400
6392@@ -75,7 +75,7 @@ drivers-$(CONFIG_OPROFILE) += arch/sparc
6393 # Export what is needed by arch/sparc/boot/Makefile
6394 export VMLINUX_INIT VMLINUX_MAIN
6395 VMLINUX_INIT := $(head-y) $(init-y)
6396-VMLINUX_MAIN := $(core-y) kernel/ mm/ fs/ ipc/ security/ crypto/ block/
6397+VMLINUX_MAIN := $(core-y) kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
6398 VMLINUX_MAIN += $(patsubst %/, %/lib.a, $(libs-y)) $(libs-y)
6399 VMLINUX_MAIN += $(drivers-y) $(net-y)
6400
6401diff -urNp linux-2.6.39/arch/sparc/mm/fault_32.c linux-2.6.39/arch/sparc/mm/fault_32.c
6402--- linux-2.6.39/arch/sparc/mm/fault_32.c 2011-05-19 00:06:34.000000000 -0400
6403+++ linux-2.6.39/arch/sparc/mm/fault_32.c 2011-05-22 19:36:30.000000000 -0400
6404@@ -22,6 +22,9 @@
6405 #include <linux/interrupt.h>
6406 #include <linux/module.h>
6407 #include <linux/kdebug.h>
6408+#include <linux/slab.h>
6409+#include <linux/pagemap.h>
6410+#include <linux/compiler.h>
6411
6412 #include <asm/system.h>
6413 #include <asm/page.h>
6414@@ -209,6 +212,268 @@ static unsigned long compute_si_addr(str
6415 return safe_compute_effective_address(regs, insn);
6416 }
6417
6418+#ifdef CONFIG_PAX_PAGEEXEC
6419+#ifdef CONFIG_PAX_DLRESOLVE
6420+static void pax_emuplt_close(struct vm_area_struct *vma)
6421+{
6422+ vma->vm_mm->call_dl_resolve = 0UL;
6423+}
6424+
6425+static int pax_emuplt_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
6426+{
6427+ unsigned int *kaddr;
6428+
6429+ vmf->page = alloc_page(GFP_HIGHUSER);
6430+ if (!vmf->page)
6431+ return VM_FAULT_OOM;
6432+
6433+ kaddr = kmap(vmf->page);
6434+ memset(kaddr, 0, PAGE_SIZE);
6435+ kaddr[0] = 0x9DE3BFA8U; /* save */
6436+ flush_dcache_page(vmf->page);
6437+ kunmap(vmf->page);
6438+ return VM_FAULT_MAJOR;
6439+}
6440+
6441+static const struct vm_operations_struct pax_vm_ops = {
6442+ .close = pax_emuplt_close,
6443+ .fault = pax_emuplt_fault
6444+};
6445+
6446+static int pax_insert_vma(struct vm_area_struct *vma, unsigned long addr)
6447+{
6448+ int ret;
6449+
6450+ INIT_LIST_HEAD(&vma->anon_vma_chain);
6451+ vma->vm_mm = current->mm;
6452+ vma->vm_start = addr;
6453+ vma->vm_end = addr + PAGE_SIZE;
6454+ vma->vm_flags = VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYEXEC;
6455+ vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
6456+ vma->vm_ops = &pax_vm_ops;
6457+
6458+ ret = insert_vm_struct(current->mm, vma);
6459+ if (ret)
6460+ return ret;
6461+
6462+ ++current->mm->total_vm;
6463+ return 0;
6464+}
6465+#endif
6466+
6467+/*
6468+ * PaX: decide what to do with offenders (regs->pc = fault address)
6469+ *
6470+ * returns 1 when task should be killed
6471+ * 2 when patched PLT trampoline was detected
6472+ * 3 when unpatched PLT trampoline was detected
6473+ */
6474+static int pax_handle_fetch_fault(struct pt_regs *regs)
6475+{
6476+
6477+#ifdef CONFIG_PAX_EMUPLT
6478+ int err;
6479+
6480+ do { /* PaX: patched PLT emulation #1 */
6481+ unsigned int sethi1, sethi2, jmpl;
6482+
6483+ err = get_user(sethi1, (unsigned int *)regs->pc);
6484+ err |= get_user(sethi2, (unsigned int *)(regs->pc+4));
6485+ err |= get_user(jmpl, (unsigned int *)(regs->pc+8));
6486+
6487+ if (err)
6488+ break;
6489+
6490+ if ((sethi1 & 0xFFC00000U) == 0x03000000U &&
6491+ (sethi2 & 0xFFC00000U) == 0x03000000U &&
6492+ (jmpl & 0xFFFFE000U) == 0x81C06000U)
6493+ {
6494+ unsigned int addr;
6495+
6496+ regs->u_regs[UREG_G1] = (sethi2 & 0x003FFFFFU) << 10;
6497+ addr = regs->u_regs[UREG_G1];
6498+ addr += (((jmpl | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
6499+ regs->pc = addr;
6500+ regs->npc = addr+4;
6501+ return 2;
6502+ }
6503+ } while (0);
6504+
6505+ { /* PaX: patched PLT emulation #2 */
6506+ unsigned int ba;
6507+
6508+ err = get_user(ba, (unsigned int *)regs->pc);
6509+
6510+ if (!err && (ba & 0xFFC00000U) == 0x30800000U) {
6511+ unsigned int addr;
6512+
6513+ addr = regs->pc + ((((ba | 0xFFC00000U) ^ 0x00200000U) + 0x00200000U) << 2);
6514+ regs->pc = addr;
6515+ regs->npc = addr+4;
6516+ return 2;
6517+ }
6518+ }
6519+
6520+ do { /* PaX: patched PLT emulation #3 */
6521+ unsigned int sethi, jmpl, nop;
6522+
6523+ err = get_user(sethi, (unsigned int *)regs->pc);
6524+ err |= get_user(jmpl, (unsigned int *)(regs->pc+4));
6525+ err |= get_user(nop, (unsigned int *)(regs->pc+8));
6526+
6527+ if (err)
6528+ break;
6529+
6530+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
6531+ (jmpl & 0xFFFFE000U) == 0x81C06000U &&
6532+ nop == 0x01000000U)
6533+ {
6534+ unsigned int addr;
6535+
6536+ addr = (sethi & 0x003FFFFFU) << 10;
6537+ regs->u_regs[UREG_G1] = addr;
6538+ addr += (((jmpl | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
6539+ regs->pc = addr;
6540+ regs->npc = addr+4;
6541+ return 2;
6542+ }
6543+ } while (0);
6544+
6545+ do { /* PaX: unpatched PLT emulation step 1 */
6546+ unsigned int sethi, ba, nop;
6547+
6548+ err = get_user(sethi, (unsigned int *)regs->pc);
6549+ err |= get_user(ba, (unsigned int *)(regs->pc+4));
6550+ err |= get_user(nop, (unsigned int *)(regs->pc+8));
6551+
6552+ if (err)
6553+ break;
6554+
6555+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
6556+ ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30680000U) &&
6557+ nop == 0x01000000U)
6558+ {
6559+ unsigned int addr, save, call;
6560+
6561+ if ((ba & 0xFFC00000U) == 0x30800000U)
6562+ addr = regs->pc + 4 + ((((ba | 0xFFC00000U) ^ 0x00200000U) + 0x00200000U) << 2);
6563+ else
6564+ addr = regs->pc + 4 + ((((ba | 0xFFF80000U) ^ 0x00040000U) + 0x00040000U) << 2);
6565+
6566+ err = get_user(save, (unsigned int *)addr);
6567+ err |= get_user(call, (unsigned int *)(addr+4));
6568+ err |= get_user(nop, (unsigned int *)(addr+8));
6569+ if (err)
6570+ break;
6571+
6572+#ifdef CONFIG_PAX_DLRESOLVE
6573+ if (save == 0x9DE3BFA8U &&
6574+ (call & 0xC0000000U) == 0x40000000U &&
6575+ nop == 0x01000000U)
6576+ {
6577+ struct vm_area_struct *vma;
6578+ unsigned long call_dl_resolve;
6579+
6580+ down_read(&current->mm->mmap_sem);
6581+ call_dl_resolve = current->mm->call_dl_resolve;
6582+ up_read(&current->mm->mmap_sem);
6583+ if (likely(call_dl_resolve))
6584+ goto emulate;
6585+
6586+ vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
6587+
6588+ down_write(&current->mm->mmap_sem);
6589+ if (current->mm->call_dl_resolve) {
6590+ call_dl_resolve = current->mm->call_dl_resolve;
6591+ up_write(&current->mm->mmap_sem);
6592+ if (vma)
6593+ kmem_cache_free(vm_area_cachep, vma);
6594+ goto emulate;
6595+ }
6596+
6597+ call_dl_resolve = get_unmapped_area(NULL, 0UL, PAGE_SIZE, 0UL, MAP_PRIVATE);
6598+ if (!vma || (call_dl_resolve & ~PAGE_MASK)) {
6599+ up_write(&current->mm->mmap_sem);
6600+ if (vma)
6601+ kmem_cache_free(vm_area_cachep, vma);
6602+ return 1;
6603+ }
6604+
6605+ if (pax_insert_vma(vma, call_dl_resolve)) {
6606+ up_write(&current->mm->mmap_sem);
6607+ kmem_cache_free(vm_area_cachep, vma);
6608+ return 1;
6609+ }
6610+
6611+ current->mm->call_dl_resolve = call_dl_resolve;
6612+ up_write(&current->mm->mmap_sem);
6613+
6614+emulate:
6615+ regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
6616+ regs->pc = call_dl_resolve;
6617+ regs->npc = addr+4;
6618+ return 3;
6619+ }
6620+#endif
6621+
6622+ /* PaX: glibc 2.4+ generates sethi/jmpl instead of save/call */
6623+ if ((save & 0xFFC00000U) == 0x05000000U &&
6624+ (call & 0xFFFFE000U) == 0x85C0A000U &&
6625+ nop == 0x01000000U)
6626+ {
6627+ regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
6628+ regs->u_regs[UREG_G2] = addr + 4;
6629+ addr = (save & 0x003FFFFFU) << 10;
6630+ addr += (((call | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
6631+ regs->pc = addr;
6632+ regs->npc = addr+4;
6633+ return 3;
6634+ }
6635+ }
6636+ } while (0);
6637+
6638+ do { /* PaX: unpatched PLT emulation step 2 */
6639+ unsigned int save, call, nop;
6640+
6641+ err = get_user(save, (unsigned int *)(regs->pc-4));
6642+ err |= get_user(call, (unsigned int *)regs->pc);
6643+ err |= get_user(nop, (unsigned int *)(regs->pc+4));
6644+ if (err)
6645+ break;
6646+
6647+ if (save == 0x9DE3BFA8U &&
6648+ (call & 0xC0000000U) == 0x40000000U &&
6649+ nop == 0x01000000U)
6650+ {
6651+ unsigned int dl_resolve = regs->pc + ((((call | 0xC0000000U) ^ 0x20000000U) + 0x20000000U) << 2);
6652+
6653+ regs->u_regs[UREG_RETPC] = regs->pc;
6654+ regs->pc = dl_resolve;
6655+ regs->npc = dl_resolve+4;
6656+ return 3;
6657+ }
6658+ } while (0);
6659+#endif
6660+
6661+ return 1;
6662+}
6663+
6664+void pax_report_insns(void *pc, void *sp)
6665+{
6666+ unsigned long i;
6667+
6668+ printk(KERN_ERR "PAX: bytes at PC: ");
6669+ for (i = 0; i < 8; i++) {
6670+ unsigned int c;
6671+ if (get_user(c, (unsigned int *)pc+i))
6672+ printk(KERN_CONT "???????? ");
6673+ else
6674+ printk(KERN_CONT "%08x ", c);
6675+ }
6676+ printk("\n");
6677+}
6678+#endif
6679+
6680 static noinline void do_fault_siginfo(int code, int sig, struct pt_regs *regs,
6681 int text_fault)
6682 {
6683@@ -281,6 +546,24 @@ good_area:
6684 if(!(vma->vm_flags & VM_WRITE))
6685 goto bad_area;
6686 } else {
6687+
6688+#ifdef CONFIG_PAX_PAGEEXEC
6689+ if ((mm->pax_flags & MF_PAX_PAGEEXEC) && text_fault && !(vma->vm_flags & VM_EXEC)) {
6690+ up_read(&mm->mmap_sem);
6691+ switch (pax_handle_fetch_fault(regs)) {
6692+
6693+#ifdef CONFIG_PAX_EMUPLT
6694+ case 2:
6695+ case 3:
6696+ return;
6697+#endif
6698+
6699+ }
6700+ pax_report_fault(regs, (void *)regs->pc, (void *)regs->u_regs[UREG_FP]);
6701+ do_group_exit(SIGKILL);
6702+ }
6703+#endif
6704+
6705 /* Allow reads even for write-only mappings */
6706 if(!(vma->vm_flags & (VM_READ | VM_EXEC)))
6707 goto bad_area;
6708diff -urNp linux-2.6.39/arch/sparc/mm/fault_64.c linux-2.6.39/arch/sparc/mm/fault_64.c
6709--- linux-2.6.39/arch/sparc/mm/fault_64.c 2011-05-19 00:06:34.000000000 -0400
6710+++ linux-2.6.39/arch/sparc/mm/fault_64.c 2011-05-22 19:41:32.000000000 -0400
6711@@ -21,6 +21,9 @@
6712 #include <linux/kprobes.h>
6713 #include <linux/kdebug.h>
6714 #include <linux/percpu.h>
6715+#include <linux/slab.h>
6716+#include <linux/pagemap.h>
6717+#include <linux/compiler.h>
6718
6719 #include <asm/page.h>
6720 #include <asm/pgtable.h>
6721@@ -74,7 +77,7 @@ static void __kprobes bad_kernel_pc(stru
6722 printk(KERN_CRIT "OOPS: Bogus kernel PC [%016lx] in fault handler\n",
6723 regs->tpc);
6724 printk(KERN_CRIT "OOPS: RPC [%016lx]\n", regs->u_regs[15]);
6725- printk("OOPS: RPC <%pS>\n", (void *) regs->u_regs[15]);
6726+ printk("OOPS: RPC <%pA>\n", (void *) regs->u_regs[15]);
6727 printk(KERN_CRIT "OOPS: Fault was to vaddr[%lx]\n", vaddr);
6728 dump_stack();
6729 unhandled_fault(regs->tpc, current, regs);
6730@@ -272,6 +275,457 @@ static void noinline __kprobes bogus_32b
6731 show_regs(regs);
6732 }
6733
6734+#ifdef CONFIG_PAX_PAGEEXEC
6735+#ifdef CONFIG_PAX_DLRESOLVE
6736+static void pax_emuplt_close(struct vm_area_struct *vma)
6737+{
6738+ vma->vm_mm->call_dl_resolve = 0UL;
6739+}
6740+
6741+static int pax_emuplt_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
6742+{
6743+ unsigned int *kaddr;
6744+
6745+ vmf->page = alloc_page(GFP_HIGHUSER);
6746+ if (!vmf->page)
6747+ return VM_FAULT_OOM;
6748+
6749+ kaddr = kmap(vmf->page);
6750+ memset(kaddr, 0, PAGE_SIZE);
6751+ kaddr[0] = 0x9DE3BFA8U; /* save */
6752+ flush_dcache_page(vmf->page);
6753+ kunmap(vmf->page);
6754+ return VM_FAULT_MAJOR;
6755+}
6756+
6757+static const struct vm_operations_struct pax_vm_ops = {
6758+ .close = pax_emuplt_close,
6759+ .fault = pax_emuplt_fault
6760+};
6761+
6762+static int pax_insert_vma(struct vm_area_struct *vma, unsigned long addr)
6763+{
6764+ int ret;
6765+
6766+ INIT_LIST_HEAD(&vma->anon_vma_chain);
6767+ vma->vm_mm = current->mm;
6768+ vma->vm_start = addr;
6769+ vma->vm_end = addr + PAGE_SIZE;
6770+ vma->vm_flags = VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYEXEC;
6771+ vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
6772+ vma->vm_ops = &pax_vm_ops;
6773+
6774+ ret = insert_vm_struct(current->mm, vma);
6775+ if (ret)
6776+ return ret;
6777+
6778+ ++current->mm->total_vm;
6779+ return 0;
6780+}
6781+#endif
6782+
6783+/*
6784+ * PaX: decide what to do with offenders (regs->tpc = fault address)
6785+ *
6786+ * returns 1 when task should be killed
6787+ * 2 when patched PLT trampoline was detected
6788+ * 3 when unpatched PLT trampoline was detected
6789+ */
6790+static int pax_handle_fetch_fault(struct pt_regs *regs)
6791+{
6792+
6793+#ifdef CONFIG_PAX_EMUPLT
6794+ int err;
6795+
6796+ do { /* PaX: patched PLT emulation #1 */
6797+ unsigned int sethi1, sethi2, jmpl;
6798+
6799+ err = get_user(sethi1, (unsigned int *)regs->tpc);
6800+ err |= get_user(sethi2, (unsigned int *)(regs->tpc+4));
6801+ err |= get_user(jmpl, (unsigned int *)(regs->tpc+8));
6802+
6803+ if (err)
6804+ break;
6805+
6806+ if ((sethi1 & 0xFFC00000U) == 0x03000000U &&
6807+ (sethi2 & 0xFFC00000U) == 0x03000000U &&
6808+ (jmpl & 0xFFFFE000U) == 0x81C06000U)
6809+ {
6810+ unsigned long addr;
6811+
6812+ regs->u_regs[UREG_G1] = (sethi2 & 0x003FFFFFU) << 10;
6813+ addr = regs->u_regs[UREG_G1];
6814+ addr += (((jmpl | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
6815+
6816+ if (test_thread_flag(TIF_32BIT))
6817+ addr &= 0xFFFFFFFFUL;
6818+
6819+ regs->tpc = addr;
6820+ regs->tnpc = addr+4;
6821+ return 2;
6822+ }
6823+ } while (0);
6824+
6825+ { /* PaX: patched PLT emulation #2 */
6826+ unsigned int ba;
6827+
6828+ err = get_user(ba, (unsigned int *)regs->tpc);
6829+
6830+ if (!err && (ba & 0xFFC00000U) == 0x30800000U) {
6831+ unsigned long addr;
6832+
6833+ addr = regs->tpc + ((((ba | 0xFFFFFFFFFFC00000UL) ^ 0x00200000UL) + 0x00200000UL) << 2);
6834+
6835+ if (test_thread_flag(TIF_32BIT))
6836+ addr &= 0xFFFFFFFFUL;
6837+
6838+ regs->tpc = addr;
6839+ regs->tnpc = addr+4;
6840+ return 2;
6841+ }
6842+ }
6843+
6844+ do { /* PaX: patched PLT emulation #3 */
6845+ unsigned int sethi, jmpl, nop;
6846+
6847+ err = get_user(sethi, (unsigned int *)regs->tpc);
6848+ err |= get_user(jmpl, (unsigned int *)(regs->tpc+4));
6849+ err |= get_user(nop, (unsigned int *)(regs->tpc+8));
6850+
6851+ if (err)
6852+ break;
6853+
6854+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
6855+ (jmpl & 0xFFFFE000U) == 0x81C06000U &&
6856+ nop == 0x01000000U)
6857+ {
6858+ unsigned long addr;
6859+
6860+ addr = (sethi & 0x003FFFFFU) << 10;
6861+ regs->u_regs[UREG_G1] = addr;
6862+ addr += (((jmpl | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
6863+
6864+ if (test_thread_flag(TIF_32BIT))
6865+ addr &= 0xFFFFFFFFUL;
6866+
6867+ regs->tpc = addr;
6868+ regs->tnpc = addr+4;
6869+ return 2;
6870+ }
6871+ } while (0);
6872+
6873+ do { /* PaX: patched PLT emulation #4 */
6874+ unsigned int sethi, mov1, call, mov2;
6875+
6876+ err = get_user(sethi, (unsigned int *)regs->tpc);
6877+ err |= get_user(mov1, (unsigned int *)(regs->tpc+4));
6878+ err |= get_user(call, (unsigned int *)(regs->tpc+8));
6879+ err |= get_user(mov2, (unsigned int *)(regs->tpc+12));
6880+
6881+ if (err)
6882+ break;
6883+
6884+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
6885+ mov1 == 0x8210000FU &&
6886+ (call & 0xC0000000U) == 0x40000000U &&
6887+ mov2 == 0x9E100001U)
6888+ {
6889+ unsigned long addr;
6890+
6891+ regs->u_regs[UREG_G1] = regs->u_regs[UREG_RETPC];
6892+ addr = regs->tpc + 4 + ((((call | 0xFFFFFFFFC0000000UL) ^ 0x20000000UL) + 0x20000000UL) << 2);
6893+
6894+ if (test_thread_flag(TIF_32BIT))
6895+ addr &= 0xFFFFFFFFUL;
6896+
6897+ regs->tpc = addr;
6898+ regs->tnpc = addr+4;
6899+ return 2;
6900+ }
6901+ } while (0);
6902+
6903+ do { /* PaX: patched PLT emulation #5 */
6904+ unsigned int sethi, sethi1, sethi2, or1, or2, sllx, jmpl, nop;
6905+
6906+ err = get_user(sethi, (unsigned int *)regs->tpc);
6907+ err |= get_user(sethi1, (unsigned int *)(regs->tpc+4));
6908+ err |= get_user(sethi2, (unsigned int *)(regs->tpc+8));
6909+ err |= get_user(or1, (unsigned int *)(regs->tpc+12));
6910+ err |= get_user(or2, (unsigned int *)(regs->tpc+16));
6911+ err |= get_user(sllx, (unsigned int *)(regs->tpc+20));
6912+ err |= get_user(jmpl, (unsigned int *)(regs->tpc+24));
6913+ err |= get_user(nop, (unsigned int *)(regs->tpc+28));
6914+
6915+ if (err)
6916+ break;
6917+
6918+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
6919+ (sethi1 & 0xFFC00000U) == 0x03000000U &&
6920+ (sethi2 & 0xFFC00000U) == 0x0B000000U &&
6921+ (or1 & 0xFFFFE000U) == 0x82106000U &&
6922+ (or2 & 0xFFFFE000U) == 0x8A116000U &&
6923+ sllx == 0x83287020U &&
6924+ jmpl == 0x81C04005U &&
6925+ nop == 0x01000000U)
6926+ {
6927+ unsigned long addr;
6928+
6929+ regs->u_regs[UREG_G1] = ((sethi1 & 0x003FFFFFU) << 10) | (or1 & 0x000003FFU);
6930+ regs->u_regs[UREG_G1] <<= 32;
6931+ regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or2 & 0x000003FFU);
6932+ addr = regs->u_regs[UREG_G1] + regs->u_regs[UREG_G5];
6933+ regs->tpc = addr;
6934+ regs->tnpc = addr+4;
6935+ return 2;
6936+ }
6937+ } while (0);
6938+
6939+ do { /* PaX: patched PLT emulation #6 */
6940+ unsigned int sethi, sethi1, sethi2, sllx, or, jmpl, nop;
6941+
6942+ err = get_user(sethi, (unsigned int *)regs->tpc);
6943+ err |= get_user(sethi1, (unsigned int *)(regs->tpc+4));
6944+ err |= get_user(sethi2, (unsigned int *)(regs->tpc+8));
6945+ err |= get_user(sllx, (unsigned int *)(regs->tpc+12));
6946+ err |= get_user(or, (unsigned int *)(regs->tpc+16));
6947+ err |= get_user(jmpl, (unsigned int *)(regs->tpc+20));
6948+ err |= get_user(nop, (unsigned int *)(regs->tpc+24));
6949+
6950+ if (err)
6951+ break;
6952+
6953+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
6954+ (sethi1 & 0xFFC00000U) == 0x03000000U &&
6955+ (sethi2 & 0xFFC00000U) == 0x0B000000U &&
6956+ sllx == 0x83287020U &&
6957+ (or & 0xFFFFE000U) == 0x8A116000U &&
6958+ jmpl == 0x81C04005U &&
6959+ nop == 0x01000000U)
6960+ {
6961+ unsigned long addr;
6962+
6963+ regs->u_regs[UREG_G1] = (sethi1 & 0x003FFFFFU) << 10;
6964+ regs->u_regs[UREG_G1] <<= 32;
6965+ regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or & 0x3FFU);
6966+ addr = regs->u_regs[UREG_G1] + regs->u_regs[UREG_G5];
6967+ regs->tpc = addr;
6968+ regs->tnpc = addr+4;
6969+ return 2;
6970+ }
6971+ } while (0);
6972+
6973+ do { /* PaX: unpatched PLT emulation step 1 */
6974+ unsigned int sethi, ba, nop;
6975+
6976+ err = get_user(sethi, (unsigned int *)regs->tpc);
6977+ err |= get_user(ba, (unsigned int *)(regs->tpc+4));
6978+ err |= get_user(nop, (unsigned int *)(regs->tpc+8));
6979+
6980+ if (err)
6981+ break;
6982+
6983+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
6984+ ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30680000U) &&
6985+ nop == 0x01000000U)
6986+ {
6987+ unsigned long addr;
6988+ unsigned int save, call;
6989+ unsigned int sethi1, sethi2, or1, or2, sllx, add, jmpl;
6990+
6991+ if ((ba & 0xFFC00000U) == 0x30800000U)
6992+ addr = regs->tpc + 4 + ((((ba | 0xFFFFFFFFFFC00000UL) ^ 0x00200000UL) + 0x00200000UL) << 2);
6993+ else
6994+ addr = regs->tpc + 4 + ((((ba | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2);
6995+
6996+ if (test_thread_flag(TIF_32BIT))
6997+ addr &= 0xFFFFFFFFUL;
6998+
6999+ err = get_user(save, (unsigned int *)addr);
7000+ err |= get_user(call, (unsigned int *)(addr+4));
7001+ err |= get_user(nop, (unsigned int *)(addr+8));
7002+ if (err)
7003+ break;
7004+
7005+#ifdef CONFIG_PAX_DLRESOLVE
7006+ if (save == 0x9DE3BFA8U &&
7007+ (call & 0xC0000000U) == 0x40000000U &&
7008+ nop == 0x01000000U)
7009+ {
7010+ struct vm_area_struct *vma;
7011+ unsigned long call_dl_resolve;
7012+
7013+ down_read(&current->mm->mmap_sem);
7014+ call_dl_resolve = current->mm->call_dl_resolve;
7015+ up_read(&current->mm->mmap_sem);
7016+ if (likely(call_dl_resolve))
7017+ goto emulate;
7018+
7019+ vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
7020+
7021+ down_write(&current->mm->mmap_sem);
7022+ if (current->mm->call_dl_resolve) {
7023+ call_dl_resolve = current->mm->call_dl_resolve;
7024+ up_write(&current->mm->mmap_sem);
7025+ if (vma)
7026+ kmem_cache_free(vm_area_cachep, vma);
7027+ goto emulate;
7028+ }
7029+
7030+ call_dl_resolve = get_unmapped_area(NULL, 0UL, PAGE_SIZE, 0UL, MAP_PRIVATE);
7031+ if (!vma || (call_dl_resolve & ~PAGE_MASK)) {
7032+ up_write(&current->mm->mmap_sem);
7033+ if (vma)
7034+ kmem_cache_free(vm_area_cachep, vma);
7035+ return 1;
7036+ }
7037+
7038+ if (pax_insert_vma(vma, call_dl_resolve)) {
7039+ up_write(&current->mm->mmap_sem);
7040+ kmem_cache_free(vm_area_cachep, vma);
7041+ return 1;
7042+ }
7043+
7044+ current->mm->call_dl_resolve = call_dl_resolve;
7045+ up_write(&current->mm->mmap_sem);
7046+
7047+emulate:
7048+ regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
7049+ regs->tpc = call_dl_resolve;
7050+ regs->tnpc = addr+4;
7051+ return 3;
7052+ }
7053+#endif
7054+
7055+ /* PaX: glibc 2.4+ generates sethi/jmpl instead of save/call */
7056+ if ((save & 0xFFC00000U) == 0x05000000U &&
7057+ (call & 0xFFFFE000U) == 0x85C0A000U &&
7058+ nop == 0x01000000U)
7059+ {
7060+ regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
7061+ regs->u_regs[UREG_G2] = addr + 4;
7062+ addr = (save & 0x003FFFFFU) << 10;
7063+ addr += (((call | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
7064+
7065+ if (test_thread_flag(TIF_32BIT))
7066+ addr &= 0xFFFFFFFFUL;
7067+
7068+ regs->tpc = addr;
7069+ regs->tnpc = addr+4;
7070+ return 3;
7071+ }
7072+
7073+ /* PaX: 64-bit PLT stub */
7074+ err = get_user(sethi1, (unsigned int *)addr);
7075+ err |= get_user(sethi2, (unsigned int *)(addr+4));
7076+ err |= get_user(or1, (unsigned int *)(addr+8));
7077+ err |= get_user(or2, (unsigned int *)(addr+12));
7078+ err |= get_user(sllx, (unsigned int *)(addr+16));
7079+ err |= get_user(add, (unsigned int *)(addr+20));
7080+ err |= get_user(jmpl, (unsigned int *)(addr+24));
7081+ err |= get_user(nop, (unsigned int *)(addr+28));
7082+ if (err)
7083+ break;
7084+
7085+ if ((sethi1 & 0xFFC00000U) == 0x09000000U &&
7086+ (sethi2 & 0xFFC00000U) == 0x0B000000U &&
7087+ (or1 & 0xFFFFE000U) == 0x88112000U &&
7088+ (or2 & 0xFFFFE000U) == 0x8A116000U &&
7089+ sllx == 0x89293020U &&
7090+ add == 0x8A010005U &&
7091+ jmpl == 0x89C14000U &&
7092+ nop == 0x01000000U)
7093+ {
7094+ regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
7095+ regs->u_regs[UREG_G4] = ((sethi1 & 0x003FFFFFU) << 10) | (or1 & 0x000003FFU);
7096+ regs->u_regs[UREG_G4] <<= 32;
7097+ regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or2 & 0x000003FFU);
7098+ regs->u_regs[UREG_G5] += regs->u_regs[UREG_G4];
7099+ regs->u_regs[UREG_G4] = addr + 24;
7100+ addr = regs->u_regs[UREG_G5];
7101+ regs->tpc = addr;
7102+ regs->tnpc = addr+4;
7103+ return 3;
7104+ }
7105+ }
7106+ } while (0);
7107+
7108+#ifdef CONFIG_PAX_DLRESOLVE
7109+ do { /* PaX: unpatched PLT emulation step 2 */
7110+ unsigned int save, call, nop;
7111+
7112+ err = get_user(save, (unsigned int *)(regs->tpc-4));
7113+ err |= get_user(call, (unsigned int *)regs->tpc);
7114+ err |= get_user(nop, (unsigned int *)(regs->tpc+4));
7115+ if (err)
7116+ break;
7117+
7118+ if (save == 0x9DE3BFA8U &&
7119+ (call & 0xC0000000U) == 0x40000000U &&
7120+ nop == 0x01000000U)
7121+ {
7122+ unsigned long dl_resolve = regs->tpc + ((((call | 0xFFFFFFFFC0000000UL) ^ 0x20000000UL) + 0x20000000UL) << 2);
7123+
7124+ if (test_thread_flag(TIF_32BIT))
7125+ dl_resolve &= 0xFFFFFFFFUL;
7126+
7127+ regs->u_regs[UREG_RETPC] = regs->tpc;
7128+ regs->tpc = dl_resolve;
7129+ regs->tnpc = dl_resolve+4;
7130+ return 3;
7131+ }
7132+ } while (0);
7133+#endif
7134+
7135+ do { /* PaX: patched PLT emulation #7, must be AFTER the unpatched PLT emulation */
7136+ unsigned int sethi, ba, nop;
7137+
7138+ err = get_user(sethi, (unsigned int *)regs->tpc);
7139+ err |= get_user(ba, (unsigned int *)(regs->tpc+4));
7140+ err |= get_user(nop, (unsigned int *)(regs->tpc+8));
7141+
7142+ if (err)
7143+ break;
7144+
7145+ if ((sethi & 0xFFC00000U) == 0x03000000U &&
7146+ (ba & 0xFFF00000U) == 0x30600000U &&
7147+ nop == 0x01000000U)
7148+ {
7149+ unsigned long addr;
7150+
7151+ addr = (sethi & 0x003FFFFFU) << 10;
7152+ regs->u_regs[UREG_G1] = addr;
7153+ addr = regs->tpc + ((((ba | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2);
7154+
7155+ if (test_thread_flag(TIF_32BIT))
7156+ addr &= 0xFFFFFFFFUL;
7157+
7158+ regs->tpc = addr;
7159+ regs->tnpc = addr+4;
7160+ return 2;
7161+ }
7162+ } while (0);
7163+
7164+#endif
7165+
7166+ return 1;
7167+}
7168+
7169+void pax_report_insns(void *pc, void *sp)
7170+{
7171+ unsigned long i;
7172+
7173+ printk(KERN_ERR "PAX: bytes at PC: ");
7174+ for (i = 0; i < 8; i++) {
7175+ unsigned int c;
7176+ if (get_user(c, (unsigned int *)pc+i))
7177+ printk(KERN_CONT "???????? ");
7178+ else
7179+ printk(KERN_CONT "%08x ", c);
7180+ }
7181+ printk("\n");
7182+}
7183+#endif
7184+
7185 asmlinkage void __kprobes do_sparc64_fault(struct pt_regs *regs)
7186 {
7187 struct mm_struct *mm = current->mm;
7188@@ -340,6 +794,29 @@ asmlinkage void __kprobes do_sparc64_fau
7189 if (!vma)
7190 goto bad_area;
7191
7192+#ifdef CONFIG_PAX_PAGEEXEC
7193+ /* PaX: detect ITLB misses on non-exec pages */
7194+ if ((mm->pax_flags & MF_PAX_PAGEEXEC) && vma->vm_start <= address &&
7195+ !(vma->vm_flags & VM_EXEC) && (fault_code & FAULT_CODE_ITLB))
7196+ {
7197+ if (address != regs->tpc)
7198+ goto good_area;
7199+
7200+ up_read(&mm->mmap_sem);
7201+ switch (pax_handle_fetch_fault(regs)) {
7202+
7203+#ifdef CONFIG_PAX_EMUPLT
7204+ case 2:
7205+ case 3:
7206+ return;
7207+#endif
7208+
7209+ }
7210+ pax_report_fault(regs, (void *)regs->tpc, (void *)(regs->u_regs[UREG_FP] + STACK_BIAS));
7211+ do_group_exit(SIGKILL);
7212+ }
7213+#endif
7214+
7215 /* Pure DTLB misses do not tell us whether the fault causing
7216 * load/store/atomic was a write or not, it only says that there
7217 * was no match. So in such a case we (carefully) read the
7218diff -urNp linux-2.6.39/arch/sparc/mm/hugetlbpage.c linux-2.6.39/arch/sparc/mm/hugetlbpage.c
7219--- linux-2.6.39/arch/sparc/mm/hugetlbpage.c 2011-05-19 00:06:34.000000000 -0400
7220+++ linux-2.6.39/arch/sparc/mm/hugetlbpage.c 2011-05-22 19:36:30.000000000 -0400
7221@@ -68,7 +68,7 @@ full_search:
7222 }
7223 return -ENOMEM;
7224 }
7225- if (likely(!vma || addr + len <= vma->vm_start)) {
7226+ if (likely(check_heap_stack_gap(vma, addr, len))) {
7227 /*
7228 * Remember the place where we stopped the search:
7229 */
7230@@ -107,7 +107,7 @@ hugetlb_get_unmapped_area_topdown(struct
7231 /* make sure it can fit in the remaining address space */
7232 if (likely(addr > len)) {
7233 vma = find_vma(mm, addr-len);
7234- if (!vma || addr <= vma->vm_start) {
7235+ if (check_heap_stack_gap(vma, addr - len, len)) {
7236 /* remember the address as a hint for next time */
7237 return (mm->free_area_cache = addr-len);
7238 }
7239@@ -116,16 +116,17 @@ hugetlb_get_unmapped_area_topdown(struct
7240 if (unlikely(mm->mmap_base < len))
7241 goto bottomup;
7242
7243- addr = (mm->mmap_base-len) & HPAGE_MASK;
7244+ addr = mm->mmap_base - len;
7245
7246 do {
7247+ addr &= HPAGE_MASK;
7248 /*
7249 * Lookup failure means no vma is above this address,
7250 * else if new region fits below vma->vm_start,
7251 * return with success:
7252 */
7253 vma = find_vma(mm, addr);
7254- if (likely(!vma || addr+len <= vma->vm_start)) {
7255+ if (likely(check_heap_stack_gap(vma, addr, len))) {
7256 /* remember the address as a hint for next time */
7257 return (mm->free_area_cache = addr);
7258 }
7259@@ -135,8 +136,8 @@ hugetlb_get_unmapped_area_topdown(struct
7260 mm->cached_hole_size = vma->vm_start - addr;
7261
7262 /* try just below the current vma->vm_start */
7263- addr = (vma->vm_start-len) & HPAGE_MASK;
7264- } while (likely(len < vma->vm_start));
7265+ addr = skip_heap_stack_gap(vma, len);
7266+ } while (!IS_ERR_VALUE(addr));
7267
7268 bottomup:
7269 /*
7270@@ -182,8 +183,7 @@ hugetlb_get_unmapped_area(struct file *f
7271 if (addr) {
7272 addr = ALIGN(addr, HPAGE_SIZE);
7273 vma = find_vma(mm, addr);
7274- if (task_size - len >= addr &&
7275- (!vma || addr + len <= vma->vm_start))
7276+ if (task_size - len >= addr && check_heap_stack_gap(vma, addr, len))
7277 return addr;
7278 }
7279 if (mm->get_unmapped_area == arch_get_unmapped_area)
7280diff -urNp linux-2.6.39/arch/sparc/mm/init_32.c linux-2.6.39/arch/sparc/mm/init_32.c
7281--- linux-2.6.39/arch/sparc/mm/init_32.c 2011-05-19 00:06:34.000000000 -0400
7282+++ linux-2.6.39/arch/sparc/mm/init_32.c 2011-05-22 19:36:30.000000000 -0400
7283@@ -318,6 +318,9 @@ extern void device_scan(void);
7284 pgprot_t PAGE_SHARED __read_mostly;
7285 EXPORT_SYMBOL(PAGE_SHARED);
7286
7287+pgprot_t PAGE_SHARED_NOEXEC __read_mostly;
7288+EXPORT_SYMBOL(PAGE_SHARED_NOEXEC);
7289+
7290 void __init paging_init(void)
7291 {
7292 switch(sparc_cpu_model) {
7293@@ -346,17 +349,17 @@ void __init paging_init(void)
7294
7295 /* Initialize the protection map with non-constant, MMU dependent values. */
7296 protection_map[0] = PAGE_NONE;
7297- protection_map[1] = PAGE_READONLY;
7298- protection_map[2] = PAGE_COPY;
7299- protection_map[3] = PAGE_COPY;
7300+ protection_map[1] = PAGE_READONLY_NOEXEC;
7301+ protection_map[2] = PAGE_COPY_NOEXEC;
7302+ protection_map[3] = PAGE_COPY_NOEXEC;
7303 protection_map[4] = PAGE_READONLY;
7304 protection_map[5] = PAGE_READONLY;
7305 protection_map[6] = PAGE_COPY;
7306 protection_map[7] = PAGE_COPY;
7307 protection_map[8] = PAGE_NONE;
7308- protection_map[9] = PAGE_READONLY;
7309- protection_map[10] = PAGE_SHARED;
7310- protection_map[11] = PAGE_SHARED;
7311+ protection_map[9] = PAGE_READONLY_NOEXEC;
7312+ protection_map[10] = PAGE_SHARED_NOEXEC;
7313+ protection_map[11] = PAGE_SHARED_NOEXEC;
7314 protection_map[12] = PAGE_READONLY;
7315 protection_map[13] = PAGE_READONLY;
7316 protection_map[14] = PAGE_SHARED;
7317diff -urNp linux-2.6.39/arch/sparc/mm/Makefile linux-2.6.39/arch/sparc/mm/Makefile
7318--- linux-2.6.39/arch/sparc/mm/Makefile 2011-05-19 00:06:34.000000000 -0400
7319+++ linux-2.6.39/arch/sparc/mm/Makefile 2011-05-22 19:36:30.000000000 -0400
7320@@ -2,7 +2,7 @@
7321 #
7322
7323 asflags-y := -ansi
7324-ccflags-y := -Werror
7325+#ccflags-y := -Werror
7326
7327 obj-$(CONFIG_SPARC64) += ultra.o tlb.o tsb.o
7328 obj-y += fault_$(BITS).o
7329diff -urNp linux-2.6.39/arch/sparc/mm/srmmu.c linux-2.6.39/arch/sparc/mm/srmmu.c
7330--- linux-2.6.39/arch/sparc/mm/srmmu.c 2011-05-19 00:06:34.000000000 -0400
7331+++ linux-2.6.39/arch/sparc/mm/srmmu.c 2011-05-22 19:36:30.000000000 -0400
7332@@ -2200,6 +2200,13 @@ void __init ld_mmu_srmmu(void)
7333 PAGE_SHARED = pgprot_val(SRMMU_PAGE_SHARED);
7334 BTFIXUPSET_INT(page_copy, pgprot_val(SRMMU_PAGE_COPY));
7335 BTFIXUPSET_INT(page_readonly, pgprot_val(SRMMU_PAGE_RDONLY));
7336+
7337+#ifdef CONFIG_PAX_PAGEEXEC
7338+ PAGE_SHARED_NOEXEC = pgprot_val(SRMMU_PAGE_SHARED_NOEXEC);
7339+ BTFIXUPSET_INT(page_copy_noexec, pgprot_val(SRMMU_PAGE_COPY_NOEXEC));
7340+ BTFIXUPSET_INT(page_readonly_noexec, pgprot_val(SRMMU_PAGE_RDONLY_NOEXEC));
7341+#endif
7342+
7343 BTFIXUPSET_INT(page_kernel, pgprot_val(SRMMU_PAGE_KERNEL));
7344 page_kernel = pgprot_val(SRMMU_PAGE_KERNEL);
7345
7346diff -urNp linux-2.6.39/arch/tile/kernel/pci.c linux-2.6.39/arch/tile/kernel/pci.c
7347--- linux-2.6.39/arch/tile/kernel/pci.c 2011-05-19 00:06:34.000000000 -0400
7348+++ linux-2.6.39/arch/tile/kernel/pci.c 2011-05-22 19:36:30.000000000 -0400
7349@@ -60,7 +60,7 @@ int __write_once tile_plx_gen1;
7350 static struct pci_controller controllers[TILE_NUM_PCIE];
7351 static int num_controllers;
7352
7353-static struct pci_ops tile_cfg_ops;
7354+static const struct pci_ops tile_cfg_ops;
7355
7356
7357 /*
7358@@ -564,7 +564,7 @@ static int __devinit tile_cfg_write(stru
7359 }
7360
7361
7362-static struct pci_ops tile_cfg_ops = {
7363+static const struct pci_ops tile_cfg_ops = {
7364 .read = tile_cfg_read,
7365 .write = tile_cfg_write,
7366 };
7367diff -urNp linux-2.6.39/arch/um/include/asm/kmap_types.h linux-2.6.39/arch/um/include/asm/kmap_types.h
7368--- linux-2.6.39/arch/um/include/asm/kmap_types.h 2011-05-19 00:06:34.000000000 -0400
7369+++ linux-2.6.39/arch/um/include/asm/kmap_types.h 2011-05-22 19:36:30.000000000 -0400
7370@@ -23,6 +23,7 @@ enum km_type {
7371 KM_IRQ1,
7372 KM_SOFTIRQ0,
7373 KM_SOFTIRQ1,
7374+ KM_CLEARPAGE,
7375 KM_TYPE_NR
7376 };
7377
7378diff -urNp linux-2.6.39/arch/um/include/asm/page.h linux-2.6.39/arch/um/include/asm/page.h
7379--- linux-2.6.39/arch/um/include/asm/page.h 2011-05-19 00:06:34.000000000 -0400
7380+++ linux-2.6.39/arch/um/include/asm/page.h 2011-05-22 19:36:30.000000000 -0400
7381@@ -14,6 +14,9 @@
7382 #define PAGE_SIZE (_AC(1, UL) << PAGE_SHIFT)
7383 #define PAGE_MASK (~(PAGE_SIZE-1))
7384
7385+#define ktla_ktva(addr) (addr)
7386+#define ktva_ktla(addr) (addr)
7387+
7388 #ifndef __ASSEMBLY__
7389
7390 struct page;
7391diff -urNp linux-2.6.39/arch/um/kernel/process.c linux-2.6.39/arch/um/kernel/process.c
7392--- linux-2.6.39/arch/um/kernel/process.c 2011-05-19 00:06:34.000000000 -0400
7393+++ linux-2.6.39/arch/um/kernel/process.c 2011-05-22 19:36:30.000000000 -0400
7394@@ -404,22 +404,6 @@ int singlestepping(void * t)
7395 return 2;
7396 }
7397
7398-/*
7399- * Only x86 and x86_64 have an arch_align_stack().
7400- * All other arches have "#define arch_align_stack(x) (x)"
7401- * in their asm/system.h
7402- * As this is included in UML from asm-um/system-generic.h,
7403- * we can use it to behave as the subarch does.
7404- */
7405-#ifndef arch_align_stack
7406-unsigned long arch_align_stack(unsigned long sp)
7407-{
7408- if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
7409- sp -= get_random_int() % 8192;
7410- return sp & ~0xf;
7411-}
7412-#endif
7413-
7414 unsigned long get_wchan(struct task_struct *p)
7415 {
7416 unsigned long stack_page, sp, ip;
7417diff -urNp linux-2.6.39/arch/um/sys-i386/syscalls.c linux-2.6.39/arch/um/sys-i386/syscalls.c
7418--- linux-2.6.39/arch/um/sys-i386/syscalls.c 2011-05-19 00:06:34.000000000 -0400
7419+++ linux-2.6.39/arch/um/sys-i386/syscalls.c 2011-05-22 19:36:30.000000000 -0400
7420@@ -11,6 +11,21 @@
7421 #include "asm/uaccess.h"
7422 #include "asm/unistd.h"
7423
7424+int i386_mmap_check(unsigned long addr, unsigned long len, unsigned long flags)
7425+{
7426+ unsigned long pax_task_size = TASK_SIZE;
7427+
7428+#ifdef CONFIG_PAX_SEGMEXEC
7429+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
7430+ pax_task_size = SEGMEXEC_TASK_SIZE;
7431+#endif
7432+
7433+ if (len > pax_task_size || addr > pax_task_size - len)
7434+ return -EINVAL;
7435+
7436+ return 0;
7437+}
7438+
7439 /*
7440 * The prototype on i386 is:
7441 *
7442diff -urNp linux-2.6.39/arch/unicore32/kernel/pci.c linux-2.6.39/arch/unicore32/kernel/pci.c
7443--- linux-2.6.39/arch/unicore32/kernel/pci.c 2011-05-19 00:06:34.000000000 -0400
7444+++ linux-2.6.39/arch/unicore32/kernel/pci.c 2011-05-22 19:36:30.000000000 -0400
7445@@ -66,7 +66,7 @@ puv3_write_config(struct pci_bus *bus, u
7446 return PCIBIOS_SUCCESSFUL;
7447 }
7448
7449-struct pci_ops pci_puv3_ops = {
7450+const struct pci_ops pci_puv3_ops = {
7451 .read = puv3_read_config,
7452 .write = puv3_write_config,
7453 };
7454diff -urNp linux-2.6.39/arch/x86/boot/bitops.h linux-2.6.39/arch/x86/boot/bitops.h
7455--- linux-2.6.39/arch/x86/boot/bitops.h 2011-05-19 00:06:34.000000000 -0400
7456+++ linux-2.6.39/arch/x86/boot/bitops.h 2011-05-22 19:36:30.000000000 -0400
7457@@ -26,7 +26,7 @@ static inline int variable_test_bit(int
7458 u8 v;
7459 const u32 *p = (const u32 *)addr;
7460
7461- asm("btl %2,%1; setc %0" : "=qm" (v) : "m" (*p), "Ir" (nr));
7462+ asm volatile("btl %2,%1; setc %0" : "=qm" (v) : "m" (*p), "Ir" (nr));
7463 return v;
7464 }
7465
7466@@ -37,7 +37,7 @@ static inline int variable_test_bit(int
7467
7468 static inline void set_bit(int nr, void *addr)
7469 {
7470- asm("btsl %1,%0" : "+m" (*(u32 *)addr) : "Ir" (nr));
7471+ asm volatile("btsl %1,%0" : "+m" (*(u32 *)addr) : "Ir" (nr));
7472 }
7473
7474 #endif /* BOOT_BITOPS_H */
7475diff -urNp linux-2.6.39/arch/x86/boot/boot.h linux-2.6.39/arch/x86/boot/boot.h
7476--- linux-2.6.39/arch/x86/boot/boot.h 2011-05-19 00:06:34.000000000 -0400
7477+++ linux-2.6.39/arch/x86/boot/boot.h 2011-05-22 19:36:30.000000000 -0400
7478@@ -85,7 +85,7 @@ static inline void io_delay(void)
7479 static inline u16 ds(void)
7480 {
7481 u16 seg;
7482- asm("movw %%ds,%0" : "=rm" (seg));
7483+ asm volatile("movw %%ds,%0" : "=rm" (seg));
7484 return seg;
7485 }
7486
7487@@ -181,7 +181,7 @@ static inline void wrgs32(u32 v, addr_t
7488 static inline int memcmp(const void *s1, const void *s2, size_t len)
7489 {
7490 u8 diff;
7491- asm("repe; cmpsb; setnz %0"
7492+ asm volatile("repe; cmpsb; setnz %0"
7493 : "=qm" (diff), "+D" (s1), "+S" (s2), "+c" (len));
7494 return diff;
7495 }
7496diff -urNp linux-2.6.39/arch/x86/boot/compressed/head_32.S linux-2.6.39/arch/x86/boot/compressed/head_32.S
7497--- linux-2.6.39/arch/x86/boot/compressed/head_32.S 2011-05-19 00:06:34.000000000 -0400
7498+++ linux-2.6.39/arch/x86/boot/compressed/head_32.S 2011-05-22 19:36:30.000000000 -0400
7499@@ -76,7 +76,7 @@ ENTRY(startup_32)
7500 notl %eax
7501 andl %eax, %ebx
7502 #else
7503- movl $LOAD_PHYSICAL_ADDR, %ebx
7504+ movl $____LOAD_PHYSICAL_ADDR, %ebx
7505 #endif
7506
7507 /* Target address to relocate to for decompression */
7508@@ -162,7 +162,7 @@ relocated:
7509 * and where it was actually loaded.
7510 */
7511 movl %ebp, %ebx
7512- subl $LOAD_PHYSICAL_ADDR, %ebx
7513+ subl $____LOAD_PHYSICAL_ADDR, %ebx
7514 jz 2f /* Nothing to be done if loaded at compiled addr. */
7515 /*
7516 * Process relocations.
7517@@ -170,8 +170,7 @@ relocated:
7518
7519 1: subl $4, %edi
7520 movl (%edi), %ecx
7521- testl %ecx, %ecx
7522- jz 2f
7523+ jecxz 2f
7524 addl %ebx, -__PAGE_OFFSET(%ebx, %ecx)
7525 jmp 1b
7526 2:
7527diff -urNp linux-2.6.39/arch/x86/boot/compressed/head_64.S linux-2.6.39/arch/x86/boot/compressed/head_64.S
7528--- linux-2.6.39/arch/x86/boot/compressed/head_64.S 2011-05-19 00:06:34.000000000 -0400
7529+++ linux-2.6.39/arch/x86/boot/compressed/head_64.S 2011-05-22 19:36:30.000000000 -0400
7530@@ -91,7 +91,7 @@ ENTRY(startup_32)
7531 notl %eax
7532 andl %eax, %ebx
7533 #else
7534- movl $LOAD_PHYSICAL_ADDR, %ebx
7535+ movl $____LOAD_PHYSICAL_ADDR, %ebx
7536 #endif
7537
7538 /* Target address to relocate to for decompression */
7539@@ -233,7 +233,7 @@ ENTRY(startup_64)
7540 notq %rax
7541 andq %rax, %rbp
7542 #else
7543- movq $LOAD_PHYSICAL_ADDR, %rbp
7544+ movq $____LOAD_PHYSICAL_ADDR, %rbp
7545 #endif
7546
7547 /* Target address to relocate to for decompression */
7548diff -urNp linux-2.6.39/arch/x86/boot/compressed/misc.c linux-2.6.39/arch/x86/boot/compressed/misc.c
7549--- linux-2.6.39/arch/x86/boot/compressed/misc.c 2011-05-19 00:06:34.000000000 -0400
7550+++ linux-2.6.39/arch/x86/boot/compressed/misc.c 2011-05-22 19:36:30.000000000 -0400
7551@@ -310,7 +310,7 @@ static void parse_elf(void *output)
7552 case PT_LOAD:
7553 #ifdef CONFIG_RELOCATABLE
7554 dest = output;
7555- dest += (phdr->p_paddr - LOAD_PHYSICAL_ADDR);
7556+ dest += (phdr->p_paddr - ____LOAD_PHYSICAL_ADDR);
7557 #else
7558 dest = (void *)(phdr->p_paddr);
7559 #endif
7560@@ -363,7 +363,7 @@ asmlinkage void decompress_kernel(void *
7561 error("Destination address too large");
7562 #endif
7563 #ifndef CONFIG_RELOCATABLE
7564- if ((unsigned long)output != LOAD_PHYSICAL_ADDR)
7565+ if ((unsigned long)output != ____LOAD_PHYSICAL_ADDR)
7566 error("Wrong destination address");
7567 #endif
7568
7569diff -urNp linux-2.6.39/arch/x86/boot/compressed/relocs.c linux-2.6.39/arch/x86/boot/compressed/relocs.c
7570--- linux-2.6.39/arch/x86/boot/compressed/relocs.c 2011-05-19 00:06:34.000000000 -0400
7571+++ linux-2.6.39/arch/x86/boot/compressed/relocs.c 2011-05-22 19:36:30.000000000 -0400
7572@@ -13,8 +13,11 @@
7573
7574 static void die(char *fmt, ...);
7575
7576+#include "../../../../include/generated/autoconf.h"
7577+
7578 #define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
7579 static Elf32_Ehdr ehdr;
7580+static Elf32_Phdr *phdr;
7581 static unsigned long reloc_count, reloc_idx;
7582 static unsigned long *relocs;
7583
7584@@ -270,9 +273,39 @@ static void read_ehdr(FILE *fp)
7585 }
7586 }
7587
7588+static void read_phdrs(FILE *fp)
7589+{
7590+ unsigned int i;
7591+
7592+ phdr = calloc(ehdr.e_phnum, sizeof(Elf32_Phdr));
7593+ if (!phdr) {
7594+ die("Unable to allocate %d program headers\n",
7595+ ehdr.e_phnum);
7596+ }
7597+ if (fseek(fp, ehdr.e_phoff, SEEK_SET) < 0) {
7598+ die("Seek to %d failed: %s\n",
7599+ ehdr.e_phoff, strerror(errno));
7600+ }
7601+ if (fread(phdr, sizeof(*phdr), ehdr.e_phnum, fp) != ehdr.e_phnum) {
7602+ die("Cannot read ELF program headers: %s\n",
7603+ strerror(errno));
7604+ }
7605+ for(i = 0; i < ehdr.e_phnum; i++) {
7606+ phdr[i].p_type = elf32_to_cpu(phdr[i].p_type);
7607+ phdr[i].p_offset = elf32_to_cpu(phdr[i].p_offset);
7608+ phdr[i].p_vaddr = elf32_to_cpu(phdr[i].p_vaddr);
7609+ phdr[i].p_paddr = elf32_to_cpu(phdr[i].p_paddr);
7610+ phdr[i].p_filesz = elf32_to_cpu(phdr[i].p_filesz);
7611+ phdr[i].p_memsz = elf32_to_cpu(phdr[i].p_memsz);
7612+ phdr[i].p_flags = elf32_to_cpu(phdr[i].p_flags);
7613+ phdr[i].p_align = elf32_to_cpu(phdr[i].p_align);
7614+ }
7615+
7616+}
7617+
7618 static void read_shdrs(FILE *fp)
7619 {
7620- int i;
7621+ unsigned int i;
7622 Elf32_Shdr shdr;
7623
7624 secs = calloc(ehdr.e_shnum, sizeof(struct section));
7625@@ -307,7 +340,7 @@ static void read_shdrs(FILE *fp)
7626
7627 static void read_strtabs(FILE *fp)
7628 {
7629- int i;
7630+ unsigned int i;
7631 for (i = 0; i < ehdr.e_shnum; i++) {
7632 struct section *sec = &secs[i];
7633 if (sec->shdr.sh_type != SHT_STRTAB) {
7634@@ -332,7 +365,7 @@ static void read_strtabs(FILE *fp)
7635
7636 static void read_symtabs(FILE *fp)
7637 {
7638- int i,j;
7639+ unsigned int i,j;
7640 for (i = 0; i < ehdr.e_shnum; i++) {
7641 struct section *sec = &secs[i];
7642 if (sec->shdr.sh_type != SHT_SYMTAB) {
7643@@ -365,7 +398,9 @@ static void read_symtabs(FILE *fp)
7644
7645 static void read_relocs(FILE *fp)
7646 {
7647- int i,j;
7648+ unsigned int i,j;
7649+ uint32_t base;
7650+
7651 for (i = 0; i < ehdr.e_shnum; i++) {
7652 struct section *sec = &secs[i];
7653 if (sec->shdr.sh_type != SHT_REL) {
7654@@ -385,9 +420,18 @@ static void read_relocs(FILE *fp)
7655 die("Cannot read symbol table: %s\n",
7656 strerror(errno));
7657 }
7658+ base = 0;
7659+ for (j = 0; j < ehdr.e_phnum; j++) {
7660+ if (phdr[j].p_type != PT_LOAD )
7661+ continue;
7662+ if (secs[sec->shdr.sh_info].shdr.sh_offset < phdr[j].p_offset || secs[sec->shdr.sh_info].shdr.sh_offset >= phdr[j].p_offset + phdr[j].p_filesz)
7663+ continue;
7664+ base = CONFIG_PAGE_OFFSET + phdr[j].p_paddr - phdr[j].p_vaddr;
7665+ break;
7666+ }
7667 for (j = 0; j < sec->shdr.sh_size/sizeof(Elf32_Rel); j++) {
7668 Elf32_Rel *rel = &sec->reltab[j];
7669- rel->r_offset = elf32_to_cpu(rel->r_offset);
7670+ rel->r_offset = elf32_to_cpu(rel->r_offset) + base;
7671 rel->r_info = elf32_to_cpu(rel->r_info);
7672 }
7673 }
7674@@ -396,14 +440,14 @@ static void read_relocs(FILE *fp)
7675
7676 static void print_absolute_symbols(void)
7677 {
7678- int i;
7679+ unsigned int i;
7680 printf("Absolute symbols\n");
7681 printf(" Num: Value Size Type Bind Visibility Name\n");
7682 for (i = 0; i < ehdr.e_shnum; i++) {
7683 struct section *sec = &secs[i];
7684 char *sym_strtab;
7685 Elf32_Sym *sh_symtab;
7686- int j;
7687+ unsigned int j;
7688
7689 if (sec->shdr.sh_type != SHT_SYMTAB) {
7690 continue;
7691@@ -431,14 +475,14 @@ static void print_absolute_symbols(void)
7692
7693 static void print_absolute_relocs(void)
7694 {
7695- int i, printed = 0;
7696+ unsigned int i, printed = 0;
7697
7698 for (i = 0; i < ehdr.e_shnum; i++) {
7699 struct section *sec = &secs[i];
7700 struct section *sec_applies, *sec_symtab;
7701 char *sym_strtab;
7702 Elf32_Sym *sh_symtab;
7703- int j;
7704+ unsigned int j;
7705 if (sec->shdr.sh_type != SHT_REL) {
7706 continue;
7707 }
7708@@ -499,13 +543,13 @@ static void print_absolute_relocs(void)
7709
7710 static void walk_relocs(void (*visit)(Elf32_Rel *rel, Elf32_Sym *sym))
7711 {
7712- int i;
7713+ unsigned int i;
7714 /* Walk through the relocations */
7715 for (i = 0; i < ehdr.e_shnum; i++) {
7716 char *sym_strtab;
7717 Elf32_Sym *sh_symtab;
7718 struct section *sec_applies, *sec_symtab;
7719- int j;
7720+ unsigned int j;
7721 struct section *sec = &secs[i];
7722
7723 if (sec->shdr.sh_type != SHT_REL) {
7724@@ -530,6 +574,22 @@ static void walk_relocs(void (*visit)(El
7725 !is_rel_reloc(sym_name(sym_strtab, sym))) {
7726 continue;
7727 }
7728+ /* Don't relocate actual per-cpu variables, they are absolute indices, not addresses */
7729+ if (!strcmp(sec_name(sym->st_shndx), ".data..percpu") && strcmp(sym_name(sym_strtab, sym), "__per_cpu_load"))
7730+ continue;
7731+
7732+#if defined(CONFIG_PAX_KERNEXEC) && defined(CONFIG_X86_32)
7733+ /* Don't relocate actual code, they are relocated implicitly by the base address of KERNEL_CS */
7734+ if (!strcmp(sec_name(sym->st_shndx), ".module.text") && !strcmp(sym_name(sym_strtab, sym), "_etext"))
7735+ continue;
7736+ if (!strcmp(sec_name(sym->st_shndx), ".init.text"))
7737+ continue;
7738+ if (!strcmp(sec_name(sym->st_shndx), ".exit.text"))
7739+ continue;
7740+ if (!strcmp(sec_name(sym->st_shndx), ".text") && strcmp(sym_name(sym_strtab, sym), "__LOAD_PHYSICAL_ADDR"))
7741+ continue;
7742+#endif
7743+
7744 switch (r_type) {
7745 case R_386_NONE:
7746 case R_386_PC32:
7747@@ -571,7 +631,7 @@ static int cmp_relocs(const void *va, co
7748
7749 static void emit_relocs(int as_text)
7750 {
7751- int i;
7752+ unsigned int i;
7753 /* Count how many relocations I have and allocate space for them. */
7754 reloc_count = 0;
7755 walk_relocs(count_reloc);
7756@@ -665,6 +725,7 @@ int main(int argc, char **argv)
7757 fname, strerror(errno));
7758 }
7759 read_ehdr(fp);
7760+ read_phdrs(fp);
7761 read_shdrs(fp);
7762 read_strtabs(fp);
7763 read_symtabs(fp);
7764diff -urNp linux-2.6.39/arch/x86/boot/cpucheck.c linux-2.6.39/arch/x86/boot/cpucheck.c
7765--- linux-2.6.39/arch/x86/boot/cpucheck.c 2011-05-19 00:06:34.000000000 -0400
7766+++ linux-2.6.39/arch/x86/boot/cpucheck.c 2011-05-22 19:36:30.000000000 -0400
7767@@ -74,7 +74,7 @@ static int has_fpu(void)
7768 u16 fcw = -1, fsw = -1;
7769 u32 cr0;
7770
7771- asm("movl %%cr0,%0" : "=r" (cr0));
7772+ asm volatile("movl %%cr0,%0" : "=r" (cr0));
7773 if (cr0 & (X86_CR0_EM|X86_CR0_TS)) {
7774 cr0 &= ~(X86_CR0_EM|X86_CR0_TS);
7775 asm volatile("movl %0,%%cr0" : : "r" (cr0));
7776@@ -90,7 +90,7 @@ static int has_eflag(u32 mask)
7777 {
7778 u32 f0, f1;
7779
7780- asm("pushfl ; "
7781+ asm volatile("pushfl ; "
7782 "pushfl ; "
7783 "popl %0 ; "
7784 "movl %0,%1 ; "
7785@@ -115,7 +115,7 @@ static void get_flags(void)
7786 set_bit(X86_FEATURE_FPU, cpu.flags);
7787
7788 if (has_eflag(X86_EFLAGS_ID)) {
7789- asm("cpuid"
7790+ asm volatile("cpuid"
7791 : "=a" (max_intel_level),
7792 "=b" (cpu_vendor[0]),
7793 "=d" (cpu_vendor[1]),
7794@@ -124,7 +124,7 @@ static void get_flags(void)
7795
7796 if (max_intel_level >= 0x00000001 &&
7797 max_intel_level <= 0x0000ffff) {
7798- asm("cpuid"
7799+ asm volatile("cpuid"
7800 : "=a" (tfms),
7801 "=c" (cpu.flags[4]),
7802 "=d" (cpu.flags[0])
7803@@ -136,7 +136,7 @@ static void get_flags(void)
7804 cpu.model += ((tfms >> 16) & 0xf) << 4;
7805 }
7806
7807- asm("cpuid"
7808+ asm volatile("cpuid"
7809 : "=a" (max_amd_level)
7810 : "a" (0x80000000)
7811 : "ebx", "ecx", "edx");
7812@@ -144,7 +144,7 @@ static void get_flags(void)
7813 if (max_amd_level >= 0x80000001 &&
7814 max_amd_level <= 0x8000ffff) {
7815 u32 eax = 0x80000001;
7816- asm("cpuid"
7817+ asm volatile("cpuid"
7818 : "+a" (eax),
7819 "=c" (cpu.flags[6]),
7820 "=d" (cpu.flags[1])
7821@@ -203,9 +203,9 @@ int check_cpu(int *cpu_level_ptr, int *r
7822 u32 ecx = MSR_K7_HWCR;
7823 u32 eax, edx;
7824
7825- asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
7826+ asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
7827 eax &= ~(1 << 15);
7828- asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
7829+ asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
7830
7831 get_flags(); /* Make sure it really did something */
7832 err = check_flags();
7833@@ -218,9 +218,9 @@ int check_cpu(int *cpu_level_ptr, int *r
7834 u32 ecx = MSR_VIA_FCR;
7835 u32 eax, edx;
7836
7837- asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
7838+ asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
7839 eax |= (1<<1)|(1<<7);
7840- asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
7841+ asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
7842
7843 set_bit(X86_FEATURE_CX8, cpu.flags);
7844 err = check_flags();
7845@@ -231,12 +231,12 @@ int check_cpu(int *cpu_level_ptr, int *r
7846 u32 eax, edx;
7847 u32 level = 1;
7848
7849- asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
7850- asm("wrmsr" : : "a" (~0), "d" (edx), "c" (ecx));
7851- asm("cpuid"
7852+ asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
7853+ asm volatile("wrmsr" : : "a" (~0), "d" (edx), "c" (ecx));
7854+ asm volatile("cpuid"
7855 : "+a" (level), "=d" (cpu.flags[0])
7856 : : "ecx", "ebx");
7857- asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
7858+ asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
7859
7860 err = check_flags();
7861 }
7862diff -urNp linux-2.6.39/arch/x86/boot/header.S linux-2.6.39/arch/x86/boot/header.S
7863--- linux-2.6.39/arch/x86/boot/header.S 2011-05-19 00:06:34.000000000 -0400
7864+++ linux-2.6.39/arch/x86/boot/header.S 2011-05-22 19:36:30.000000000 -0400
7865@@ -224,7 +224,7 @@ setup_data: .quad 0 # 64-bit physical
7866 # single linked list of
7867 # struct setup_data
7868
7869-pref_address: .quad LOAD_PHYSICAL_ADDR # preferred load addr
7870+pref_address: .quad ____LOAD_PHYSICAL_ADDR # preferred load addr
7871
7872 #define ZO_INIT_SIZE (ZO__end - ZO_startup_32 + ZO_z_extract_offset)
7873 #define VO_INIT_SIZE (VO__end - VO__text)
7874diff -urNp linux-2.6.39/arch/x86/boot/memory.c linux-2.6.39/arch/x86/boot/memory.c
7875--- linux-2.6.39/arch/x86/boot/memory.c 2011-05-19 00:06:34.000000000 -0400
7876+++ linux-2.6.39/arch/x86/boot/memory.c 2011-05-22 19:36:30.000000000 -0400
7877@@ -19,7 +19,7 @@
7878
7879 static int detect_memory_e820(void)
7880 {
7881- int count = 0;
7882+ unsigned int count = 0;
7883 struct biosregs ireg, oreg;
7884 struct e820entry *desc = boot_params.e820_map;
7885 static struct e820entry buf; /* static so it is zeroed */
7886diff -urNp linux-2.6.39/arch/x86/boot/video.c linux-2.6.39/arch/x86/boot/video.c
7887--- linux-2.6.39/arch/x86/boot/video.c 2011-05-19 00:06:34.000000000 -0400
7888+++ linux-2.6.39/arch/x86/boot/video.c 2011-05-22 19:36:30.000000000 -0400
7889@@ -96,7 +96,7 @@ static void store_mode_params(void)
7890 static unsigned int get_entry(void)
7891 {
7892 char entry_buf[4];
7893- int i, len = 0;
7894+ unsigned int i, len = 0;
7895 int key;
7896 unsigned int v;
7897
7898diff -urNp linux-2.6.39/arch/x86/boot/video-vesa.c linux-2.6.39/arch/x86/boot/video-vesa.c
7899--- linux-2.6.39/arch/x86/boot/video-vesa.c 2011-05-19 00:06:34.000000000 -0400
7900+++ linux-2.6.39/arch/x86/boot/video-vesa.c 2011-05-22 19:36:30.000000000 -0400
7901@@ -200,6 +200,7 @@ static void vesa_store_pm_info(void)
7902
7903 boot_params.screen_info.vesapm_seg = oreg.es;
7904 boot_params.screen_info.vesapm_off = oreg.di;
7905+ boot_params.screen_info.vesapm_size = oreg.cx;
7906 }
7907
7908 /*
7909diff -urNp linux-2.6.39/arch/x86/ia32/ia32_aout.c linux-2.6.39/arch/x86/ia32/ia32_aout.c
7910--- linux-2.6.39/arch/x86/ia32/ia32_aout.c 2011-05-19 00:06:34.000000000 -0400
7911+++ linux-2.6.39/arch/x86/ia32/ia32_aout.c 2011-05-22 19:41:32.000000000 -0400
7912@@ -162,6 +162,8 @@ static int aout_core_dump(long signr, st
7913 unsigned long dump_start, dump_size;
7914 struct user32 dump;
7915
7916+ memset(&dump, 0, sizeof(dump));
7917+
7918 fs = get_fs();
7919 set_fs(KERNEL_DS);
7920 has_dumped = 1;
7921diff -urNp linux-2.6.39/arch/x86/ia32/ia32entry.S linux-2.6.39/arch/x86/ia32/ia32entry.S
7922--- linux-2.6.39/arch/x86/ia32/ia32entry.S 2011-05-19 00:06:34.000000000 -0400
7923+++ linux-2.6.39/arch/x86/ia32/ia32entry.S 2011-05-23 17:16:01.000000000 -0400
7924@@ -13,6 +13,7 @@
7925 #include <asm/thread_info.h>
7926 #include <asm/segment.h>
7927 #include <asm/irqflags.h>
7928+#include <asm/pgtable.h>
7929 #include <linux/linkage.h>
7930
7931 /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this. */
7932@@ -95,6 +96,32 @@ ENTRY(native_irq_enable_sysexit)
7933 ENDPROC(native_irq_enable_sysexit)
7934 #endif
7935
7936+ .macro pax_enter_kernel_user
7937+#ifdef CONFIG_PAX_MEMORY_UDEREF
7938+ call pax_enter_kernel_user
7939+#endif
7940+ .endm
7941+
7942+ .macro pax_exit_kernel_user
7943+#ifdef CONFIG_PAX_MEMORY_UDEREF
7944+ call pax_exit_kernel_user
7945+#endif
7946+#ifdef CONFIG_PAX_RANDKSTACK
7947+ pushq %rax
7948+ call pax_randomize_kstack
7949+ popq %rax
7950+#endif
7951+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
7952+ call pax_erase_kstack
7953+#endif
7954+ .endm
7955+
7956+ .macro pax_erase_kstack
7957+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
7958+ call pax_erase_kstack
7959+#endif
7960+ .endm
7961+
7962 /*
7963 * 32bit SYSENTER instruction entry.
7964 *
7965@@ -121,7 +148,7 @@ ENTRY(ia32_sysenter_target)
7966 CFI_REGISTER rsp,rbp
7967 SWAPGS_UNSAFE_STACK
7968 movq PER_CPU_VAR(kernel_stack), %rsp
7969- addq $(KERNEL_STACK_OFFSET),%rsp
7970+ pax_enter_kernel_user
7971 /*
7972 * No need to follow this irqs on/off section: the syscall
7973 * disabled irqs, here we enable it straight after entry:
7974@@ -134,7 +161,8 @@ ENTRY(ia32_sysenter_target)
7975 CFI_REL_OFFSET rsp,0
7976 pushfq_cfi
7977 /*CFI_REL_OFFSET rflags,0*/
7978- movl 8*3-THREAD_SIZE+TI_sysenter_return(%rsp), %r10d
7979+ GET_THREAD_INFO(%r10)
7980+ movl TI_sysenter_return(%r10), %r10d
7981 CFI_REGISTER rip,r10
7982 pushq_cfi $__USER32_CS
7983 /*CFI_REL_OFFSET cs,0*/
7984@@ -146,6 +174,12 @@ ENTRY(ia32_sysenter_target)
7985 SAVE_ARGS 0,0,1
7986 /* no need to do an access_ok check here because rbp has been
7987 32bit zero extended */
7988+
7989+#ifdef CONFIG_PAX_MEMORY_UDEREF
7990+ mov $PAX_USER_SHADOW_BASE,%r10
7991+ add %r10,%rbp
7992+#endif
7993+
7994 1: movl (%rbp),%ebp
7995 .section __ex_table,"a"
7996 .quad 1b,ia32_badarg
7997@@ -168,6 +202,7 @@ sysenter_dispatch:
7998 testl $_TIF_ALLWORK_MASK,TI_flags(%r10)
7999 jnz sysexit_audit
8000 sysexit_from_sys_call:
8001+ pax_exit_kernel_user
8002 andl $~TS_COMPAT,TI_status(%r10)
8003 /* clear IF, that popfq doesn't enable interrupts early */
8004 andl $~0x200,EFLAGS-R11(%rsp)
8005@@ -194,6 +229,9 @@ sysexit_from_sys_call:
8006 movl %eax,%esi /* 2nd arg: syscall number */
8007 movl $AUDIT_ARCH_I386,%edi /* 1st arg: audit arch */
8008 call audit_syscall_entry
8009+
8010+ pax_erase_kstack
8011+
8012 movl RAX-ARGOFFSET(%rsp),%eax /* reload syscall number */
8013 cmpq $(IA32_NR_syscalls-1),%rax
8014 ja ia32_badsys
8015@@ -246,6 +284,9 @@ sysenter_tracesys:
8016 movq $-ENOSYS,RAX(%rsp)/* ptrace can change this for a bad syscall */
8017 movq %rsp,%rdi /* &pt_regs -> arg1 */
8018 call syscall_trace_enter
8019+
8020+ pax_erase_kstack
8021+
8022 LOAD_ARGS32 ARGOFFSET /* reload args from stack in case ptrace changed it */
8023 RESTORE_REST
8024 cmpq $(IA32_NR_syscalls-1),%rax
8025@@ -277,19 +318,24 @@ ENDPROC(ia32_sysenter_target)
8026 ENTRY(ia32_cstar_target)
8027 CFI_STARTPROC32 simple
8028 CFI_SIGNAL_FRAME
8029- CFI_DEF_CFA rsp,KERNEL_STACK_OFFSET
8030+ CFI_DEF_CFA rsp,0
8031 CFI_REGISTER rip,rcx
8032 /*CFI_REGISTER rflags,r11*/
8033 SWAPGS_UNSAFE_STACK
8034 movl %esp,%r8d
8035 CFI_REGISTER rsp,r8
8036 movq PER_CPU_VAR(kernel_stack),%rsp
8037+
8038+#ifdef CONFIG_PAX_MEMORY_UDEREF
8039+ pax_enter_kernel_user
8040+#endif
8041+
8042 /*
8043 * No need to follow this irqs on/off section: the syscall
8044 * disabled irqs and here we enable it straight after entry:
8045 */
8046 ENABLE_INTERRUPTS(CLBR_NONE)
8047- SAVE_ARGS 8,1,1
8048+ SAVE_ARGS 8*6,1,1
8049 movl %eax,%eax /* zero extension */
8050 movq %rax,ORIG_RAX-ARGOFFSET(%rsp)
8051 movq %rcx,RIP-ARGOFFSET(%rsp)
8052@@ -305,6 +351,12 @@ ENTRY(ia32_cstar_target)
8053 /* no need to do an access_ok check here because r8 has been
8054 32bit zero extended */
8055 /* hardware stack frame is complete now */
8056+
8057+#ifdef CONFIG_PAX_MEMORY_UDEREF
8058+ mov $PAX_USER_SHADOW_BASE,%r10
8059+ add %r10,%r8
8060+#endif
8061+
8062 1: movl (%r8),%r9d
8063 .section __ex_table,"a"
8064 .quad 1b,ia32_badarg
8065@@ -327,6 +379,7 @@ cstar_dispatch:
8066 testl $_TIF_ALLWORK_MASK,TI_flags(%r10)
8067 jnz sysretl_audit
8068 sysretl_from_sys_call:
8069+ pax_exit_kernel_user
8070 andl $~TS_COMPAT,TI_status(%r10)
8071 RESTORE_ARGS 1,-ARG_SKIP,1,1,1
8072 movl RIP-ARGOFFSET(%rsp),%ecx
8073@@ -364,6 +417,9 @@ cstar_tracesys:
8074 movq $-ENOSYS,RAX(%rsp) /* ptrace can change this for a bad syscall */
8075 movq %rsp,%rdi /* &pt_regs -> arg1 */
8076 call syscall_trace_enter
8077+
8078+ pax_erase_kstack
8079+
8080 LOAD_ARGS32 ARGOFFSET, 1 /* reload args from stack in case ptrace changed it */
8081 RESTORE_REST
8082 xchgl %ebp,%r9d
8083@@ -409,6 +465,7 @@ ENTRY(ia32_syscall)
8084 CFI_REL_OFFSET rip,RIP-RIP
8085 PARAVIRT_ADJUST_EXCEPTION_FRAME
8086 SWAPGS
8087+ pax_enter_kernel_user
8088 /*
8089 * No need to follow this irqs on/off section: the syscall
8090 * disabled irqs and here we enable it straight after entry:
8091@@ -441,6 +498,9 @@ ia32_tracesys:
8092 movq $-ENOSYS,RAX(%rsp) /* ptrace can change this for a bad syscall */
8093 movq %rsp,%rdi /* &pt_regs -> arg1 */
8094 call syscall_trace_enter
8095+
8096+ pax_erase_kstack
8097+
8098 LOAD_ARGS32 ARGOFFSET /* reload args from stack in case ptrace changed it */
8099 RESTORE_REST
8100 cmpq $(IA32_NR_syscalls-1),%rax
8101diff -urNp linux-2.6.39/arch/x86/ia32/ia32_signal.c linux-2.6.39/arch/x86/ia32/ia32_signal.c
8102--- linux-2.6.39/arch/x86/ia32/ia32_signal.c 2011-05-19 00:06:34.000000000 -0400
8103+++ linux-2.6.39/arch/x86/ia32/ia32_signal.c 2011-05-22 19:36:30.000000000 -0400
8104@@ -403,7 +403,7 @@ static void __user *get_sigframe(struct
8105 sp -= frame_size;
8106 /* Align the stack pointer according to the i386 ABI,
8107 * i.e. so that on function entry ((sp + 4) & 15) == 0. */
8108- sp = ((sp + 4) & -16ul) - 4;
8109+ sp = ((sp - 12) & -16ul) - 4;
8110 return (void __user *) sp;
8111 }
8112
8113@@ -461,7 +461,7 @@ int ia32_setup_frame(int sig, struct k_s
8114 * These are actually not used anymore, but left because some
8115 * gdb versions depend on them as a marker.
8116 */
8117- put_user_ex(*((u64 *)&code), (u64 *)frame->retcode);
8118+ put_user_ex(*((const u64 *)&code), (u64 *)frame->retcode);
8119 } put_user_catch(err);
8120
8121 if (err)
8122@@ -503,7 +503,7 @@ int ia32_setup_rt_frame(int sig, struct
8123 0xb8,
8124 __NR_ia32_rt_sigreturn,
8125 0x80cd,
8126- 0,
8127+ 0
8128 };
8129
8130 frame = get_sigframe(ka, regs, sizeof(*frame), &fpstate);
8131@@ -533,16 +533,18 @@ int ia32_setup_rt_frame(int sig, struct
8132
8133 if (ka->sa.sa_flags & SA_RESTORER)
8134 restorer = ka->sa.sa_restorer;
8135+ else if (current->mm->context.vdso)
8136+ /* Return stub is in 32bit vsyscall page */
8137+ restorer = VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
8138 else
8139- restorer = VDSO32_SYMBOL(current->mm->context.vdso,
8140- rt_sigreturn);
8141+ restorer = &frame->retcode;
8142 put_user_ex(ptr_to_compat(restorer), &frame->pretcode);
8143
8144 /*
8145 * Not actually used anymore, but left because some gdb
8146 * versions need it.
8147 */
8148- put_user_ex(*((u64 *)&code), (u64 *)frame->retcode);
8149+ put_user_ex(*((const u64 *)&code), (u64 *)frame->retcode);
8150 } put_user_catch(err);
8151
8152 if (err)
8153diff -urNp linux-2.6.39/arch/x86/include/asm/alternative.h linux-2.6.39/arch/x86/include/asm/alternative.h
8154--- linux-2.6.39/arch/x86/include/asm/alternative.h 2011-05-19 00:06:34.000000000 -0400
8155+++ linux-2.6.39/arch/x86/include/asm/alternative.h 2011-05-22 19:36:30.000000000 -0400
8156@@ -94,7 +94,7 @@ static inline int alternatives_text_rese
8157 ".section .discard,\"aw\",@progbits\n" \
8158 " .byte 0xff + (664f-663f) - (662b-661b)\n" /* rlen <= slen */ \
8159 ".previous\n" \
8160- ".section .altinstr_replacement, \"ax\"\n" \
8161+ ".section .altinstr_replacement, \"a\"\n" \
8162 "663:\n\t" newinstr "\n664:\n" /* replacement */ \
8163 ".previous"
8164
8165diff -urNp linux-2.6.39/arch/x86/include/asm/apm.h linux-2.6.39/arch/x86/include/asm/apm.h
8166--- linux-2.6.39/arch/x86/include/asm/apm.h 2011-05-19 00:06:34.000000000 -0400
8167+++ linux-2.6.39/arch/x86/include/asm/apm.h 2011-05-22 19:36:30.000000000 -0400
8168@@ -34,7 +34,7 @@ static inline void apm_bios_call_asm(u32
8169 __asm__ __volatile__(APM_DO_ZERO_SEGS
8170 "pushl %%edi\n\t"
8171 "pushl %%ebp\n\t"
8172- "lcall *%%cs:apm_bios_entry\n\t"
8173+ "lcall *%%ss:apm_bios_entry\n\t"
8174 "setc %%al\n\t"
8175 "popl %%ebp\n\t"
8176 "popl %%edi\n\t"
8177@@ -58,7 +58,7 @@ static inline u8 apm_bios_call_simple_as
8178 __asm__ __volatile__(APM_DO_ZERO_SEGS
8179 "pushl %%edi\n\t"
8180 "pushl %%ebp\n\t"
8181- "lcall *%%cs:apm_bios_entry\n\t"
8182+ "lcall *%%ss:apm_bios_entry\n\t"
8183 "setc %%bl\n\t"
8184 "popl %%ebp\n\t"
8185 "popl %%edi\n\t"
8186diff -urNp linux-2.6.39/arch/x86/include/asm/atomic64_32.h linux-2.6.39/arch/x86/include/asm/atomic64_32.h
8187--- linux-2.6.39/arch/x86/include/asm/atomic64_32.h 2011-05-19 00:06:34.000000000 -0400
8188+++ linux-2.6.39/arch/x86/include/asm/atomic64_32.h 2011-05-22 19:36:30.000000000 -0400
8189@@ -12,6 +12,14 @@ typedef struct {
8190 u64 __aligned(8) counter;
8191 } atomic64_t;
8192
8193+#ifdef CONFIG_PAX_REFCOUNT
8194+typedef struct {
8195+ u64 __aligned(8) counter;
8196+} atomic64_unchecked_t;
8197+#else
8198+typedef atomic64_t atomic64_unchecked_t;
8199+#endif
8200+
8201 #define ATOMIC64_INIT(val) { (val) }
8202
8203 #ifdef CONFIG_X86_CMPXCHG64
8204@@ -38,6 +46,21 @@ static inline long long atomic64_cmpxchg
8205 }
8206
8207 /**
8208+ * atomic64_cmpxchg_unchecked - cmpxchg atomic64 variable
8209+ * @p: pointer to type atomic64_unchecked_t
8210+ * @o: expected value
8211+ * @n: new value
8212+ *
8213+ * Atomically sets @v to @n if it was equal to @o and returns
8214+ * the old value.
8215+ */
8216+
8217+static inline long long atomic64_cmpxchg_unchecked(atomic64_unchecked_t *v, long long o, long long n)
8218+{
8219+ return cmpxchg64(&v->counter, o, n);
8220+}
8221+
8222+/**
8223 * atomic64_xchg - xchg atomic64 variable
8224 * @v: pointer to type atomic64_t
8225 * @n: value to assign
8226@@ -77,6 +100,24 @@ static inline void atomic64_set(atomic64
8227 }
8228
8229 /**
8230+ * atomic64_set_unchecked - set atomic64 variable
8231+ * @v: pointer to type atomic64_unchecked_t
8232+ * @n: value to assign
8233+ *
8234+ * Atomically sets the value of @v to @n.
8235+ */
8236+static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long long i)
8237+{
8238+ unsigned high = (unsigned)(i >> 32);
8239+ unsigned low = (unsigned)i;
8240+ asm volatile(ATOMIC64_ALTERNATIVE(set)
8241+ : "+b" (low), "+c" (high)
8242+ : "S" (v)
8243+ : "eax", "edx", "memory"
8244+ );
8245+}
8246+
8247+/**
8248 * atomic64_read - read atomic64 variable
8249 * @v: pointer to type atomic64_t
8250 *
8251@@ -93,6 +134,22 @@ static inline long long atomic64_read(at
8252 }
8253
8254 /**
8255+ * atomic64_read_unchecked - read atomic64 variable
8256+ * @v: pointer to type atomic64_unchecked_t
8257+ *
8258+ * Atomically reads the value of @v and returns it.
8259+ */
8260+static inline long long atomic64_read_unchecked(atomic64_unchecked_t *v)
8261+{
8262+ long long r;
8263+ asm volatile(ATOMIC64_ALTERNATIVE(read_unchecked)
8264+ : "=A" (r), "+c" (v)
8265+ : : "memory"
8266+ );
8267+ return r;
8268+ }
8269+
8270+/**
8271 * atomic64_add_return - add and return
8272 * @i: integer value to add
8273 * @v: pointer to type atomic64_t
8274@@ -108,6 +165,22 @@ static inline long long atomic64_add_ret
8275 return i;
8276 }
8277
8278+/**
8279+ * atomic64_add_return_unchecked - add and return
8280+ * @i: integer value to add
8281+ * @v: pointer to type atomic64_unchecked_t
8282+ *
8283+ * Atomically adds @i to @v and returns @i + *@v
8284+ */
8285+static inline long long atomic64_add_return_unchecked(long long i, atomic64_unchecked_t *v)
8286+{
8287+ asm volatile(ATOMIC64_ALTERNATIVE(add_return_unchecked)
8288+ : "+A" (i), "+c" (v)
8289+ : : "memory"
8290+ );
8291+ return i;
8292+}
8293+
8294 /*
8295 * Other variants with different arithmetic operators:
8296 */
8297@@ -131,6 +204,17 @@ static inline long long atomic64_inc_ret
8298 return a;
8299 }
8300
8301+static inline long long atomic64_inc_return_unchecked(atomic64_unchecked_t *v)
8302+{
8303+ long long a;
8304+ asm volatile(ATOMIC64_ALTERNATIVE(inc_return_unchecked)
8305+ : "=A" (a)
8306+ : "S" (v)
8307+ : "memory", "ecx"
8308+ );
8309+ return a;
8310+}
8311+
8312 static inline long long atomic64_dec_return(atomic64_t *v)
8313 {
8314 long long a;
8315@@ -159,6 +243,22 @@ static inline long long atomic64_add(lon
8316 }
8317
8318 /**
8319+ * atomic64_add_unchecked - add integer to atomic64 variable
8320+ * @i: integer value to add
8321+ * @v: pointer to type atomic64_unchecked_t
8322+ *
8323+ * Atomically adds @i to @v.
8324+ */
8325+static inline long long atomic64_add_unchecked(long long i, atomic64_unchecked_t *v)
8326+{
8327+ asm volatile(ATOMIC64_ALTERNATIVE_(add_unchecked, add_return_unchecked)
8328+ : "+A" (i), "+c" (v)
8329+ : : "memory"
8330+ );
8331+ return i;
8332+}
8333+
8334+/**
8335 * atomic64_sub - subtract the atomic64 variable
8336 * @i: integer value to subtract
8337 * @v: pointer to type atomic64_t
8338diff -urNp linux-2.6.39/arch/x86/include/asm/atomic64_64.h linux-2.6.39/arch/x86/include/asm/atomic64_64.h
8339--- linux-2.6.39/arch/x86/include/asm/atomic64_64.h 2011-05-19 00:06:34.000000000 -0400
8340+++ linux-2.6.39/arch/x86/include/asm/atomic64_64.h 2011-05-22 19:36:30.000000000 -0400
8341@@ -18,7 +18,19 @@
8342 */
8343 static inline long atomic64_read(const atomic64_t *v)
8344 {
8345- return (*(volatile long *)&(v)->counter);
8346+ return (*(volatile const long *)&(v)->counter);
8347+}
8348+
8349+/**
8350+ * atomic64_read_unchecked - read atomic64 variable
8351+ * @v: pointer of type atomic64_unchecked_t
8352+ *
8353+ * Atomically reads the value of @v.
8354+ * Doesn't imply a read memory barrier.
8355+ */
8356+static inline long atomic64_read_unchecked(const atomic64_unchecked_t *v)
8357+{
8358+ return (*(volatile const long *)&(v)->counter);
8359 }
8360
8361 /**
8362@@ -34,6 +46,18 @@ static inline void atomic64_set(atomic64
8363 }
8364
8365 /**
8366+ * atomic64_set_unchecked - set atomic64 variable
8367+ * @v: pointer to type atomic64_unchecked_t
8368+ * @i: required value
8369+ *
8370+ * Atomically sets the value of @v to @i.
8371+ */
8372+static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long i)
8373+{
8374+ v->counter = i;
8375+}
8376+
8377+/**
8378 * atomic64_add - add integer to atomic64 variable
8379 * @i: integer value to add
8380 * @v: pointer to type atomic64_t
8381@@ -42,6 +66,28 @@ static inline void atomic64_set(atomic64
8382 */
8383 static inline void atomic64_add(long i, atomic64_t *v)
8384 {
8385+ asm volatile(LOCK_PREFIX "addq %1,%0\n"
8386+
8387+#ifdef CONFIG_PAX_REFCOUNT
8388+ "jno 0f\n"
8389+ LOCK_PREFIX "subq %1,%0\n"
8390+ "int $4\n0:\n"
8391+ _ASM_EXTABLE(0b, 0b)
8392+#endif
8393+
8394+ : "=m" (v->counter)
8395+ : "er" (i), "m" (v->counter));
8396+}
8397+
8398+/**
8399+ * atomic64_add_unchecked - add integer to atomic64 variable
8400+ * @i: integer value to add
8401+ * @v: pointer to type atomic64_unchecked_t
8402+ *
8403+ * Atomically adds @i to @v.
8404+ */
8405+static inline void atomic64_add_unchecked(long i, atomic64_unchecked_t *v)
8406+{
8407 asm volatile(LOCK_PREFIX "addq %1,%0"
8408 : "=m" (v->counter)
8409 : "er" (i), "m" (v->counter));
8410@@ -56,7 +102,29 @@ static inline void atomic64_add(long i,
8411 */
8412 static inline void atomic64_sub(long i, atomic64_t *v)
8413 {
8414- asm volatile(LOCK_PREFIX "subq %1,%0"
8415+ asm volatile(LOCK_PREFIX "subq %1,%0\n"
8416+
8417+#ifdef CONFIG_PAX_REFCOUNT
8418+ "jno 0f\n"
8419+ LOCK_PREFIX "addq %1,%0\n"
8420+ "int $4\n0:\n"
8421+ _ASM_EXTABLE(0b, 0b)
8422+#endif
8423+
8424+ : "=m" (v->counter)
8425+ : "er" (i), "m" (v->counter));
8426+}
8427+
8428+/**
8429+ * atomic64_sub_unchecked - subtract the atomic64 variable
8430+ * @i: integer value to subtract
8431+ * @v: pointer to type atomic64_unchecked_t
8432+ *
8433+ * Atomically subtracts @i from @v.
8434+ */
8435+static inline void atomic64_sub_unchecked(long i, atomic64_unchecked_t *v)
8436+{
8437+ asm volatile(LOCK_PREFIX "subq %1,%0\n"
8438 : "=m" (v->counter)
8439 : "er" (i), "m" (v->counter));
8440 }
8441@@ -74,7 +142,16 @@ static inline int atomic64_sub_and_test(
8442 {
8443 unsigned char c;
8444
8445- asm volatile(LOCK_PREFIX "subq %2,%0; sete %1"
8446+ asm volatile(LOCK_PREFIX "subq %2,%0\n"
8447+
8448+#ifdef CONFIG_PAX_REFCOUNT
8449+ "jno 0f\n"
8450+ LOCK_PREFIX "addq %2,%0\n"
8451+ "int $4\n0:\n"
8452+ _ASM_EXTABLE(0b, 0b)
8453+#endif
8454+
8455+ "sete %1\n"
8456 : "=m" (v->counter), "=qm" (c)
8457 : "er" (i), "m" (v->counter) : "memory");
8458 return c;
8459@@ -88,6 +165,27 @@ static inline int atomic64_sub_and_test(
8460 */
8461 static inline void atomic64_inc(atomic64_t *v)
8462 {
8463+ asm volatile(LOCK_PREFIX "incq %0\n"
8464+
8465+#ifdef CONFIG_PAX_REFCOUNT
8466+ "jno 0f\n"
8467+ LOCK_PREFIX "decq %0\n"
8468+ "int $4\n0:\n"
8469+ _ASM_EXTABLE(0b, 0b)
8470+#endif
8471+
8472+ : "=m" (v->counter)
8473+ : "m" (v->counter));
8474+}
8475+
8476+/**
8477+ * atomic64_inc_unchecked - increment atomic64 variable
8478+ * @v: pointer to type atomic64_unchecked_t
8479+ *
8480+ * Atomically increments @v by 1.
8481+ */
8482+static inline void atomic64_inc_unchecked(atomic64_unchecked_t *v)
8483+{
8484 asm volatile(LOCK_PREFIX "incq %0"
8485 : "=m" (v->counter)
8486 : "m" (v->counter));
8487@@ -101,7 +199,28 @@ static inline void atomic64_inc(atomic64
8488 */
8489 static inline void atomic64_dec(atomic64_t *v)
8490 {
8491- asm volatile(LOCK_PREFIX "decq %0"
8492+ asm volatile(LOCK_PREFIX "decq %0\n"
8493+
8494+#ifdef CONFIG_PAX_REFCOUNT
8495+ "jno 0f\n"
8496+ LOCK_PREFIX "incq %0\n"
8497+ "int $4\n0:\n"
8498+ _ASM_EXTABLE(0b, 0b)
8499+#endif
8500+
8501+ : "=m" (v->counter)
8502+ : "m" (v->counter));
8503+}
8504+
8505+/**
8506+ * atomic64_dec_unchecked - decrement atomic64 variable
8507+ * @v: pointer to type atomic64_t
8508+ *
8509+ * Atomically decrements @v by 1.
8510+ */
8511+static inline void atomic64_dec_unchecked(atomic64_unchecked_t *v)
8512+{
8513+ asm volatile(LOCK_PREFIX "decq %0\n"
8514 : "=m" (v->counter)
8515 : "m" (v->counter));
8516 }
8517@@ -118,7 +237,16 @@ static inline int atomic64_dec_and_test(
8518 {
8519 unsigned char c;
8520
8521- asm volatile(LOCK_PREFIX "decq %0; sete %1"
8522+ asm volatile(LOCK_PREFIX "decq %0\n"
8523+
8524+#ifdef CONFIG_PAX_REFCOUNT
8525+ "jno 0f\n"
8526+ LOCK_PREFIX "incq %0\n"
8527+ "int $4\n0:\n"
8528+ _ASM_EXTABLE(0b, 0b)
8529+#endif
8530+
8531+ "sete %1\n"
8532 : "=m" (v->counter), "=qm" (c)
8533 : "m" (v->counter) : "memory");
8534 return c != 0;
8535@@ -136,7 +264,16 @@ static inline int atomic64_inc_and_test(
8536 {
8537 unsigned char c;
8538
8539- asm volatile(LOCK_PREFIX "incq %0; sete %1"
8540+ asm volatile(LOCK_PREFIX "incq %0\n"
8541+
8542+#ifdef CONFIG_PAX_REFCOUNT
8543+ "jno 0f\n"
8544+ LOCK_PREFIX "decq %0\n"
8545+ "int $4\n0:\n"
8546+ _ASM_EXTABLE(0b, 0b)
8547+#endif
8548+
8549+ "sete %1\n"
8550 : "=m" (v->counter), "=qm" (c)
8551 : "m" (v->counter) : "memory");
8552 return c != 0;
8553@@ -155,7 +292,16 @@ static inline int atomic64_add_negative(
8554 {
8555 unsigned char c;
8556
8557- asm volatile(LOCK_PREFIX "addq %2,%0; sets %1"
8558+ asm volatile(LOCK_PREFIX "addq %2,%0\n"
8559+
8560+#ifdef CONFIG_PAX_REFCOUNT
8561+ "jno 0f\n"
8562+ LOCK_PREFIX "subq %2,%0\n"
8563+ "int $4\n0:\n"
8564+ _ASM_EXTABLE(0b, 0b)
8565+#endif
8566+
8567+ "sets %1\n"
8568 : "=m" (v->counter), "=qm" (c)
8569 : "er" (i), "m" (v->counter) : "memory");
8570 return c;
8571@@ -171,7 +317,31 @@ static inline int atomic64_add_negative(
8572 static inline long atomic64_add_return(long i, atomic64_t *v)
8573 {
8574 long __i = i;
8575- asm volatile(LOCK_PREFIX "xaddq %0, %1;"
8576+ asm volatile(LOCK_PREFIX "xaddq %0, %1\n"
8577+
8578+#ifdef CONFIG_PAX_REFCOUNT
8579+ "jno 0f\n"
8580+ "movq %0, %1\n"
8581+ "int $4\n0:\n"
8582+ _ASM_EXTABLE(0b, 0b)
8583+#endif
8584+
8585+ : "+r" (i), "+m" (v->counter)
8586+ : : "memory");
8587+ return i + __i;
8588+}
8589+
8590+/**
8591+ * atomic64_add_return_unchecked - add and return
8592+ * @i: integer value to add
8593+ * @v: pointer to type atomic64_unchecked_t
8594+ *
8595+ * Atomically adds @i to @v and returns @i + @v
8596+ */
8597+static inline long atomic64_add_return_unchecked(long i, atomic64_unchecked_t *v)
8598+{
8599+ long __i = i;
8600+ asm volatile(LOCK_PREFIX "xaddq %0, %1"
8601 : "+r" (i), "+m" (v->counter)
8602 : : "memory");
8603 return i + __i;
8604@@ -183,6 +353,10 @@ static inline long atomic64_sub_return(l
8605 }
8606
8607 #define atomic64_inc_return(v) (atomic64_add_return(1, (v)))
8608+static inline long atomic64_inc_return_unchecked(atomic64_unchecked_t *v)
8609+{
8610+ return atomic64_add_return_unchecked(1, v);
8611+}
8612 #define atomic64_dec_return(v) (atomic64_sub_return(1, (v)))
8613
8614 static inline long atomic64_cmpxchg(atomic64_t *v, long old, long new)
8615@@ -190,6 +364,11 @@ static inline long atomic64_cmpxchg(atom
8616 return cmpxchg(&v->counter, old, new);
8617 }
8618
8619+static inline long atomic64_cmpxchg_unchecked(atomic64_unchecked_t *v, long old, long new)
8620+{
8621+ return cmpxchg(&v->counter, old, new);
8622+}
8623+
8624 static inline long atomic64_xchg(atomic64_t *v, long new)
8625 {
8626 return xchg(&v->counter, new);
8627@@ -206,17 +385,30 @@ static inline long atomic64_xchg(atomic6
8628 */
8629 static inline int atomic64_add_unless(atomic64_t *v, long a, long u)
8630 {
8631- long c, old;
8632+ long c, old, new;
8633 c = atomic64_read(v);
8634 for (;;) {
8635- if (unlikely(c == (u)))
8636+ if (unlikely(c == u))
8637 break;
8638- old = atomic64_cmpxchg((v), c, c + (a));
8639+
8640+ asm volatile("add %2,%0\n"
8641+
8642+#ifdef CONFIG_PAX_REFCOUNT
8643+ "jno 0f\n"
8644+ "sub %2,%0\n"
8645+ "int $4\n0:\n"
8646+ _ASM_EXTABLE(0b, 0b)
8647+#endif
8648+
8649+ : "=r" (new)
8650+ : "0" (c), "ir" (a));
8651+
8652+ old = atomic64_cmpxchg(v, c, new);
8653 if (likely(old == c))
8654 break;
8655 c = old;
8656 }
8657- return c != (u);
8658+ return c != u;
8659 }
8660
8661 #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
8662diff -urNp linux-2.6.39/arch/x86/include/asm/atomic.h linux-2.6.39/arch/x86/include/asm/atomic.h
8663--- linux-2.6.39/arch/x86/include/asm/atomic.h 2011-05-19 00:06:34.000000000 -0400
8664+++ linux-2.6.39/arch/x86/include/asm/atomic.h 2011-05-22 19:36:30.000000000 -0400
8665@@ -22,7 +22,18 @@
8666 */
8667 static inline int atomic_read(const atomic_t *v)
8668 {
8669- return (*(volatile int *)&(v)->counter);
8670+ return (*(volatile const int *)&(v)->counter);
8671+}
8672+
8673+/**
8674+ * atomic_read_unchecked - read atomic variable
8675+ * @v: pointer of type atomic_unchecked_t
8676+ *
8677+ * Atomically reads the value of @v.
8678+ */
8679+static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
8680+{
8681+ return (*(volatile const int *)&(v)->counter);
8682 }
8683
8684 /**
8685@@ -38,6 +49,18 @@ static inline void atomic_set(atomic_t *
8686 }
8687
8688 /**
8689+ * atomic_set_unchecked - set atomic variable
8690+ * @v: pointer of type atomic_unchecked_t
8691+ * @i: required value
8692+ *
8693+ * Atomically sets the value of @v to @i.
8694+ */
8695+static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
8696+{
8697+ v->counter = i;
8698+}
8699+
8700+/**
8701 * atomic_add - add integer to atomic variable
8702 * @i: integer value to add
8703 * @v: pointer of type atomic_t
8704@@ -46,7 +69,29 @@ static inline void atomic_set(atomic_t *
8705 */
8706 static inline void atomic_add(int i, atomic_t *v)
8707 {
8708- asm volatile(LOCK_PREFIX "addl %1,%0"
8709+ asm volatile(LOCK_PREFIX "addl %1,%0\n"
8710+
8711+#ifdef CONFIG_PAX_REFCOUNT
8712+ "jno 0f\n"
8713+ LOCK_PREFIX "subl %1,%0\n"
8714+ "int $4\n0:\n"
8715+ _ASM_EXTABLE(0b, 0b)
8716+#endif
8717+
8718+ : "+m" (v->counter)
8719+ : "ir" (i));
8720+}
8721+
8722+/**
8723+ * atomic_add_unchecked - add integer to atomic variable
8724+ * @i: integer value to add
8725+ * @v: pointer of type atomic_unchecked_t
8726+ *
8727+ * Atomically adds @i to @v.
8728+ */
8729+static inline void atomic_add_unchecked(int i, atomic_unchecked_t *v)
8730+{
8731+ asm volatile(LOCK_PREFIX "addl %1,%0\n"
8732 : "+m" (v->counter)
8733 : "ir" (i));
8734 }
8735@@ -60,7 +105,29 @@ static inline void atomic_add(int i, ato
8736 */
8737 static inline void atomic_sub(int i, atomic_t *v)
8738 {
8739- asm volatile(LOCK_PREFIX "subl %1,%0"
8740+ asm volatile(LOCK_PREFIX "subl %1,%0\n"
8741+
8742+#ifdef CONFIG_PAX_REFCOUNT
8743+ "jno 0f\n"
8744+ LOCK_PREFIX "addl %1,%0\n"
8745+ "int $4\n0:\n"
8746+ _ASM_EXTABLE(0b, 0b)
8747+#endif
8748+
8749+ : "+m" (v->counter)
8750+ : "ir" (i));
8751+}
8752+
8753+/**
8754+ * atomic_sub_unchecked - subtract integer from atomic variable
8755+ * @i: integer value to subtract
8756+ * @v: pointer of type atomic_unchecked_t
8757+ *
8758+ * Atomically subtracts @i from @v.
8759+ */
8760+static inline void atomic_sub_unchecked(int i, atomic_unchecked_t *v)
8761+{
8762+ asm volatile(LOCK_PREFIX "subl %1,%0\n"
8763 : "+m" (v->counter)
8764 : "ir" (i));
8765 }
8766@@ -78,7 +145,16 @@ static inline int atomic_sub_and_test(in
8767 {
8768 unsigned char c;
8769
8770- asm volatile(LOCK_PREFIX "subl %2,%0; sete %1"
8771+ asm volatile(LOCK_PREFIX "subl %2,%0\n"
8772+
8773+#ifdef CONFIG_PAX_REFCOUNT
8774+ "jno 0f\n"
8775+ LOCK_PREFIX "addl %2,%0\n"
8776+ "int $4\n0:\n"
8777+ _ASM_EXTABLE(0b, 0b)
8778+#endif
8779+
8780+ "sete %1\n"
8781 : "+m" (v->counter), "=qm" (c)
8782 : "ir" (i) : "memory");
8783 return c;
8784@@ -92,7 +168,27 @@ static inline int atomic_sub_and_test(in
8785 */
8786 static inline void atomic_inc(atomic_t *v)
8787 {
8788- asm volatile(LOCK_PREFIX "incl %0"
8789+ asm volatile(LOCK_PREFIX "incl %0\n"
8790+
8791+#ifdef CONFIG_PAX_REFCOUNT
8792+ "jno 0f\n"
8793+ LOCK_PREFIX "decl %0\n"
8794+ "int $4\n0:\n"
8795+ _ASM_EXTABLE(0b, 0b)
8796+#endif
8797+
8798+ : "+m" (v->counter));
8799+}
8800+
8801+/**
8802+ * atomic_inc_unchecked - increment atomic variable
8803+ * @v: pointer of type atomic_unchecked_t
8804+ *
8805+ * Atomically increments @v by 1.
8806+ */
8807+static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
8808+{
8809+ asm volatile(LOCK_PREFIX "incl %0\n"
8810 : "+m" (v->counter));
8811 }
8812
8813@@ -104,7 +200,27 @@ static inline void atomic_inc(atomic_t *
8814 */
8815 static inline void atomic_dec(atomic_t *v)
8816 {
8817- asm volatile(LOCK_PREFIX "decl %0"
8818+ asm volatile(LOCK_PREFIX "decl %0\n"
8819+
8820+#ifdef CONFIG_PAX_REFCOUNT
8821+ "jno 0f\n"
8822+ LOCK_PREFIX "incl %0\n"
8823+ "int $4\n0:\n"
8824+ _ASM_EXTABLE(0b, 0b)
8825+#endif
8826+
8827+ : "+m" (v->counter));
8828+}
8829+
8830+/**
8831+ * atomic_dec_unchecked - decrement atomic variable
8832+ * @v: pointer of type atomic_unchecked_t
8833+ *
8834+ * Atomically decrements @v by 1.
8835+ */
8836+static inline void atomic_dec_unchecked(atomic_unchecked_t *v)
8837+{
8838+ asm volatile(LOCK_PREFIX "decl %0\n"
8839 : "+m" (v->counter));
8840 }
8841
8842@@ -120,7 +236,16 @@ static inline int atomic_dec_and_test(at
8843 {
8844 unsigned char c;
8845
8846- asm volatile(LOCK_PREFIX "decl %0; sete %1"
8847+ asm volatile(LOCK_PREFIX "decl %0\n"
8848+
8849+#ifdef CONFIG_PAX_REFCOUNT
8850+ "jno 0f\n"
8851+ LOCK_PREFIX "incl %0\n"
8852+ "int $4\n0:\n"
8853+ _ASM_EXTABLE(0b, 0b)
8854+#endif
8855+
8856+ "sete %1\n"
8857 : "+m" (v->counter), "=qm" (c)
8858 : : "memory");
8859 return c != 0;
8860@@ -138,7 +263,35 @@ static inline int atomic_inc_and_test(at
8861 {
8862 unsigned char c;
8863
8864- asm volatile(LOCK_PREFIX "incl %0; sete %1"
8865+ asm volatile(LOCK_PREFIX "incl %0\n"
8866+
8867+#ifdef CONFIG_PAX_REFCOUNT
8868+ "jno 0f\n"
8869+ LOCK_PREFIX "decl %0\n"
8870+ "int $4\n0:\n"
8871+ _ASM_EXTABLE(0b, 0b)
8872+#endif
8873+
8874+ "sete %1\n"
8875+ : "+m" (v->counter), "=qm" (c)
8876+ : : "memory");
8877+ return c != 0;
8878+}
8879+
8880+/**
8881+ * atomic_inc_and_test_unchecked - increment and test
8882+ * @v: pointer of type atomic_unchecked_t
8883+ *
8884+ * Atomically increments @v by 1
8885+ * and returns true if the result is zero, or false for all
8886+ * other cases.
8887+ */
8888+static inline int atomic_inc_and_test_unchecked(atomic_unchecked_t *v)
8889+{
8890+ unsigned char c;
8891+
8892+ asm volatile(LOCK_PREFIX "incl %0\n"
8893+ "sete %1\n"
8894 : "+m" (v->counter), "=qm" (c)
8895 : : "memory");
8896 return c != 0;
8897@@ -157,7 +310,16 @@ static inline int atomic_add_negative(in
8898 {
8899 unsigned char c;
8900
8901- asm volatile(LOCK_PREFIX "addl %2,%0; sets %1"
8902+ asm volatile(LOCK_PREFIX "addl %2,%0\n"
8903+
8904+#ifdef CONFIG_PAX_REFCOUNT
8905+ "jno 0f\n"
8906+ LOCK_PREFIX "subl %2,%0\n"
8907+ "int $4\n0:\n"
8908+ _ASM_EXTABLE(0b, 0b)
8909+#endif
8910+
8911+ "sets %1\n"
8912 : "+m" (v->counter), "=qm" (c)
8913 : "ir" (i) : "memory");
8914 return c;
8915@@ -180,6 +342,46 @@ static inline int atomic_add_return(int
8916 #endif
8917 /* Modern 486+ processor */
8918 __i = i;
8919+ asm volatile(LOCK_PREFIX "xaddl %0, %1\n"
8920+
8921+#ifdef CONFIG_PAX_REFCOUNT
8922+ "jno 0f\n"
8923+ "movl %0, %1\n"
8924+ "int $4\n0:\n"
8925+ _ASM_EXTABLE(0b, 0b)
8926+#endif
8927+
8928+ : "+r" (i), "+m" (v->counter)
8929+ : : "memory");
8930+ return i + __i;
8931+
8932+#ifdef CONFIG_M386
8933+no_xadd: /* Legacy 386 processor */
8934+ local_irq_save(flags);
8935+ __i = atomic_read(v);
8936+ atomic_set(v, i + __i);
8937+ local_irq_restore(flags);
8938+ return i + __i;
8939+#endif
8940+}
8941+
8942+/**
8943+ * atomic_add_return_unchecked - add integer and return
8944+ * @v: pointer of type atomic_unchecked_t
8945+ * @i: integer value to add
8946+ *
8947+ * Atomically adds @i to @v and returns @i + @v
8948+ */
8949+static inline int atomic_add_return_unchecked(int i, atomic_unchecked_t *v)
8950+{
8951+ int __i;
8952+#ifdef CONFIG_M386
8953+ unsigned long flags;
8954+ if (unlikely(boot_cpu_data.x86 <= 3))
8955+ goto no_xadd;
8956+#endif
8957+ /* Modern 486+ processor */
8958+ __i = i;
8959 asm volatile(LOCK_PREFIX "xaddl %0, %1"
8960 : "+r" (i), "+m" (v->counter)
8961 : : "memory");
8962@@ -208,6 +410,10 @@ static inline int atomic_sub_return(int
8963 }
8964
8965 #define atomic_inc_return(v) (atomic_add_return(1, v))
8966+static inline int atomic_inc_return_unchecked(atomic_unchecked_t *v)
8967+{
8968+ return atomic_add_return_unchecked(1, v);
8969+}
8970 #define atomic_dec_return(v) (atomic_sub_return(1, v))
8971
8972 static inline int atomic_cmpxchg(atomic_t *v, int old, int new)
8973@@ -215,11 +421,21 @@ static inline int atomic_cmpxchg(atomic_
8974 return cmpxchg(&v->counter, old, new);
8975 }
8976
8977+static inline int atomic_cmpxchg_unchecked(atomic_unchecked_t *v, int old, int new)
8978+{
8979+ return cmpxchg(&v->counter, old, new);
8980+}
8981+
8982 static inline int atomic_xchg(atomic_t *v, int new)
8983 {
8984 return xchg(&v->counter, new);
8985 }
8986
8987+static inline int atomic_xchg_unchecked(atomic_unchecked_t *v, int new)
8988+{
8989+ return xchg(&v->counter, new);
8990+}
8991+
8992 /**
8993 * atomic_add_unless - add unless the number is already a given value
8994 * @v: pointer of type atomic_t
8995@@ -231,21 +447,77 @@ static inline int atomic_xchg(atomic_t *
8996 */
8997 static inline int atomic_add_unless(atomic_t *v, int a, int u)
8998 {
8999- int c, old;
9000+ int c, old, new;
9001 c = atomic_read(v);
9002 for (;;) {
9003- if (unlikely(c == (u)))
9004+ if (unlikely(c == u))
9005 break;
9006- old = atomic_cmpxchg((v), c, c + (a));
9007+
9008+ asm volatile("addl %2,%0\n"
9009+
9010+#ifdef CONFIG_PAX_REFCOUNT
9011+ "jno 0f\n"
9012+ "subl %2,%0\n"
9013+ "int $4\n0:\n"
9014+ _ASM_EXTABLE(0b, 0b)
9015+#endif
9016+
9017+ : "=r" (new)
9018+ : "0" (c), "ir" (a));
9019+
9020+ old = atomic_cmpxchg(v, c, new);
9021 if (likely(old == c))
9022 break;
9023 c = old;
9024 }
9025- return c != (u);
9026+ return c != u;
9027 }
9028
9029 #define atomic_inc_not_zero(v) atomic_add_unless((v), 1, 0)
9030
9031+/**
9032+ * atomic_inc_not_zero_hint - increment if not null
9033+ * @v: pointer of type atomic_t
9034+ * @hint: probable value of the atomic before the increment
9035+ *
9036+ * This version of atomic_inc_not_zero() gives a hint of probable
9037+ * value of the atomic. This helps processor to not read the memory
9038+ * before doing the atomic read/modify/write cycle, lowering
9039+ * number of bus transactions on some arches.
9040+ *
9041+ * Returns: 0 if increment was not done, 1 otherwise.
9042+ */
9043+#define atomic_inc_not_zero_hint atomic_inc_not_zero_hint
9044+static inline int atomic_inc_not_zero_hint(atomic_t *v, int hint)
9045+{
9046+ int val, c = hint, new;
9047+
9048+ /* sanity test, should be removed by compiler if hint is a constant */
9049+ if (!hint)
9050+ return atomic_inc_not_zero(v);
9051+
9052+ do {
9053+ asm volatile("incl %0\n"
9054+
9055+#ifdef CONFIG_PAX_REFCOUNT
9056+ "jno 0f\n"
9057+ "decl %0\n"
9058+ "int $4\n0:\n"
9059+ _ASM_EXTABLE(0b, 0b)
9060+#endif
9061+
9062+ : "=r" (new)
9063+ : "0" (c));
9064+
9065+ val = atomic_cmpxchg(v, c, new);
9066+ if (val == c)
9067+ return 1;
9068+ c = val;
9069+ } while (c);
9070+
9071+ return 0;
9072+}
9073+
9074 /*
9075 * atomic_dec_if_positive - decrement by 1 if old value positive
9076 * @v: pointer of type atomic_t
9077diff -urNp linux-2.6.39/arch/x86/include/asm/bitops.h linux-2.6.39/arch/x86/include/asm/bitops.h
9078--- linux-2.6.39/arch/x86/include/asm/bitops.h 2011-05-19 00:06:34.000000000 -0400
9079+++ linux-2.6.39/arch/x86/include/asm/bitops.h 2011-05-22 19:36:30.000000000 -0400
9080@@ -38,7 +38,7 @@
9081 * a mask operation on a byte.
9082 */
9083 #define IS_IMMEDIATE(nr) (__builtin_constant_p(nr))
9084-#define CONST_MASK_ADDR(nr, addr) BITOP_ADDR((void *)(addr) + ((nr)>>3))
9085+#define CONST_MASK_ADDR(nr, addr) BITOP_ADDR((volatile void *)(addr) + ((nr)>>3))
9086 #define CONST_MASK(nr) (1 << ((nr) & 7))
9087
9088 /**
9089diff -urNp linux-2.6.39/arch/x86/include/asm/boot.h linux-2.6.39/arch/x86/include/asm/boot.h
9090--- linux-2.6.39/arch/x86/include/asm/boot.h 2011-05-19 00:06:34.000000000 -0400
9091+++ linux-2.6.39/arch/x86/include/asm/boot.h 2011-05-22 19:36:30.000000000 -0400
9092@@ -11,10 +11,15 @@
9093 #include <asm/pgtable_types.h>
9094
9095 /* Physical address where kernel should be loaded. */
9096-#define LOAD_PHYSICAL_ADDR ((CONFIG_PHYSICAL_START \
9097+#define ____LOAD_PHYSICAL_ADDR ((CONFIG_PHYSICAL_START \
9098 + (CONFIG_PHYSICAL_ALIGN - 1)) \
9099 & ~(CONFIG_PHYSICAL_ALIGN - 1))
9100
9101+#ifndef __ASSEMBLY__
9102+extern unsigned char __LOAD_PHYSICAL_ADDR[];
9103+#define LOAD_PHYSICAL_ADDR ((unsigned long)__LOAD_PHYSICAL_ADDR)
9104+#endif
9105+
9106 /* Minimum kernel alignment, as a power of two */
9107 #ifdef CONFIG_X86_64
9108 #define MIN_KERNEL_ALIGN_LG2 PMD_SHIFT
9109diff -urNp linux-2.6.39/arch/x86/include/asm/cacheflush.h linux-2.6.39/arch/x86/include/asm/cacheflush.h
9110--- linux-2.6.39/arch/x86/include/asm/cacheflush.h 2011-05-19 00:06:34.000000000 -0400
9111+++ linux-2.6.39/arch/x86/include/asm/cacheflush.h 2011-05-22 19:36:30.000000000 -0400
9112@@ -26,7 +26,7 @@ static inline unsigned long get_page_mem
9113 unsigned long pg_flags = pg->flags & _PGMT_MASK;
9114
9115 if (pg_flags == _PGMT_DEFAULT)
9116- return -1;
9117+ return ~0UL;
9118 else if (pg_flags == _PGMT_WC)
9119 return _PAGE_CACHE_WC;
9120 else if (pg_flags == _PGMT_UC_MINUS)
9121diff -urNp linux-2.6.39/arch/x86/include/asm/cache.h linux-2.6.39/arch/x86/include/asm/cache.h
9122--- linux-2.6.39/arch/x86/include/asm/cache.h 2011-05-19 00:06:34.000000000 -0400
9123+++ linux-2.6.39/arch/x86/include/asm/cache.h 2011-05-22 19:36:30.000000000 -0400
9124@@ -5,12 +5,13 @@
9125
9126 /* L1 cache line size */
9127 #define L1_CACHE_SHIFT (CONFIG_X86_L1_CACHE_SHIFT)
9128-#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
9129+#define L1_CACHE_BYTES (_AC(1,U) << L1_CACHE_SHIFT)
9130
9131 #define __read_mostly __attribute__((__section__(".data..read_mostly")))
9132+#define __read_only __attribute__((__section__(".data..read_only")))
9133
9134 #define INTERNODE_CACHE_SHIFT CONFIG_X86_INTERNODE_CACHE_SHIFT
9135-#define INTERNODE_CACHE_BYTES (1 << INTERNODE_CACHE_SHIFT)
9136+#define INTERNODE_CACHE_BYTES (_AC(1,U) << INTERNODE_CACHE_SHIFT)
9137
9138 #ifdef CONFIG_X86_VSMP
9139 #ifdef CONFIG_SMP
9140diff -urNp linux-2.6.39/arch/x86/include/asm/checksum_32.h linux-2.6.39/arch/x86/include/asm/checksum_32.h
9141--- linux-2.6.39/arch/x86/include/asm/checksum_32.h 2011-05-19 00:06:34.000000000 -0400
9142+++ linux-2.6.39/arch/x86/include/asm/checksum_32.h 2011-05-22 19:36:30.000000000 -0400
9143@@ -31,6 +31,14 @@ asmlinkage __wsum csum_partial_copy_gene
9144 int len, __wsum sum,
9145 int *src_err_ptr, int *dst_err_ptr);
9146
9147+asmlinkage __wsum csum_partial_copy_generic_to_user(const void *src, void *dst,
9148+ int len, __wsum sum,
9149+ int *src_err_ptr, int *dst_err_ptr);
9150+
9151+asmlinkage __wsum csum_partial_copy_generic_from_user(const void *src, void *dst,
9152+ int len, __wsum sum,
9153+ int *src_err_ptr, int *dst_err_ptr);
9154+
9155 /*
9156 * Note: when you get a NULL pointer exception here this means someone
9157 * passed in an incorrect kernel address to one of these functions.
9158@@ -50,7 +58,7 @@ static inline __wsum csum_partial_copy_f
9159 int *err_ptr)
9160 {
9161 might_sleep();
9162- return csum_partial_copy_generic((__force void *)src, dst,
9163+ return csum_partial_copy_generic_from_user((__force void *)src, dst,
9164 len, sum, err_ptr, NULL);
9165 }
9166
9167@@ -178,7 +186,7 @@ static inline __wsum csum_and_copy_to_us
9168 {
9169 might_sleep();
9170 if (access_ok(VERIFY_WRITE, dst, len))
9171- return csum_partial_copy_generic(src, (__force void *)dst,
9172+ return csum_partial_copy_generic_to_user(src, (__force void *)dst,
9173 len, sum, NULL, err_ptr);
9174
9175 if (len)
9176diff -urNp linux-2.6.39/arch/x86/include/asm/cpufeature.h linux-2.6.39/arch/x86/include/asm/cpufeature.h
9177--- linux-2.6.39/arch/x86/include/asm/cpufeature.h 2011-05-19 00:06:34.000000000 -0400
9178+++ linux-2.6.39/arch/x86/include/asm/cpufeature.h 2011-05-22 19:36:30.000000000 -0400
9179@@ -351,7 +351,7 @@ static __always_inline __pure bool __sta
9180 ".section .discard,\"aw\",@progbits\n"
9181 " .byte 0xff + (4f-3f) - (2b-1b)\n" /* size check */
9182 ".previous\n"
9183- ".section .altinstr_replacement,\"ax\"\n"
9184+ ".section .altinstr_replacement,\"a\"\n"
9185 "3: movb $1,%0\n"
9186 "4:\n"
9187 ".previous\n"
9188diff -urNp linux-2.6.39/arch/x86/include/asm/desc_defs.h linux-2.6.39/arch/x86/include/asm/desc_defs.h
9189--- linux-2.6.39/arch/x86/include/asm/desc_defs.h 2011-05-19 00:06:34.000000000 -0400
9190+++ linux-2.6.39/arch/x86/include/asm/desc_defs.h 2011-05-22 19:36:30.000000000 -0400
9191@@ -31,6 +31,12 @@ struct desc_struct {
9192 unsigned base1: 8, type: 4, s: 1, dpl: 2, p: 1;
9193 unsigned limit: 4, avl: 1, l: 1, d: 1, g: 1, base2: 8;
9194 };
9195+ struct {
9196+ u16 offset_low;
9197+ u16 seg;
9198+ unsigned reserved: 8, type: 4, s: 1, dpl: 2, p: 1;
9199+ unsigned offset_high: 16;
9200+ } gate;
9201 };
9202 } __attribute__((packed));
9203
9204diff -urNp linux-2.6.39/arch/x86/include/asm/desc.h linux-2.6.39/arch/x86/include/asm/desc.h
9205--- linux-2.6.39/arch/x86/include/asm/desc.h 2011-05-19 00:06:34.000000000 -0400
9206+++ linux-2.6.39/arch/x86/include/asm/desc.h 2011-05-22 19:36:30.000000000 -0400
9207@@ -4,6 +4,7 @@
9208 #include <asm/desc_defs.h>
9209 #include <asm/ldt.h>
9210 #include <asm/mmu.h>
9211+#include <asm/pgtable.h>
9212 #include <linux/smp.h>
9213
9214 static inline void fill_ldt(struct desc_struct *desc,
9215@@ -15,6 +16,7 @@ static inline void fill_ldt(struct desc_
9216 desc->base1 = (info->base_addr & 0x00ff0000) >> 16;
9217 desc->type = (info->read_exec_only ^ 1) << 1;
9218 desc->type |= info->contents << 2;
9219+ desc->type |= info->seg_not_present ^ 1;
9220 desc->s = 1;
9221 desc->dpl = 0x3;
9222 desc->p = info->seg_not_present ^ 1;
9223@@ -31,16 +33,12 @@ static inline void fill_ldt(struct desc_
9224 }
9225
9226 extern struct desc_ptr idt_descr;
9227-extern gate_desc idt_table[];
9228-
9229-struct gdt_page {
9230- struct desc_struct gdt[GDT_ENTRIES];
9231-} __attribute__((aligned(PAGE_SIZE)));
9232-DECLARE_PER_CPU_PAGE_ALIGNED(struct gdt_page, gdt_page);
9233+extern gate_desc idt_table[256];
9234
9235+extern struct desc_struct cpu_gdt_table[NR_CPUS][PAGE_SIZE / sizeof(struct desc_struct)];
9236 static inline struct desc_struct *get_cpu_gdt_table(unsigned int cpu)
9237 {
9238- return per_cpu(gdt_page, cpu).gdt;
9239+ return cpu_gdt_table[cpu];
9240 }
9241
9242 #ifdef CONFIG_X86_64
9243@@ -65,9 +63,14 @@ static inline void pack_gate(gate_desc *
9244 unsigned long base, unsigned dpl, unsigned flags,
9245 unsigned short seg)
9246 {
9247- gate->a = (seg << 16) | (base & 0xffff);
9248- gate->b = (base & 0xffff0000) |
9249- (((0x80 | type | (dpl << 5)) & 0xff) << 8);
9250+ gate->gate.offset_low = base;
9251+ gate->gate.seg = seg;
9252+ gate->gate.reserved = 0;
9253+ gate->gate.type = type;
9254+ gate->gate.s = 0;
9255+ gate->gate.dpl = dpl;
9256+ gate->gate.p = 1;
9257+ gate->gate.offset_high = base >> 16;
9258 }
9259
9260 #endif
9261@@ -115,13 +118,17 @@ static inline void paravirt_free_ldt(str
9262 static inline void native_write_idt_entry(gate_desc *idt, int entry,
9263 const gate_desc *gate)
9264 {
9265+ pax_open_kernel();
9266 memcpy(&idt[entry], gate, sizeof(*gate));
9267+ pax_close_kernel();
9268 }
9269
9270 static inline void native_write_ldt_entry(struct desc_struct *ldt, int entry,
9271 const void *desc)
9272 {
9273+ pax_open_kernel();
9274 memcpy(&ldt[entry], desc, 8);
9275+ pax_close_kernel();
9276 }
9277
9278 static inline void native_write_gdt_entry(struct desc_struct *gdt, int entry,
9279@@ -139,7 +146,10 @@ static inline void native_write_gdt_entr
9280 size = sizeof(struct desc_struct);
9281 break;
9282 }
9283+
9284+ pax_open_kernel();
9285 memcpy(&gdt[entry], desc, size);
9286+ pax_close_kernel();
9287 }
9288
9289 static inline void pack_descriptor(struct desc_struct *desc, unsigned long base,
9290@@ -211,7 +221,9 @@ static inline void native_set_ldt(const
9291
9292 static inline void native_load_tr_desc(void)
9293 {
9294+ pax_open_kernel();
9295 asm volatile("ltr %w0"::"q" (GDT_ENTRY_TSS*8));
9296+ pax_close_kernel();
9297 }
9298
9299 static inline void native_load_gdt(const struct desc_ptr *dtr)
9300@@ -246,8 +258,10 @@ static inline void native_load_tls(struc
9301 unsigned int i;
9302 struct desc_struct *gdt = get_cpu_gdt_table(cpu);
9303
9304+ pax_open_kernel();
9305 for (i = 0; i < GDT_ENTRY_TLS_ENTRIES; i++)
9306 gdt[GDT_ENTRY_TLS_MIN + i] = t->tls_array[i];
9307+ pax_close_kernel();
9308 }
9309
9310 #define _LDT_empty(info) \
9311@@ -309,7 +323,7 @@ static inline void set_desc_limit(struct
9312 desc->limit = (limit >> 16) & 0xf;
9313 }
9314
9315-static inline void _set_gate(int gate, unsigned type, void *addr,
9316+static inline void _set_gate(int gate, unsigned type, const void *addr,
9317 unsigned dpl, unsigned ist, unsigned seg)
9318 {
9319 gate_desc s;
9320@@ -327,7 +341,7 @@ static inline void _set_gate(int gate, u
9321 * Pentium F0 0F bugfix can have resulted in the mapped
9322 * IDT being write-protected.
9323 */
9324-static inline void set_intr_gate(unsigned int n, void *addr)
9325+static inline void set_intr_gate(unsigned int n, const void *addr)
9326 {
9327 BUG_ON((unsigned)n > 0xFF);
9328 _set_gate(n, GATE_INTERRUPT, addr, 0, 0, __KERNEL_CS);
9329@@ -356,19 +370,19 @@ static inline void alloc_intr_gate(unsig
9330 /*
9331 * This routine sets up an interrupt gate at directory privilege level 3.
9332 */
9333-static inline void set_system_intr_gate(unsigned int n, void *addr)
9334+static inline void set_system_intr_gate(unsigned int n, const void *addr)
9335 {
9336 BUG_ON((unsigned)n > 0xFF);
9337 _set_gate(n, GATE_INTERRUPT, addr, 0x3, 0, __KERNEL_CS);
9338 }
9339
9340-static inline void set_system_trap_gate(unsigned int n, void *addr)
9341+static inline void set_system_trap_gate(unsigned int n, const void *addr)
9342 {
9343 BUG_ON((unsigned)n > 0xFF);
9344 _set_gate(n, GATE_TRAP, addr, 0x3, 0, __KERNEL_CS);
9345 }
9346
9347-static inline void set_trap_gate(unsigned int n, void *addr)
9348+static inline void set_trap_gate(unsigned int n, const void *addr)
9349 {
9350 BUG_ON((unsigned)n > 0xFF);
9351 _set_gate(n, GATE_TRAP, addr, 0, 0, __KERNEL_CS);
9352@@ -377,19 +391,31 @@ static inline void set_trap_gate(unsigne
9353 static inline void set_task_gate(unsigned int n, unsigned int gdt_entry)
9354 {
9355 BUG_ON((unsigned)n > 0xFF);
9356- _set_gate(n, GATE_TASK, (void *)0, 0, 0, (gdt_entry<<3));
9357+ _set_gate(n, GATE_TASK, (const void *)0, 0, 0, (gdt_entry<<3));
9358 }
9359
9360-static inline void set_intr_gate_ist(int n, void *addr, unsigned ist)
9361+static inline void set_intr_gate_ist(int n, const void *addr, unsigned ist)
9362 {
9363 BUG_ON((unsigned)n > 0xFF);
9364 _set_gate(n, GATE_INTERRUPT, addr, 0, ist, __KERNEL_CS);
9365 }
9366
9367-static inline void set_system_intr_gate_ist(int n, void *addr, unsigned ist)
9368+static inline void set_system_intr_gate_ist(int n, const void *addr, unsigned ist)
9369 {
9370 BUG_ON((unsigned)n > 0xFF);
9371 _set_gate(n, GATE_INTERRUPT, addr, 0x3, ist, __KERNEL_CS);
9372 }
9373
9374+#ifdef CONFIG_X86_32
9375+static inline void set_user_cs(unsigned long base, unsigned long limit, int cpu)
9376+{
9377+ struct desc_struct d;
9378+
9379+ if (likely(limit))
9380+ limit = (limit - 1UL) >> PAGE_SHIFT;
9381+ pack_descriptor(&d, base, limit, 0xFB, 0xC);
9382+ write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_DEFAULT_USER_CS, &d, DESCTYPE_S);
9383+}
9384+#endif
9385+
9386 #endif /* _ASM_X86_DESC_H */
9387diff -urNp linux-2.6.39/arch/x86/include/asm/device.h linux-2.6.39/arch/x86/include/asm/device.h
9388--- linux-2.6.39/arch/x86/include/asm/device.h 2011-05-19 00:06:34.000000000 -0400
9389+++ linux-2.6.39/arch/x86/include/asm/device.h 2011-05-22 19:36:30.000000000 -0400
9390@@ -6,7 +6,7 @@ struct dev_archdata {
9391 void *acpi_handle;
9392 #endif
9393 #ifdef CONFIG_X86_64
9394-struct dma_map_ops *dma_ops;
9395+ const struct dma_map_ops *dma_ops;
9396 #endif
9397 #if defined(CONFIG_DMAR) || defined(CONFIG_AMD_IOMMU)
9398 void *iommu; /* hook for IOMMU specific extension */
9399diff -urNp linux-2.6.39/arch/x86/include/asm/dma-mapping.h linux-2.6.39/arch/x86/include/asm/dma-mapping.h
9400--- linux-2.6.39/arch/x86/include/asm/dma-mapping.h 2011-05-19 00:06:34.000000000 -0400
9401+++ linux-2.6.39/arch/x86/include/asm/dma-mapping.h 2011-05-22 19:36:30.000000000 -0400
9402@@ -26,9 +26,9 @@ extern int iommu_merge;
9403 extern struct device x86_dma_fallback_dev;
9404 extern int panic_on_overflow;
9405
9406-extern struct dma_map_ops *dma_ops;
9407+extern const struct dma_map_ops *dma_ops;
9408
9409-static inline struct dma_map_ops *get_dma_ops(struct device *dev)
9410+static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
9411 {
9412 #ifdef CONFIG_X86_32
9413 return dma_ops;
9414@@ -45,7 +45,7 @@ static inline struct dma_map_ops *get_dm
9415 /* Make sure we keep the same behaviour */
9416 static inline int dma_mapping_error(struct device *dev, dma_addr_t dma_addr)
9417 {
9418- struct dma_map_ops *ops = get_dma_ops(dev);
9419+ const struct dma_map_ops *ops = get_dma_ops(dev);
9420 if (ops->mapping_error)
9421 return ops->mapping_error(dev, dma_addr);
9422
9423@@ -115,7 +115,7 @@ static inline void *
9424 dma_alloc_coherent(struct device *dev, size_t size, dma_addr_t *dma_handle,
9425 gfp_t gfp)
9426 {
9427- struct dma_map_ops *ops = get_dma_ops(dev);
9428+ const struct dma_map_ops *ops = get_dma_ops(dev);
9429 void *memory;
9430
9431 gfp &= ~(__GFP_DMA | __GFP_HIGHMEM | __GFP_DMA32);
9432@@ -142,7 +142,7 @@ dma_alloc_coherent(struct device *dev, s
9433 static inline void dma_free_coherent(struct device *dev, size_t size,
9434 void *vaddr, dma_addr_t bus)
9435 {
9436- struct dma_map_ops *ops = get_dma_ops(dev);
9437+ const struct dma_map_ops *ops = get_dma_ops(dev);
9438
9439 WARN_ON(irqs_disabled()); /* for portability */
9440
9441diff -urNp linux-2.6.39/arch/x86/include/asm/e820.h linux-2.6.39/arch/x86/include/asm/e820.h
9442--- linux-2.6.39/arch/x86/include/asm/e820.h 2011-05-19 00:06:34.000000000 -0400
9443+++ linux-2.6.39/arch/x86/include/asm/e820.h 2011-05-22 19:36:30.000000000 -0400
9444@@ -69,7 +69,7 @@ struct e820map {
9445 #define ISA_START_ADDRESS 0xa0000
9446 #define ISA_END_ADDRESS 0x100000
9447
9448-#define BIOS_BEGIN 0x000a0000
9449+#define BIOS_BEGIN 0x000c0000
9450 #define BIOS_END 0x00100000
9451
9452 #define BIOS_ROM_BASE 0xffe00000
9453diff -urNp linux-2.6.39/arch/x86/include/asm/elf.h linux-2.6.39/arch/x86/include/asm/elf.h
9454--- linux-2.6.39/arch/x86/include/asm/elf.h 2011-05-19 00:06:34.000000000 -0400
9455+++ linux-2.6.39/arch/x86/include/asm/elf.h 2011-05-22 19:36:30.000000000 -0400
9456@@ -237,7 +237,25 @@ extern int force_personality32;
9457 the loader. We need to make sure that it is out of the way of the program
9458 that it will "exec", and that there is sufficient room for the brk. */
9459
9460+#ifdef CONFIG_PAX_SEGMEXEC
9461+#define ELF_ET_DYN_BASE ((current->mm->pax_flags & MF_PAX_SEGMEXEC) ? SEGMEXEC_TASK_SIZE/3*2 : TASK_SIZE/3*2)
9462+#else
9463 #define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
9464+#endif
9465+
9466+#ifdef CONFIG_PAX_ASLR
9467+#ifdef CONFIG_X86_32
9468+#define PAX_ELF_ET_DYN_BASE 0x10000000UL
9469+
9470+#define PAX_DELTA_MMAP_LEN (current->mm->pax_flags & MF_PAX_SEGMEXEC ? 15 : 16)
9471+#define PAX_DELTA_STACK_LEN (current->mm->pax_flags & MF_PAX_SEGMEXEC ? 15 : 16)
9472+#else
9473+#define PAX_ELF_ET_DYN_BASE 0x400000UL
9474+
9475+#define PAX_DELTA_MMAP_LEN ((test_thread_flag(TIF_IA32)) ? 16 : TASK_SIZE_MAX_SHIFT - PAGE_SHIFT - 3)
9476+#define PAX_DELTA_STACK_LEN ((test_thread_flag(TIF_IA32)) ? 16 : TASK_SIZE_MAX_SHIFT - PAGE_SHIFT - 3)
9477+#endif
9478+#endif
9479
9480 /* This yields a mask that user programs can use to figure out what
9481 instruction set this CPU supports. This could be done in user space,
9482@@ -291,8 +309,7 @@ do { \
9483 #define ARCH_DLINFO \
9484 do { \
9485 if (vdso_enabled) \
9486- NEW_AUX_ENT(AT_SYSINFO_EHDR, \
9487- (unsigned long)current->mm->context.vdso); \
9488+ NEW_AUX_ENT(AT_SYSINFO_EHDR, current->mm->context.vdso);\
9489 } while (0)
9490
9491 #define AT_SYSINFO 32
9492@@ -303,7 +320,7 @@ do { \
9493
9494 #endif /* !CONFIG_X86_32 */
9495
9496-#define VDSO_CURRENT_BASE ((unsigned long)current->mm->context.vdso)
9497+#define VDSO_CURRENT_BASE (current->mm->context.vdso)
9498
9499 #define VDSO_ENTRY \
9500 ((unsigned long)VDSO32_SYMBOL(VDSO_CURRENT_BASE, vsyscall))
9501@@ -317,7 +334,4 @@ extern int arch_setup_additional_pages(s
9502 extern int syscall32_setup_pages(struct linux_binprm *, int exstack);
9503 #define compat_arch_setup_additional_pages syscall32_setup_pages
9504
9505-extern unsigned long arch_randomize_brk(struct mm_struct *mm);
9506-#define arch_randomize_brk arch_randomize_brk
9507-
9508 #endif /* _ASM_X86_ELF_H */
9509diff -urNp linux-2.6.39/arch/x86/include/asm/emergency-restart.h linux-2.6.39/arch/x86/include/asm/emergency-restart.h
9510--- linux-2.6.39/arch/x86/include/asm/emergency-restart.h 2011-05-19 00:06:34.000000000 -0400
9511+++ linux-2.6.39/arch/x86/include/asm/emergency-restart.h 2011-05-22 19:36:30.000000000 -0400
9512@@ -15,6 +15,6 @@ enum reboot_type {
9513
9514 extern enum reboot_type reboot_type;
9515
9516-extern void machine_emergency_restart(void);
9517+extern void machine_emergency_restart(void) __noreturn;
9518
9519 #endif /* _ASM_X86_EMERGENCY_RESTART_H */
9520diff -urNp linux-2.6.39/arch/x86/include/asm/futex.h linux-2.6.39/arch/x86/include/asm/futex.h
9521--- linux-2.6.39/arch/x86/include/asm/futex.h 2011-05-19 00:06:34.000000000 -0400
9522+++ linux-2.6.39/arch/x86/include/asm/futex.h 2011-05-22 19:36:30.000000000 -0400
9523@@ -12,16 +12,18 @@
9524 #include <asm/system.h>
9525
9526 #define __futex_atomic_op1(insn, ret, oldval, uaddr, oparg) \
9527+ typecheck(u32 *, uaddr); \
9528 asm volatile("1:\t" insn "\n" \
9529 "2:\t.section .fixup,\"ax\"\n" \
9530 "3:\tmov\t%3, %1\n" \
9531 "\tjmp\t2b\n" \
9532 "\t.previous\n" \
9533 _ASM_EXTABLE(1b, 3b) \
9534- : "=r" (oldval), "=r" (ret), "+m" (*uaddr) \
9535+ : "=r" (oldval), "=r" (ret), "+m" (*(u32 *)____m(uaddr))\
9536 : "i" (-EFAULT), "0" (oparg), "1" (0))
9537
9538 #define __futex_atomic_op2(insn, ret, oldval, uaddr, oparg) \
9539+ typecheck(u32 *, uaddr); \
9540 asm volatile("1:\tmovl %2, %0\n" \
9541 "\tmovl\t%0, %3\n" \
9542 "\t" insn "\n" \
9543@@ -34,7 +36,7 @@
9544 _ASM_EXTABLE(1b, 4b) \
9545 _ASM_EXTABLE(2b, 4b) \
9546 : "=&a" (oldval), "=&r" (ret), \
9547- "+m" (*uaddr), "=&r" (tem) \
9548+ "+m" (*(u32 *)____m(uaddr)), "=&r" (tem) \
9549 : "r" (oparg), "i" (-EFAULT), "1" (0))
9550
9551 static inline int futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr)
9552@@ -61,10 +63,10 @@ static inline int futex_atomic_op_inuser
9553
9554 switch (op) {
9555 case FUTEX_OP_SET:
9556- __futex_atomic_op1("xchgl %0, %2", ret, oldval, uaddr, oparg);
9557+ __futex_atomic_op1(__copyuser_seg"xchgl %0, %2", ret, oldval, uaddr, oparg);
9558 break;
9559 case FUTEX_OP_ADD:
9560- __futex_atomic_op1(LOCK_PREFIX "xaddl %0, %2", ret, oldval,
9561+ __futex_atomic_op1(LOCK_PREFIX __copyuser_seg"xaddl %0, %2", ret, oldval,
9562 uaddr, oparg);
9563 break;
9564 case FUTEX_OP_OR:
9565@@ -123,13 +125,13 @@ static inline int futex_atomic_cmpxchg_i
9566 if (!access_ok(VERIFY_WRITE, uaddr, sizeof(u32)))
9567 return -EFAULT;
9568
9569- asm volatile("1:\t" LOCK_PREFIX "cmpxchgl %4, %2\n"
9570+ asm volatile("1:\t" LOCK_PREFIX __copyuser_seg"cmpxchgl %4, %2\n"
9571 "2:\t.section .fixup, \"ax\"\n"
9572 "3:\tmov %3, %0\n"
9573 "\tjmp 2b\n"
9574 "\t.previous\n"
9575 _ASM_EXTABLE(1b, 3b)
9576- : "+r" (ret), "=a" (oldval), "+m" (*uaddr)
9577+ : "+r" (ret), "=a" (oldval), "+m" (*(u32 *)____m(uaddr))
9578 : "i" (-EFAULT), "r" (newval), "1" (oldval)
9579 : "memory"
9580 );
9581diff -urNp linux-2.6.39/arch/x86/include/asm/hw_irq.h linux-2.6.39/arch/x86/include/asm/hw_irq.h
9582--- linux-2.6.39/arch/x86/include/asm/hw_irq.h 2011-05-19 00:06:34.000000000 -0400
9583+++ linux-2.6.39/arch/x86/include/asm/hw_irq.h 2011-05-22 19:36:30.000000000 -0400
9584@@ -137,8 +137,8 @@ extern void setup_ioapic_dest(void);
9585 extern void enable_IO_APIC(void);
9586
9587 /* Statistics */
9588-extern atomic_t irq_err_count;
9589-extern atomic_t irq_mis_count;
9590+extern atomic_unchecked_t irq_err_count;
9591+extern atomic_unchecked_t irq_mis_count;
9592
9593 /* EISA */
9594 extern void eisa_set_level_irq(unsigned int irq);
9595diff -urNp linux-2.6.39/arch/x86/include/asm/i387.h linux-2.6.39/arch/x86/include/asm/i387.h
9596--- linux-2.6.39/arch/x86/include/asm/i387.h 2011-05-19 00:06:34.000000000 -0400
9597+++ linux-2.6.39/arch/x86/include/asm/i387.h 2011-05-22 19:36:30.000000000 -0400
9598@@ -92,6 +92,11 @@ static inline int fxrstor_checking(struc
9599 {
9600 int err;
9601
9602+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
9603+ if ((unsigned long)fx < PAX_USER_SHADOW_BASE)
9604+ fx = (struct i387_fxsave_struct *)((void *)fx + PAX_USER_SHADOW_BASE);
9605+#endif
9606+
9607 /* See comment in fxsave() below. */
9608 #ifdef CONFIG_AS_FXSAVEQ
9609 asm volatile("1: fxrstorq %[fx]\n\t"
9610@@ -121,6 +126,11 @@ static inline int fxsave_user(struct i38
9611 {
9612 int err;
9613
9614+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
9615+ if ((unsigned long)fx < PAX_USER_SHADOW_BASE)
9616+ fx = (struct i387_fxsave_struct __user *)((void __user *)fx + PAX_USER_SHADOW_BASE);
9617+#endif
9618+
9619 /*
9620 * Clear the bytes not touched by the fxsave and reserved
9621 * for the SW usage.
9622@@ -213,13 +223,8 @@ static inline void fpu_fxsave(struct fpu
9623 #endif /* CONFIG_X86_64 */
9624
9625 /* We need a safe address that is cheap to find and that is already
9626- in L1 during context switch. The best choices are unfortunately
9627- different for UP and SMP */
9628-#ifdef CONFIG_SMP
9629-#define safe_address (__per_cpu_offset[0])
9630-#else
9631-#define safe_address (kstat_cpu(0).cpustat.user)
9632-#endif
9633+ in L1 during context switch. */
9634+#define safe_address (init_tss[smp_processor_id()].x86_tss.sp0)
9635
9636 /*
9637 * These must be called with preempt disabled
9638@@ -312,7 +317,7 @@ static inline void kernel_fpu_begin(void
9639 struct thread_info *me = current_thread_info();
9640 preempt_disable();
9641 if (me->status & TS_USEDFPU)
9642- __save_init_fpu(me->task);
9643+ __save_init_fpu(current);
9644 else
9645 clts();
9646 }
9647diff -urNp linux-2.6.39/arch/x86/include/asm/io.h linux-2.6.39/arch/x86/include/asm/io.h
9648--- linux-2.6.39/arch/x86/include/asm/io.h 2011-05-19 00:06:34.000000000 -0400
9649+++ linux-2.6.39/arch/x86/include/asm/io.h 2011-05-22 19:36:30.000000000 -0400
9650@@ -216,6 +216,17 @@ extern void set_iounmap_nonlazy(void);
9651
9652 #include <linux/vmalloc.h>
9653
9654+#define ARCH_HAS_VALID_PHYS_ADDR_RANGE
9655+static inline int valid_phys_addr_range(unsigned long addr, size_t count)
9656+{
9657+ return ((addr + count + PAGE_SIZE - 1) >> PAGE_SHIFT) < (1ULL << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0;
9658+}
9659+
9660+static inline int valid_mmap_phys_addr_range(unsigned long pfn, size_t count)
9661+{
9662+ return (pfn + (count >> PAGE_SHIFT)) < (1ULL << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0;
9663+}
9664+
9665 /*
9666 * Convert a virtual cached pointer to an uncached pointer
9667 */
9668diff -urNp linux-2.6.39/arch/x86/include/asm/iommu.h linux-2.6.39/arch/x86/include/asm/iommu.h
9669--- linux-2.6.39/arch/x86/include/asm/iommu.h 2011-05-19 00:06:34.000000000 -0400
9670+++ linux-2.6.39/arch/x86/include/asm/iommu.h 2011-05-22 19:36:30.000000000 -0400
9671@@ -1,7 +1,7 @@
9672 #ifndef _ASM_X86_IOMMU_H
9673 #define _ASM_X86_IOMMU_H
9674
9675-extern struct dma_map_ops nommu_dma_ops;
9676+extern const struct dma_map_ops nommu_dma_ops;
9677 extern int force_iommu, no_iommu;
9678 extern int iommu_detected;
9679 extern int iommu_pass_through;
9680diff -urNp linux-2.6.39/arch/x86/include/asm/irqflags.h linux-2.6.39/arch/x86/include/asm/irqflags.h
9681--- linux-2.6.39/arch/x86/include/asm/irqflags.h 2011-05-19 00:06:34.000000000 -0400
9682+++ linux-2.6.39/arch/x86/include/asm/irqflags.h 2011-05-22 19:36:30.000000000 -0400
9683@@ -140,6 +140,11 @@ static inline unsigned long arch_local_i
9684 sti; \
9685 sysexit
9686
9687+#define GET_CR0_INTO_RDI mov %cr0, %rdi
9688+#define SET_RDI_INTO_CR0 mov %rdi, %cr0
9689+#define GET_CR3_INTO_RDI mov %cr3, %rdi
9690+#define SET_RDI_INTO_CR3 mov %rdi, %cr3
9691+
9692 #else
9693 #define INTERRUPT_RETURN iret
9694 #define ENABLE_INTERRUPTS_SYSEXIT sti; sysexit
9695diff -urNp linux-2.6.39/arch/x86/include/asm/kprobes.h linux-2.6.39/arch/x86/include/asm/kprobes.h
9696--- linux-2.6.39/arch/x86/include/asm/kprobes.h 2011-05-19 00:06:34.000000000 -0400
9697+++ linux-2.6.39/arch/x86/include/asm/kprobes.h 2011-05-22 19:36:30.000000000 -0400
9698@@ -37,13 +37,8 @@ typedef u8 kprobe_opcode_t;
9699 #define RELATIVEJUMP_SIZE 5
9700 #define RELATIVECALL_OPCODE 0xe8
9701 #define RELATIVE_ADDR_SIZE 4
9702-#define MAX_STACK_SIZE 64
9703-#define MIN_STACK_SIZE(ADDR) \
9704- (((MAX_STACK_SIZE) < (((unsigned long)current_thread_info()) + \
9705- THREAD_SIZE - (unsigned long)(ADDR))) \
9706- ? (MAX_STACK_SIZE) \
9707- : (((unsigned long)current_thread_info()) + \
9708- THREAD_SIZE - (unsigned long)(ADDR)))
9709+#define MAX_STACK_SIZE 64UL
9710+#define MIN_STACK_SIZE(ADDR) min(MAX_STACK_SIZE, current->thread.sp0 - (unsigned long)(ADDR))
9711
9712 #define flush_insn_slot(p) do { } while (0)
9713
9714diff -urNp linux-2.6.39/arch/x86/include/asm/kvm_host.h linux-2.6.39/arch/x86/include/asm/kvm_host.h
9715--- linux-2.6.39/arch/x86/include/asm/kvm_host.h 2011-05-19 00:06:34.000000000 -0400
9716+++ linux-2.6.39/arch/x86/include/asm/kvm_host.h 2011-05-22 19:36:30.000000000 -0400
9717@@ -419,7 +419,7 @@ struct kvm_arch {
9718 unsigned int n_used_mmu_pages;
9719 unsigned int n_requested_mmu_pages;
9720 unsigned int n_max_mmu_pages;
9721- atomic_t invlpg_counter;
9722+ atomic_unchecked_t invlpg_counter;
9723 struct hlist_head mmu_page_hash[KVM_NUM_MMU_PAGES];
9724 /*
9725 * Hash table of struct kvm_mmu_page.
9726@@ -599,7 +599,7 @@ struct kvm_arch_async_pf {
9727 bool direct_map;
9728 };
9729
9730-extern struct kvm_x86_ops *kvm_x86_ops;
9731+extern const struct kvm_x86_ops *kvm_x86_ops;
9732
9733 int kvm_mmu_module_init(void);
9734 void kvm_mmu_module_exit(void);
9735diff -urNp linux-2.6.39/arch/x86/include/asm/local.h linux-2.6.39/arch/x86/include/asm/local.h
9736--- linux-2.6.39/arch/x86/include/asm/local.h 2011-05-19 00:06:34.000000000 -0400
9737+++ linux-2.6.39/arch/x86/include/asm/local.h 2011-05-22 19:36:30.000000000 -0400
9738@@ -18,26 +18,58 @@ typedef struct {
9739
9740 static inline void local_inc(local_t *l)
9741 {
9742- asm volatile(_ASM_INC "%0"
9743+ asm volatile(_ASM_INC "%0\n"
9744+
9745+#ifdef CONFIG_PAX_REFCOUNT
9746+ "jno 0f\n"
9747+ _ASM_DEC "%0\n"
9748+ "int $4\n0:\n"
9749+ _ASM_EXTABLE(0b, 0b)
9750+#endif
9751+
9752 : "+m" (l->a.counter));
9753 }
9754
9755 static inline void local_dec(local_t *l)
9756 {
9757- asm volatile(_ASM_DEC "%0"
9758+ asm volatile(_ASM_DEC "%0\n"
9759+
9760+#ifdef CONFIG_PAX_REFCOUNT
9761+ "jno 0f\n"
9762+ _ASM_INC "%0\n"
9763+ "int $4\n0:\n"
9764+ _ASM_EXTABLE(0b, 0b)
9765+#endif
9766+
9767 : "+m" (l->a.counter));
9768 }
9769
9770 static inline void local_add(long i, local_t *l)
9771 {
9772- asm volatile(_ASM_ADD "%1,%0"
9773+ asm volatile(_ASM_ADD "%1,%0\n"
9774+
9775+#ifdef CONFIG_PAX_REFCOUNT
9776+ "jno 0f\n"
9777+ _ASM_SUB "%1,%0\n"
9778+ "int $4\n0:\n"
9779+ _ASM_EXTABLE(0b, 0b)
9780+#endif
9781+
9782 : "+m" (l->a.counter)
9783 : "ir" (i));
9784 }
9785
9786 static inline void local_sub(long i, local_t *l)
9787 {
9788- asm volatile(_ASM_SUB "%1,%0"
9789+ asm volatile(_ASM_SUB "%1,%0\n"
9790+
9791+#ifdef CONFIG_PAX_REFCOUNT
9792+ "jno 0f\n"
9793+ _ASM_ADD "%1,%0\n"
9794+ "int $4\n0:\n"
9795+ _ASM_EXTABLE(0b, 0b)
9796+#endif
9797+
9798 : "+m" (l->a.counter)
9799 : "ir" (i));
9800 }
9801@@ -55,7 +87,16 @@ static inline int local_sub_and_test(lon
9802 {
9803 unsigned char c;
9804
9805- asm volatile(_ASM_SUB "%2,%0; sete %1"
9806+ asm volatile(_ASM_SUB "%2,%0\n"
9807+
9808+#ifdef CONFIG_PAX_REFCOUNT
9809+ "jno 0f\n"
9810+ _ASM_ADD "%2,%0\n"
9811+ "int $4\n0:\n"
9812+ _ASM_EXTABLE(0b, 0b)
9813+#endif
9814+
9815+ "sete %1\n"
9816 : "+m" (l->a.counter), "=qm" (c)
9817 : "ir" (i) : "memory");
9818 return c;
9819@@ -73,7 +114,16 @@ static inline int local_dec_and_test(loc
9820 {
9821 unsigned char c;
9822
9823- asm volatile(_ASM_DEC "%0; sete %1"
9824+ asm volatile(_ASM_DEC "%0\n"
9825+
9826+#ifdef CONFIG_PAX_REFCOUNT
9827+ "jno 0f\n"
9828+ _ASM_INC "%0\n"
9829+ "int $4\n0:\n"
9830+ _ASM_EXTABLE(0b, 0b)
9831+#endif
9832+
9833+ "sete %1\n"
9834 : "+m" (l->a.counter), "=qm" (c)
9835 : : "memory");
9836 return c != 0;
9837@@ -91,7 +141,16 @@ static inline int local_inc_and_test(loc
9838 {
9839 unsigned char c;
9840
9841- asm volatile(_ASM_INC "%0; sete %1"
9842+ asm volatile(_ASM_INC "%0\n"
9843+
9844+#ifdef CONFIG_PAX_REFCOUNT
9845+ "jno 0f\n"
9846+ _ASM_DEC "%0\n"
9847+ "int $4\n0:\n"
9848+ _ASM_EXTABLE(0b, 0b)
9849+#endif
9850+
9851+ "sete %1\n"
9852 : "+m" (l->a.counter), "=qm" (c)
9853 : : "memory");
9854 return c != 0;
9855@@ -110,7 +169,16 @@ static inline int local_add_negative(lon
9856 {
9857 unsigned char c;
9858
9859- asm volatile(_ASM_ADD "%2,%0; sets %1"
9860+ asm volatile(_ASM_ADD "%2,%0\n"
9861+
9862+#ifdef CONFIG_PAX_REFCOUNT
9863+ "jno 0f\n"
9864+ _ASM_SUB "%2,%0\n"
9865+ "int $4\n0:\n"
9866+ _ASM_EXTABLE(0b, 0b)
9867+#endif
9868+
9869+ "sets %1\n"
9870 : "+m" (l->a.counter), "=qm" (c)
9871 : "ir" (i) : "memory");
9872 return c;
9873@@ -133,7 +201,15 @@ static inline long local_add_return(long
9874 #endif
9875 /* Modern 486+ processor */
9876 __i = i;
9877- asm volatile(_ASM_XADD "%0, %1;"
9878+ asm volatile(_ASM_XADD "%0, %1\n"
9879+
9880+#ifdef CONFIG_PAX_REFCOUNT
9881+ "jno 0f\n"
9882+ _ASM_MOV "%0,%1\n"
9883+ "int $4\n0:\n"
9884+ _ASM_EXTABLE(0b, 0b)
9885+#endif
9886+
9887 : "+r" (i), "+m" (l->a.counter)
9888 : : "memory");
9889 return i + __i;
9890diff -urNp linux-2.6.39/arch/x86/include/asm/mce.h linux-2.6.39/arch/x86/include/asm/mce.h
9891--- linux-2.6.39/arch/x86/include/asm/mce.h 2011-05-19 00:06:34.000000000 -0400
9892+++ linux-2.6.39/arch/x86/include/asm/mce.h 2011-05-22 19:36:30.000000000 -0400
9893@@ -198,7 +198,7 @@ int mce_notify_irq(void);
9894 void mce_notify_process(void);
9895
9896 DECLARE_PER_CPU(struct mce, injectm);
9897-extern struct file_operations mce_chrdev_ops;
9898+extern struct file_operations mce_chrdev_ops; /* cannot be const, see arch/x86/kernel/cpu/mcheck/mce. */
9899
9900 /*
9901 * Exception handler
9902diff -urNp linux-2.6.39/arch/x86/include/asm/microcode.h linux-2.6.39/arch/x86/include/asm/microcode.h
9903--- linux-2.6.39/arch/x86/include/asm/microcode.h 2011-05-19 00:06:34.000000000 -0400
9904+++ linux-2.6.39/arch/x86/include/asm/microcode.h 2011-05-22 19:36:30.000000000 -0400
9905@@ -12,13 +12,13 @@ struct device;
9906 enum ucode_state { UCODE_ERROR, UCODE_OK, UCODE_NFOUND };
9907
9908 struct microcode_ops {
9909- enum ucode_state (*request_microcode_user) (int cpu,
9910+ enum ucode_state (* const request_microcode_user) (int cpu,
9911 const void __user *buf, size_t size);
9912
9913- enum ucode_state (*request_microcode_fw) (int cpu,
9914+ enum ucode_state (* const request_microcode_fw) (int cpu,
9915 struct device *device);
9916
9917- void (*microcode_fini_cpu) (int cpu);
9918+ void (* const microcode_fini_cpu) (int cpu);
9919
9920 /*
9921 * The generic 'microcode_core' part guarantees that
9922@@ -38,16 +38,16 @@ struct ucode_cpu_info {
9923 extern struct ucode_cpu_info ucode_cpu_info[];
9924
9925 #ifdef CONFIG_MICROCODE_INTEL
9926-extern struct microcode_ops * __init init_intel_microcode(void);
9927+extern const struct microcode_ops * __init init_intel_microcode(void);
9928 #else
9929-static inline struct microcode_ops * __init init_intel_microcode(void)
9930+static inline const struct microcode_ops * __init init_intel_microcode(void)
9931 {
9932 return NULL;
9933 }
9934 #endif /* CONFIG_MICROCODE_INTEL */
9935
9936 #ifdef CONFIG_MICROCODE_AMD
9937-extern struct microcode_ops * __init init_amd_microcode(void);
9938+extern const struct microcode_ops * __init init_amd_microcode(void);
9939
9940 static inline void get_ucode_data(void *to, const u8 *from, size_t n)
9941 {
9942@@ -55,7 +55,7 @@ static inline void get_ucode_data(void *
9943 }
9944
9945 #else
9946-static inline struct microcode_ops * __init init_amd_microcode(void)
9947+static inline const struct microcode_ops * __init init_amd_microcode(void)
9948 {
9949 return NULL;
9950 }
9951diff -urNp linux-2.6.39/arch/x86/include/asm/mman.h linux-2.6.39/arch/x86/include/asm/mman.h
9952--- linux-2.6.39/arch/x86/include/asm/mman.h 2011-05-19 00:06:34.000000000 -0400
9953+++ linux-2.6.39/arch/x86/include/asm/mman.h 2011-05-22 19:36:30.000000000 -0400
9954@@ -5,4 +5,14 @@
9955
9956 #include <asm-generic/mman.h>
9957
9958+#ifdef __KERNEL__
9959+#ifndef __ASSEMBLY__
9960+#ifdef CONFIG_X86_32
9961+#define arch_mmap_check i386_mmap_check
9962+int i386_mmap_check(unsigned long addr, unsigned long len,
9963+ unsigned long flags);
9964+#endif
9965+#endif
9966+#endif
9967+
9968 #endif /* _ASM_X86_MMAN_H */
9969diff -urNp linux-2.6.39/arch/x86/include/asm/mmu_context.h linux-2.6.39/arch/x86/include/asm/mmu_context.h
9970--- linux-2.6.39/arch/x86/include/asm/mmu_context.h 2011-05-19 00:06:34.000000000 -0400
9971+++ linux-2.6.39/arch/x86/include/asm/mmu_context.h 2011-05-22 19:36:30.000000000 -0400
9972@@ -24,6 +24,21 @@ void destroy_context(struct mm_struct *m
9973
9974 static inline void enter_lazy_tlb(struct mm_struct *mm, struct task_struct *tsk)
9975 {
9976+
9977+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
9978+ unsigned int i;
9979+ pgd_t *pgd;
9980+
9981+ pax_open_kernel();
9982+ pgd = get_cpu_pgd(smp_processor_id());
9983+ for (i = USER_PGD_PTRS; i < 2 * USER_PGD_PTRS; ++i)
9984+ if (paravirt_enabled())
9985+ set_pgd(pgd+i, native_make_pgd(0));
9986+ else
9987+ pgd[i] = native_make_pgd(0);
9988+ pax_close_kernel();
9989+#endif
9990+
9991 #ifdef CONFIG_SMP
9992 if (percpu_read(cpu_tlbstate.state) == TLBSTATE_OK)
9993 percpu_write(cpu_tlbstate.state, TLBSTATE_LAZY);
9994@@ -34,16 +49,30 @@ static inline void switch_mm(struct mm_s
9995 struct task_struct *tsk)
9996 {
9997 unsigned cpu = smp_processor_id();
9998+#if defined(CONFIG_X86_32) && defined(CONFIG_SMP)
9999+ int tlbstate = TLBSTATE_OK;
10000+#endif
10001
10002 if (likely(prev != next)) {
10003 #ifdef CONFIG_SMP
10004+#ifdef CONFIG_X86_32
10005+ tlbstate = percpu_read(cpu_tlbstate.state);
10006+#endif
10007 percpu_write(cpu_tlbstate.state, TLBSTATE_OK);
10008 percpu_write(cpu_tlbstate.active_mm, next);
10009 #endif
10010 cpumask_set_cpu(cpu, mm_cpumask(next));
10011
10012 /* Re-load page tables */
10013+#ifdef CONFIG_PAX_PER_CPU_PGD
10014+ pax_open_kernel();
10015+ __clone_user_pgds(get_cpu_pgd(cpu), next->pgd, USER_PGD_PTRS);
10016+ __shadow_user_pgds(get_cpu_pgd(cpu) + USER_PGD_PTRS, next->pgd, USER_PGD_PTRS);
10017+ pax_close_kernel();
10018+ load_cr3(get_cpu_pgd(cpu));
10019+#else
10020 load_cr3(next->pgd);
10021+#endif
10022
10023 /* stop flush ipis for the previous mm */
10024 cpumask_clear_cpu(cpu, mm_cpumask(prev));
10025@@ -53,9 +82,38 @@ static inline void switch_mm(struct mm_s
10026 */
10027 if (unlikely(prev->context.ldt != next->context.ldt))
10028 load_LDT_nolock(&next->context);
10029- }
10030+
10031+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
10032+ if (!(__supported_pte_mask & _PAGE_NX)) {
10033+ smp_mb__before_clear_bit();
10034+ cpu_clear(cpu, prev->context.cpu_user_cs_mask);
10035+ smp_mb__after_clear_bit();
10036+ cpu_set(cpu, next->context.cpu_user_cs_mask);
10037+ }
10038+#endif
10039+
10040+#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
10041+ if (unlikely(prev->context.user_cs_base != next->context.user_cs_base ||
10042+ prev->context.user_cs_limit != next->context.user_cs_limit))
10043+ set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
10044 #ifdef CONFIG_SMP
10045+ else if (unlikely(tlbstate != TLBSTATE_OK))
10046+ set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
10047+#endif
10048+#endif
10049+
10050+ }
10051 else {
10052+
10053+#ifdef CONFIG_PAX_PER_CPU_PGD
10054+ pax_open_kernel();
10055+ __clone_user_pgds(get_cpu_pgd(cpu), next->pgd, USER_PGD_PTRS);
10056+ __shadow_user_pgds(get_cpu_pgd(cpu) + USER_PGD_PTRS, next->pgd, USER_PGD_PTRS);
10057+ pax_close_kernel();
10058+ load_cr3(get_cpu_pgd(cpu));
10059+#endif
10060+
10061+#ifdef CONFIG_SMP
10062 percpu_write(cpu_tlbstate.state, TLBSTATE_OK);
10063 BUG_ON(percpu_read(cpu_tlbstate.active_mm) != next);
10064
10065@@ -64,11 +122,28 @@ static inline void switch_mm(struct mm_s
10066 * tlb flush IPI delivery. We must reload CR3
10067 * to make sure to use no freed page tables.
10068 */
10069+
10070+#ifndef CONFIG_PAX_PER_CPU_PGD
10071 load_cr3(next->pgd);
10072+#endif
10073+
10074 load_LDT_nolock(&next->context);
10075+
10076+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
10077+ if (!(__supported_pte_mask & _PAGE_NX))
10078+ cpu_set(cpu, next->context.cpu_user_cs_mask);
10079+#endif
10080+
10081+#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
10082+#ifdef CONFIG_PAX_PAGEEXEC
10083+ if (!((next->pax_flags & MF_PAX_PAGEEXEC) && (__supported_pte_mask & _PAGE_NX)))
10084+#endif
10085+ set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
10086+#endif
10087+
10088 }
10089- }
10090 #endif
10091+ }
10092 }
10093
10094 #define activate_mm(prev, next) \
10095diff -urNp linux-2.6.39/arch/x86/include/asm/mmu.h linux-2.6.39/arch/x86/include/asm/mmu.h
10096--- linux-2.6.39/arch/x86/include/asm/mmu.h 2011-05-19 00:06:34.000000000 -0400
10097+++ linux-2.6.39/arch/x86/include/asm/mmu.h 2011-05-22 19:36:30.000000000 -0400
10098@@ -9,10 +9,22 @@
10099 * we put the segment information here.
10100 */
10101 typedef struct {
10102- void *ldt;
10103+ struct desc_struct *ldt;
10104 int size;
10105 struct mutex lock;
10106- void *vdso;
10107+ unsigned long vdso;
10108+
10109+#ifdef CONFIG_X86_32
10110+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
10111+ unsigned long user_cs_base;
10112+ unsigned long user_cs_limit;
10113+
10114+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
10115+ cpumask_t cpu_user_cs_mask;
10116+#endif
10117+
10118+#endif
10119+#endif
10120
10121 #ifdef CONFIG_X86_64
10122 /* True if mm supports a task running in 32 bit compatibility mode. */
10123diff -urNp linux-2.6.39/arch/x86/include/asm/module.h linux-2.6.39/arch/x86/include/asm/module.h
10124--- linux-2.6.39/arch/x86/include/asm/module.h 2011-05-19 00:06:34.000000000 -0400
10125+++ linux-2.6.39/arch/x86/include/asm/module.h 2011-05-22 19:41:32.000000000 -0400
10126@@ -5,6 +5,7 @@
10127
10128 #ifdef CONFIG_X86_64
10129 /* X86_64 does not define MODULE_PROC_FAMILY */
10130+#define MODULE_PROC_FAMILY ""
10131 #elif defined CONFIG_M386
10132 #define MODULE_PROC_FAMILY "386 "
10133 #elif defined CONFIG_M486
10134@@ -59,8 +60,30 @@
10135 #error unknown processor family
10136 #endif
10137
10138-#ifdef CONFIG_X86_32
10139-# define MODULE_ARCH_VERMAGIC MODULE_PROC_FAMILY
10140+#ifdef CONFIG_PAX_MEMORY_UDEREF
10141+#define MODULE_PAX_UDEREF "UDEREF "
10142+#else
10143+#define MODULE_PAX_UDEREF ""
10144+#endif
10145+
10146+#ifdef CONFIG_PAX_KERNEXEC
10147+#define MODULE_PAX_KERNEXEC "KERNEXEC "
10148+#else
10149+#define MODULE_PAX_KERNEXEC ""
10150 #endif
10151
10152+#ifdef CONFIG_PAX_REFCOUNT
10153+#define MODULE_PAX_REFCOUNT "REFCOUNT "
10154+#else
10155+#define MODULE_PAX_REFCOUNT ""
10156+#endif
10157+
10158+#ifdef CONFIG_GRKERNSEC
10159+#define MODULE_GRSEC "GRSECURITY "
10160+#else
10161+#define MODULE_GRSEC ""
10162+#endif
10163+
10164+#define MODULE_ARCH_VERMAGIC MODULE_PROC_FAMILY MODULE_GRSEC MODULE_PAX_KERNEXEC MODULE_PAX_UDEREF MODULE_PAX_REFCOUNT
10165+
10166 #endif /* _ASM_X86_MODULE_H */
10167diff -urNp linux-2.6.39/arch/x86/include/asm/page_64_types.h linux-2.6.39/arch/x86/include/asm/page_64_types.h
10168--- linux-2.6.39/arch/x86/include/asm/page_64_types.h 2011-05-19 00:06:34.000000000 -0400
10169+++ linux-2.6.39/arch/x86/include/asm/page_64_types.h 2011-05-22 19:36:30.000000000 -0400
10170@@ -56,7 +56,7 @@ void copy_page(void *to, void *from);
10171
10172 /* duplicated to the one in bootmem.h */
10173 extern unsigned long max_pfn;
10174-extern unsigned long phys_base;
10175+extern const unsigned long phys_base;
10176
10177 extern unsigned long __phys_addr(unsigned long);
10178 #define __phys_reloc_hide(x) (x)
10179diff -urNp linux-2.6.39/arch/x86/include/asm/paravirt.h linux-2.6.39/arch/x86/include/asm/paravirt.h
10180--- linux-2.6.39/arch/x86/include/asm/paravirt.h 2011-05-19 00:06:34.000000000 -0400
10181+++ linux-2.6.39/arch/x86/include/asm/paravirt.h 2011-05-22 19:36:30.000000000 -0400
10182@@ -739,6 +739,21 @@ static inline void __set_fixmap(unsigned
10183 pv_mmu_ops.set_fixmap(idx, phys, flags);
10184 }
10185
10186+#ifdef CONFIG_PAX_KERNEXEC
10187+static inline unsigned long pax_open_kernel(void)
10188+{
10189+ return PVOP_CALL0(unsigned long, pv_mmu_ops.pax_open_kernel);
10190+}
10191+
10192+static inline unsigned long pax_close_kernel(void)
10193+{
10194+ return PVOP_CALL0(unsigned long, pv_mmu_ops.pax_close_kernel);
10195+}
10196+#else
10197+static inline unsigned long pax_open_kernel(void) { return 0; }
10198+static inline unsigned long pax_close_kernel(void) { return 0; }
10199+#endif
10200+
10201 #if defined(CONFIG_SMP) && defined(CONFIG_PARAVIRT_SPINLOCKS)
10202
10203 static inline int arch_spin_is_locked(struct arch_spinlock *lock)
10204@@ -955,7 +970,7 @@ extern void default_banner(void);
10205
10206 #define PARA_PATCH(struct, off) ((PARAVIRT_PATCH_##struct + (off)) / 4)
10207 #define PARA_SITE(ptype, clobbers, ops) _PVSITE(ptype, clobbers, ops, .long, 4)
10208-#define PARA_INDIRECT(addr) *%cs:addr
10209+#define PARA_INDIRECT(addr) *%ss:addr
10210 #endif
10211
10212 #define INTERRUPT_RETURN \
10213@@ -1032,6 +1047,21 @@ extern void default_banner(void);
10214 PARA_SITE(PARA_PATCH(pv_cpu_ops, PV_CPU_irq_enable_sysexit), \
10215 CLBR_NONE, \
10216 jmp PARA_INDIRECT(pv_cpu_ops+PV_CPU_irq_enable_sysexit))
10217+
10218+#define GET_CR0_INTO_RDI \
10219+ call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0); \
10220+ mov %rax,%rdi
10221+
10222+#define SET_RDI_INTO_CR0 \
10223+ call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0)
10224+
10225+#define GET_CR3_INTO_RDI \
10226+ call PARA_INDIRECT(pv_mmu_ops+PV_MMU_read_cr3); \
10227+ mov %rax,%rdi
10228+
10229+#define SET_RDI_INTO_CR3 \
10230+ call PARA_INDIRECT(pv_mmu_ops+PV_MMU_write_cr3)
10231+
10232 #endif /* CONFIG_X86_32 */
10233
10234 #endif /* __ASSEMBLY__ */
10235diff -urNp linux-2.6.39/arch/x86/include/asm/paravirt_types.h linux-2.6.39/arch/x86/include/asm/paravirt_types.h
10236--- linux-2.6.39/arch/x86/include/asm/paravirt_types.h 2011-05-19 00:06:34.000000000 -0400
10237+++ linux-2.6.39/arch/x86/include/asm/paravirt_types.h 2011-05-22 19:36:30.000000000 -0400
10238@@ -317,6 +317,12 @@ struct pv_mmu_ops {
10239 an mfn. We can tell which is which from the index. */
10240 void (*set_fixmap)(unsigned /* enum fixed_addresses */ idx,
10241 phys_addr_t phys, pgprot_t flags);
10242+
10243+#ifdef CONFIG_PAX_KERNEXEC
10244+ unsigned long (*pax_open_kernel)(void);
10245+ unsigned long (*pax_close_kernel)(void);
10246+#endif
10247+
10248 };
10249
10250 struct arch_spinlock;
10251diff -urNp linux-2.6.39/arch/x86/include/asm/pci_x86.h linux-2.6.39/arch/x86/include/asm/pci_x86.h
10252--- linux-2.6.39/arch/x86/include/asm/pci_x86.h 2011-05-19 00:06:34.000000000 -0400
10253+++ linux-2.6.39/arch/x86/include/asm/pci_x86.h 2011-05-22 19:36:30.000000000 -0400
10254@@ -93,16 +93,16 @@ extern int (*pcibios_enable_irq)(struct
10255 extern void (*pcibios_disable_irq)(struct pci_dev *dev);
10256
10257 struct pci_raw_ops {
10258- int (*read)(unsigned int domain, unsigned int bus, unsigned int devfn,
10259+ int (* const read)(unsigned int domain, unsigned int bus, unsigned int devfn,
10260 int reg, int len, u32 *val);
10261- int (*write)(unsigned int domain, unsigned int bus, unsigned int devfn,
10262+ int (* const write)(unsigned int domain, unsigned int bus, unsigned int devfn,
10263 int reg, int len, u32 val);
10264 };
10265
10266-extern struct pci_raw_ops *raw_pci_ops;
10267-extern struct pci_raw_ops *raw_pci_ext_ops;
10268+extern const struct pci_raw_ops *raw_pci_ops;
10269+extern const struct pci_raw_ops *raw_pci_ext_ops;
10270
10271-extern struct pci_raw_ops pci_direct_conf1;
10272+extern const struct pci_raw_ops pci_direct_conf1;
10273 extern bool port_cf9_safe;
10274
10275 /* arch_initcall level */
10276diff -urNp linux-2.6.39/arch/x86/include/asm/pgalloc.h linux-2.6.39/arch/x86/include/asm/pgalloc.h
10277--- linux-2.6.39/arch/x86/include/asm/pgalloc.h 2011-05-19 00:06:34.000000000 -0400
10278+++ linux-2.6.39/arch/x86/include/asm/pgalloc.h 2011-05-22 19:36:30.000000000 -0400
10279@@ -63,6 +63,13 @@ static inline void pmd_populate_kernel(s
10280 pmd_t *pmd, pte_t *pte)
10281 {
10282 paravirt_alloc_pte(mm, __pa(pte) >> PAGE_SHIFT);
10283+ set_pmd(pmd, __pmd(__pa(pte) | _KERNPG_TABLE));
10284+}
10285+
10286+static inline void pmd_populate_user(struct mm_struct *mm,
10287+ pmd_t *pmd, pte_t *pte)
10288+{
10289+ paravirt_alloc_pte(mm, __pa(pte) >> PAGE_SHIFT);
10290 set_pmd(pmd, __pmd(__pa(pte) | _PAGE_TABLE));
10291 }
10292
10293diff -urNp linux-2.6.39/arch/x86/include/asm/pgtable-2level.h linux-2.6.39/arch/x86/include/asm/pgtable-2level.h
10294--- linux-2.6.39/arch/x86/include/asm/pgtable-2level.h 2011-05-19 00:06:34.000000000 -0400
10295+++ linux-2.6.39/arch/x86/include/asm/pgtable-2level.h 2011-05-22 19:36:30.000000000 -0400
10296@@ -18,7 +18,9 @@ static inline void native_set_pte(pte_t
10297
10298 static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
10299 {
10300+ pax_open_kernel();
10301 *pmdp = pmd;
10302+ pax_close_kernel();
10303 }
10304
10305 static inline void native_set_pte_atomic(pte_t *ptep, pte_t pte)
10306diff -urNp linux-2.6.39/arch/x86/include/asm/pgtable_32.h linux-2.6.39/arch/x86/include/asm/pgtable_32.h
10307--- linux-2.6.39/arch/x86/include/asm/pgtable_32.h 2011-05-19 00:06:34.000000000 -0400
10308+++ linux-2.6.39/arch/x86/include/asm/pgtable_32.h 2011-05-22 19:36:30.000000000 -0400
10309@@ -25,9 +25,6 @@
10310 struct mm_struct;
10311 struct vm_area_struct;
10312
10313-extern pgd_t swapper_pg_dir[1024];
10314-extern pgd_t initial_page_table[1024];
10315-
10316 static inline void pgtable_cache_init(void) { }
10317 static inline void check_pgt_cache(void) { }
10318 void paging_init(void);
10319@@ -48,6 +45,12 @@ extern void set_pmd_pfn(unsigned long, u
10320 # include <asm/pgtable-2level.h>
10321 #endif
10322
10323+extern pgd_t swapper_pg_dir[PTRS_PER_PGD];
10324+extern pgd_t initial_page_table[PTRS_PER_PGD];
10325+#ifdef CONFIG_X86_PAE
10326+extern pmd_t swapper_pm_dir[PTRS_PER_PGD][PTRS_PER_PMD];
10327+#endif
10328+
10329 #if defined(CONFIG_HIGHPTE)
10330 #define pte_offset_map(dir, address) \
10331 ((pte_t *)kmap_atomic(pmd_page(*(dir))) + \
10332@@ -62,7 +65,9 @@ extern void set_pmd_pfn(unsigned long, u
10333 /* Clear a kernel PTE and flush it from the TLB */
10334 #define kpte_clear_flush(ptep, vaddr) \
10335 do { \
10336+ pax_open_kernel(); \
10337 pte_clear(&init_mm, (vaddr), (ptep)); \
10338+ pax_close_kernel(); \
10339 __flush_tlb_one((vaddr)); \
10340 } while (0)
10341
10342@@ -74,6 +79,9 @@ do { \
10343
10344 #endif /* !__ASSEMBLY__ */
10345
10346+#define HAVE_ARCH_UNMAPPED_AREA
10347+#define HAVE_ARCH_UNMAPPED_AREA_TOPDOWN
10348+
10349 /*
10350 * kern_addr_valid() is (1) for FLATMEM and (0) for
10351 * SPARSEMEM and DISCONTIGMEM
10352diff -urNp linux-2.6.39/arch/x86/include/asm/pgtable_32_types.h linux-2.6.39/arch/x86/include/asm/pgtable_32_types.h
10353--- linux-2.6.39/arch/x86/include/asm/pgtable_32_types.h 2011-05-19 00:06:34.000000000 -0400
10354+++ linux-2.6.39/arch/x86/include/asm/pgtable_32_types.h 2011-05-22 19:36:30.000000000 -0400
10355@@ -8,7 +8,7 @@
10356 */
10357 #ifdef CONFIG_X86_PAE
10358 # include <asm/pgtable-3level_types.h>
10359-# define PMD_SIZE (1UL << PMD_SHIFT)
10360+# define PMD_SIZE (_AC(1, UL) << PMD_SHIFT)
10361 # define PMD_MASK (~(PMD_SIZE - 1))
10362 #else
10363 # include <asm/pgtable-2level_types.h>
10364@@ -46,6 +46,19 @@ extern bool __vmalloc_start_set; /* set
10365 # define VMALLOC_END (FIXADDR_START - 2 * PAGE_SIZE)
10366 #endif
10367
10368+#ifdef CONFIG_PAX_KERNEXEC
10369+#ifndef __ASSEMBLY__
10370+extern unsigned char MODULES_EXEC_VADDR[];
10371+extern unsigned char MODULES_EXEC_END[];
10372+#endif
10373+#include <asm/boot.h>
10374+#define ktla_ktva(addr) (addr + LOAD_PHYSICAL_ADDR + PAGE_OFFSET)
10375+#define ktva_ktla(addr) (addr - LOAD_PHYSICAL_ADDR - PAGE_OFFSET)
10376+#else
10377+#define ktla_ktva(addr) (addr)
10378+#define ktva_ktla(addr) (addr)
10379+#endif
10380+
10381 #define MODULES_VADDR VMALLOC_START
10382 #define MODULES_END VMALLOC_END
10383 #define MODULES_LEN (MODULES_VADDR - MODULES_END)
10384diff -urNp linux-2.6.39/arch/x86/include/asm/pgtable-3level.h linux-2.6.39/arch/x86/include/asm/pgtable-3level.h
10385--- linux-2.6.39/arch/x86/include/asm/pgtable-3level.h 2011-05-19 00:06:34.000000000 -0400
10386+++ linux-2.6.39/arch/x86/include/asm/pgtable-3level.h 2011-05-22 19:36:30.000000000 -0400
10387@@ -38,12 +38,16 @@ static inline void native_set_pte_atomic
10388
10389 static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
10390 {
10391+ pax_open_kernel();
10392 set_64bit((unsigned long long *)(pmdp), native_pmd_val(pmd));
10393+ pax_close_kernel();
10394 }
10395
10396 static inline void native_set_pud(pud_t *pudp, pud_t pud)
10397 {
10398+ pax_open_kernel();
10399 set_64bit((unsigned long long *)(pudp), native_pud_val(pud));
10400+ pax_close_kernel();
10401 }
10402
10403 /*
10404diff -urNp linux-2.6.39/arch/x86/include/asm/pgtable_64.h linux-2.6.39/arch/x86/include/asm/pgtable_64.h
10405--- linux-2.6.39/arch/x86/include/asm/pgtable_64.h 2011-05-19 00:06:34.000000000 -0400
10406+++ linux-2.6.39/arch/x86/include/asm/pgtable_64.h 2011-05-22 19:36:30.000000000 -0400
10407@@ -16,10 +16,13 @@
10408
10409 extern pud_t level3_kernel_pgt[512];
10410 extern pud_t level3_ident_pgt[512];
10411+extern pud_t level3_vmalloc_pgt[512];
10412+extern pud_t level3_vmemmap_pgt[512];
10413+extern pud_t level2_vmemmap_pgt[512];
10414 extern pmd_t level2_kernel_pgt[512];
10415 extern pmd_t level2_fixmap_pgt[512];
10416-extern pmd_t level2_ident_pgt[512];
10417-extern pgd_t init_level4_pgt[];
10418+extern pmd_t level2_ident_pgt[512*2];
10419+extern pgd_t init_level4_pgt[512];
10420
10421 #define swapper_pg_dir init_level4_pgt
10422
10423@@ -61,7 +64,9 @@ static inline void native_set_pte_atomic
10424
10425 static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
10426 {
10427+ pax_open_kernel();
10428 *pmdp = pmd;
10429+ pax_close_kernel();
10430 }
10431
10432 static inline void native_pmd_clear(pmd_t *pmd)
10433@@ -107,7 +112,9 @@ static inline void native_pud_clear(pud_
10434
10435 static inline void native_set_pgd(pgd_t *pgdp, pgd_t pgd)
10436 {
10437+ pax_open_kernel();
10438 *pgdp = pgd;
10439+ pax_close_kernel();
10440 }
10441
10442 static inline void native_pgd_clear(pgd_t *pgd)
10443diff -urNp linux-2.6.39/arch/x86/include/asm/pgtable_64_types.h linux-2.6.39/arch/x86/include/asm/pgtable_64_types.h
10444--- linux-2.6.39/arch/x86/include/asm/pgtable_64_types.h 2011-05-19 00:06:34.000000000 -0400
10445+++ linux-2.6.39/arch/x86/include/asm/pgtable_64_types.h 2011-05-22 19:36:30.000000000 -0400
10446@@ -59,5 +59,10 @@ typedef struct { pteval_t pte; } pte_t;
10447 #define MODULES_VADDR _AC(0xffffffffa0000000, UL)
10448 #define MODULES_END _AC(0xffffffffff000000, UL)
10449 #define MODULES_LEN (MODULES_END - MODULES_VADDR)
10450+#define MODULES_EXEC_VADDR MODULES_VADDR
10451+#define MODULES_EXEC_END MODULES_END
10452+
10453+#define ktla_ktva(addr) (addr)
10454+#define ktva_ktla(addr) (addr)
10455
10456 #endif /* _ASM_X86_PGTABLE_64_DEFS_H */
10457diff -urNp linux-2.6.39/arch/x86/include/asm/pgtable.h linux-2.6.39/arch/x86/include/asm/pgtable.h
10458--- linux-2.6.39/arch/x86/include/asm/pgtable.h 2011-05-19 00:06:34.000000000 -0400
10459+++ linux-2.6.39/arch/x86/include/asm/pgtable.h 2011-05-22 19:36:30.000000000 -0400
10460@@ -81,12 +81,51 @@ extern struct mm_struct *pgd_page_get_mm
10461
10462 #define arch_end_context_switch(prev) do {} while(0)
10463
10464+#define pax_open_kernel() native_pax_open_kernel()
10465+#define pax_close_kernel() native_pax_close_kernel()
10466 #endif /* CONFIG_PARAVIRT */
10467
10468+#define __HAVE_ARCH_PAX_OPEN_KERNEL
10469+#define __HAVE_ARCH_PAX_CLOSE_KERNEL
10470+
10471+#ifdef CONFIG_PAX_KERNEXEC
10472+static inline unsigned long native_pax_open_kernel(void)
10473+{
10474+ unsigned long cr0;
10475+
10476+ preempt_disable();
10477+ barrier();
10478+ cr0 = read_cr0() ^ X86_CR0_WP;
10479+ BUG_ON(unlikely(cr0 & X86_CR0_WP));
10480+ write_cr0(cr0);
10481+ return cr0 ^ X86_CR0_WP;
10482+}
10483+
10484+static inline unsigned long native_pax_close_kernel(void)
10485+{
10486+ unsigned long cr0;
10487+
10488+ cr0 = read_cr0() ^ X86_CR0_WP;
10489+ BUG_ON(unlikely(!(cr0 & X86_CR0_WP)));
10490+ write_cr0(cr0);
10491+ barrier();
10492+ preempt_enable_no_resched();
10493+ return cr0 ^ X86_CR0_WP;
10494+}
10495+#else
10496+static inline unsigned long native_pax_open_kernel(void) { return 0; }
10497+static inline unsigned long native_pax_close_kernel(void) { return 0; }
10498+#endif
10499+
10500 /*
10501 * The following only work if pte_present() is true.
10502 * Undefined behaviour if not..
10503 */
10504+static inline int pte_user(pte_t pte)
10505+{
10506+ return pte_val(pte) & _PAGE_USER;
10507+}
10508+
10509 static inline int pte_dirty(pte_t pte)
10510 {
10511 return pte_flags(pte) & _PAGE_DIRTY;
10512@@ -196,9 +235,29 @@ static inline pte_t pte_wrprotect(pte_t
10513 return pte_clear_flags(pte, _PAGE_RW);
10514 }
10515
10516+static inline pte_t pte_mkread(pte_t pte)
10517+{
10518+ return __pte(pte_val(pte) | _PAGE_USER);
10519+}
10520+
10521 static inline pte_t pte_mkexec(pte_t pte)
10522 {
10523- return pte_clear_flags(pte, _PAGE_NX);
10524+#ifdef CONFIG_X86_PAE
10525+ if (__supported_pte_mask & _PAGE_NX)
10526+ return pte_clear_flags(pte, _PAGE_NX);
10527+ else
10528+#endif
10529+ return pte_set_flags(pte, _PAGE_USER);
10530+}
10531+
10532+static inline pte_t pte_exprotect(pte_t pte)
10533+{
10534+#ifdef CONFIG_X86_PAE
10535+ if (__supported_pte_mask & _PAGE_NX)
10536+ return pte_set_flags(pte, _PAGE_NX);
10537+ else
10538+#endif
10539+ return pte_clear_flags(pte, _PAGE_USER);
10540 }
10541
10542 static inline pte_t pte_mkdirty(pte_t pte)
10543@@ -390,6 +449,15 @@ pte_t *populate_extra_pte(unsigned long
10544 #endif
10545
10546 #ifndef __ASSEMBLY__
10547+
10548+#ifdef CONFIG_PAX_PER_CPU_PGD
10549+extern pgd_t cpu_pgd[NR_CPUS][PTRS_PER_PGD];
10550+static inline pgd_t *get_cpu_pgd(unsigned int cpu)
10551+{
10552+ return cpu_pgd[cpu];
10553+}
10554+#endif
10555+
10556 #include <linux/mm_types.h>
10557
10558 static inline int pte_none(pte_t pte)
10559@@ -560,7 +628,7 @@ static inline pud_t *pud_offset(pgd_t *p
10560
10561 static inline int pgd_bad(pgd_t pgd)
10562 {
10563- return (pgd_flags(pgd) & ~_PAGE_USER) != _KERNPG_TABLE;
10564+ return (pgd_flags(pgd) & ~(_PAGE_USER | _PAGE_NX)) != _KERNPG_TABLE;
10565 }
10566
10567 static inline int pgd_none(pgd_t pgd)
10568@@ -583,7 +651,12 @@ static inline int pgd_none(pgd_t pgd)
10569 * pgd_offset() returns a (pgd_t *)
10570 * pgd_index() is used get the offset into the pgd page's array of pgd_t's;
10571 */
10572-#define pgd_offset(mm, address) ((mm)->pgd + pgd_index((address)))
10573+#define pgd_offset(mm, address) ((mm)->pgd + pgd_index(address))
10574+
10575+#ifdef CONFIG_PAX_PER_CPU_PGD
10576+#define pgd_offset_cpu(cpu, address) (get_cpu_pgd(cpu) + pgd_index(address))
10577+#endif
10578+
10579 /*
10580 * a shortcut which implies the use of the kernel's pgd, instead
10581 * of a process's
10582@@ -594,6 +667,20 @@ static inline int pgd_none(pgd_t pgd)
10583 #define KERNEL_PGD_BOUNDARY pgd_index(PAGE_OFFSET)
10584 #define KERNEL_PGD_PTRS (PTRS_PER_PGD - KERNEL_PGD_BOUNDARY)
10585
10586+#ifdef CONFIG_X86_32
10587+#define USER_PGD_PTRS KERNEL_PGD_BOUNDARY
10588+#else
10589+#define TASK_SIZE_MAX_SHIFT CONFIG_TASK_SIZE_MAX_SHIFT
10590+#define USER_PGD_PTRS (_AC(1,UL) << (TASK_SIZE_MAX_SHIFT - PGDIR_SHIFT))
10591+
10592+#ifdef CONFIG_PAX_MEMORY_UDEREF
10593+#define PAX_USER_SHADOW_BASE (_AC(1,UL) << TASK_SIZE_MAX_SHIFT)
10594+#else
10595+#define PAX_USER_SHADOW_BASE (_AC(0,UL))
10596+#endif
10597+
10598+#endif
10599+
10600 #ifndef __ASSEMBLY__
10601
10602 extern int direct_gbpages;
10603@@ -758,11 +845,23 @@ static inline void pmdp_set_wrprotect(st
10604 * dst and src can be on the same page, but the range must not overlap,
10605 * and must not cross a page boundary.
10606 */
10607-static inline void clone_pgd_range(pgd_t *dst, pgd_t *src, int count)
10608+static inline void clone_pgd_range(pgd_t *dst, const pgd_t *src, int count)
10609 {
10610- memcpy(dst, src, count * sizeof(pgd_t));
10611+ pax_open_kernel();
10612+ while (count--)
10613+ *dst++ = *src++;
10614+ pax_close_kernel();
10615 }
10616
10617+#ifdef CONFIG_PAX_PER_CPU_PGD
10618+extern void __clone_user_pgds(pgd_t *dst, const pgd_t *src, int count);
10619+#endif
10620+
10621+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
10622+extern void __shadow_user_pgds(pgd_t *dst, const pgd_t *src, int count);
10623+#else
10624+static inline void __shadow_user_pgds(pgd_t *dst, const pgd_t *src, int count) {}
10625+#endif
10626
10627 #include <asm-generic/pgtable.h>
10628 #endif /* __ASSEMBLY__ */
10629diff -urNp linux-2.6.39/arch/x86/include/asm/pgtable_types.h linux-2.6.39/arch/x86/include/asm/pgtable_types.h
10630--- linux-2.6.39/arch/x86/include/asm/pgtable_types.h 2011-05-19 00:06:34.000000000 -0400
10631+++ linux-2.6.39/arch/x86/include/asm/pgtable_types.h 2011-05-22 19:36:30.000000000 -0400
10632@@ -16,13 +16,12 @@
10633 #define _PAGE_BIT_PSE 7 /* 4 MB (or 2MB) page */
10634 #define _PAGE_BIT_PAT 7 /* on 4KB pages */
10635 #define _PAGE_BIT_GLOBAL 8 /* Global TLB entry PPro+ */
10636-#define _PAGE_BIT_UNUSED1 9 /* available for programmer */
10637+#define _PAGE_BIT_SPECIAL 9 /* special mappings, no associated struct page */
10638 #define _PAGE_BIT_IOMAP 10 /* flag used to indicate IO mapping */
10639 #define _PAGE_BIT_HIDDEN 11 /* hidden by kmemcheck */
10640 #define _PAGE_BIT_PAT_LARGE 12 /* On 2MB or 1GB pages */
10641-#define _PAGE_BIT_SPECIAL _PAGE_BIT_UNUSED1
10642-#define _PAGE_BIT_CPA_TEST _PAGE_BIT_UNUSED1
10643-#define _PAGE_BIT_SPLITTING _PAGE_BIT_UNUSED1 /* only valid on a PSE pmd */
10644+#define _PAGE_BIT_CPA_TEST _PAGE_BIT_SPECIAL
10645+#define _PAGE_BIT_SPLITTING _PAGE_BIT_SPECIAL /* only valid on a PSE pmd */
10646 #define _PAGE_BIT_NX 63 /* No execute: only valid after cpuid check */
10647
10648 /* If _PAGE_BIT_PRESENT is clear, we use these: */
10649@@ -40,7 +39,6 @@
10650 #define _PAGE_DIRTY (_AT(pteval_t, 1) << _PAGE_BIT_DIRTY)
10651 #define _PAGE_PSE (_AT(pteval_t, 1) << _PAGE_BIT_PSE)
10652 #define _PAGE_GLOBAL (_AT(pteval_t, 1) << _PAGE_BIT_GLOBAL)
10653-#define _PAGE_UNUSED1 (_AT(pteval_t, 1) << _PAGE_BIT_UNUSED1)
10654 #define _PAGE_IOMAP (_AT(pteval_t, 1) << _PAGE_BIT_IOMAP)
10655 #define _PAGE_PAT (_AT(pteval_t, 1) << _PAGE_BIT_PAT)
10656 #define _PAGE_PAT_LARGE (_AT(pteval_t, 1) << _PAGE_BIT_PAT_LARGE)
10657@@ -57,8 +55,10 @@
10658
10659 #if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
10660 #define _PAGE_NX (_AT(pteval_t, 1) << _PAGE_BIT_NX)
10661-#else
10662+#elif defined(CONFIG_KMEMCHECK)
10663 #define _PAGE_NX (_AT(pteval_t, 0))
10664+#else
10665+#define _PAGE_NX (_AT(pteval_t, 1) << _PAGE_BIT_HIDDEN)
10666 #endif
10667
10668 #define _PAGE_FILE (_AT(pteval_t, 1) << _PAGE_BIT_FILE)
10669@@ -96,6 +96,9 @@
10670 #define PAGE_READONLY_EXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | \
10671 _PAGE_ACCESSED)
10672
10673+#define PAGE_READONLY_NOEXEC PAGE_READONLY
10674+#define PAGE_SHARED_NOEXEC PAGE_SHARED
10675+
10676 #define __PAGE_KERNEL_EXEC \
10677 (_PAGE_PRESENT | _PAGE_RW | _PAGE_DIRTY | _PAGE_ACCESSED | _PAGE_GLOBAL)
10678 #define __PAGE_KERNEL (__PAGE_KERNEL_EXEC | _PAGE_NX)
10679@@ -106,8 +109,8 @@
10680 #define __PAGE_KERNEL_WC (__PAGE_KERNEL | _PAGE_CACHE_WC)
10681 #define __PAGE_KERNEL_NOCACHE (__PAGE_KERNEL | _PAGE_PCD | _PAGE_PWT)
10682 #define __PAGE_KERNEL_UC_MINUS (__PAGE_KERNEL | _PAGE_PCD)
10683-#define __PAGE_KERNEL_VSYSCALL (__PAGE_KERNEL_RX | _PAGE_USER)
10684-#define __PAGE_KERNEL_VSYSCALL_NOCACHE (__PAGE_KERNEL_VSYSCALL | _PAGE_PCD | _PAGE_PWT)
10685+#define __PAGE_KERNEL_VSYSCALL (__PAGE_KERNEL_RO | _PAGE_USER)
10686+#define __PAGE_KERNEL_VSYSCALL_NOCACHE (__PAGE_KERNEL_RO | _PAGE_PCD | _PAGE_PWT | _PAGE_USER)
10687 #define __PAGE_KERNEL_LARGE (__PAGE_KERNEL | _PAGE_PSE)
10688 #define __PAGE_KERNEL_LARGE_NOCACHE (__PAGE_KERNEL | _PAGE_CACHE_UC | _PAGE_PSE)
10689 #define __PAGE_KERNEL_LARGE_EXEC (__PAGE_KERNEL_EXEC | _PAGE_PSE)
10690@@ -166,8 +169,8 @@
10691 * bits are combined, this will alow user to access the high address mapped
10692 * VDSO in the presence of CONFIG_COMPAT_VDSO
10693 */
10694-#define PTE_IDENT_ATTR 0x003 /* PRESENT+RW */
10695-#define PDE_IDENT_ATTR 0x067 /* PRESENT+RW+USER+DIRTY+ACCESSED */
10696+#define PTE_IDENT_ATTR 0x063 /* PRESENT+RW+DIRTY+ACCESSED */
10697+#define PDE_IDENT_ATTR 0x063 /* PRESENT+RW+DIRTY+ACCESSED */
10698 #define PGD_IDENT_ATTR 0x001 /* PRESENT (no other attributes) */
10699 #endif
10700
10701@@ -205,7 +208,17 @@ static inline pgdval_t pgd_flags(pgd_t p
10702 {
10703 return native_pgd_val(pgd) & PTE_FLAGS_MASK;
10704 }
10705+#endif
10706
10707+#if PAGETABLE_LEVELS == 3
10708+#include <asm-generic/pgtable-nopud.h>
10709+#endif
10710+
10711+#if PAGETABLE_LEVELS == 2
10712+#include <asm-generic/pgtable-nopmd.h>
10713+#endif
10714+
10715+#ifndef __ASSEMBLY__
10716 #if PAGETABLE_LEVELS > 3
10717 typedef struct { pudval_t pud; } pud_t;
10718
10719@@ -219,8 +232,6 @@ static inline pudval_t native_pud_val(pu
10720 return pud.pud;
10721 }
10722 #else
10723-#include <asm-generic/pgtable-nopud.h>
10724-
10725 static inline pudval_t native_pud_val(pud_t pud)
10726 {
10727 return native_pgd_val(pud.pgd);
10728@@ -240,8 +251,6 @@ static inline pmdval_t native_pmd_val(pm
10729 return pmd.pmd;
10730 }
10731 #else
10732-#include <asm-generic/pgtable-nopmd.h>
10733-
10734 static inline pmdval_t native_pmd_val(pmd_t pmd)
10735 {
10736 return native_pgd_val(pmd.pud.pgd);
10737@@ -281,7 +290,6 @@ typedef struct page *pgtable_t;
10738
10739 extern pteval_t __supported_pte_mask;
10740 extern void set_nx(void);
10741-extern int nx_enabled;
10742
10743 #define pgprot_writecombine pgprot_writecombine
10744 extern pgprot_t pgprot_writecombine(pgprot_t prot);
10745diff -urNp linux-2.6.39/arch/x86/include/asm/processor.h linux-2.6.39/arch/x86/include/asm/processor.h
10746--- linux-2.6.39/arch/x86/include/asm/processor.h 2011-05-19 00:06:34.000000000 -0400
10747+++ linux-2.6.39/arch/x86/include/asm/processor.h 2011-05-22 19:36:30.000000000 -0400
10748@@ -266,7 +266,7 @@ struct tss_struct {
10749
10750 } ____cacheline_aligned;
10751
10752-DECLARE_PER_CPU_SHARED_ALIGNED(struct tss_struct, init_tss);
10753+extern struct tss_struct init_tss[NR_CPUS];
10754
10755 /*
10756 * Save the original ist values for checking stack pointers during debugging
10757@@ -860,11 +860,18 @@ static inline void spin_lock_prefetch(co
10758 */
10759 #define TASK_SIZE PAGE_OFFSET
10760 #define TASK_SIZE_MAX TASK_SIZE
10761+
10762+#ifdef CONFIG_PAX_SEGMEXEC
10763+#define SEGMEXEC_TASK_SIZE (TASK_SIZE / 2)
10764+#define STACK_TOP ((current->mm->pax_flags & MF_PAX_SEGMEXEC)?SEGMEXEC_TASK_SIZE:TASK_SIZE)
10765+#else
10766 #define STACK_TOP TASK_SIZE
10767-#define STACK_TOP_MAX STACK_TOP
10768+#endif
10769+
10770+#define STACK_TOP_MAX TASK_SIZE
10771
10772 #define INIT_THREAD { \
10773- .sp0 = sizeof(init_stack) + (long)&init_stack, \
10774+ .sp0 = sizeof(init_stack) + (long)&init_stack - 8, \
10775 .vm86_info = NULL, \
10776 .sysenter_cs = __KERNEL_CS, \
10777 .io_bitmap_ptr = NULL, \
10778@@ -878,7 +885,7 @@ static inline void spin_lock_prefetch(co
10779 */
10780 #define INIT_TSS { \
10781 .x86_tss = { \
10782- .sp0 = sizeof(init_stack) + (long)&init_stack, \
10783+ .sp0 = sizeof(init_stack) + (long)&init_stack - 8, \
10784 .ss0 = __KERNEL_DS, \
10785 .ss1 = __KERNEL_CS, \
10786 .io_bitmap_base = INVALID_IO_BITMAP_OFFSET, \
10787@@ -889,11 +896,7 @@ static inline void spin_lock_prefetch(co
10788 extern unsigned long thread_saved_pc(struct task_struct *tsk);
10789
10790 #define THREAD_SIZE_LONGS (THREAD_SIZE/sizeof(unsigned long))
10791-#define KSTK_TOP(info) \
10792-({ \
10793- unsigned long *__ptr = (unsigned long *)(info); \
10794- (unsigned long)(&__ptr[THREAD_SIZE_LONGS]); \
10795-})
10796+#define KSTK_TOP(info) ((container_of(info, struct task_struct, tinfo))->thread.sp0)
10797
10798 /*
10799 * The below -8 is to reserve 8 bytes on top of the ring0 stack.
10800@@ -908,7 +911,7 @@ extern unsigned long thread_saved_pc(str
10801 #define task_pt_regs(task) \
10802 ({ \
10803 struct pt_regs *__regs__; \
10804- __regs__ = (struct pt_regs *)(KSTK_TOP(task_stack_page(task))-8); \
10805+ __regs__ = (struct pt_regs *)((task)->thread.sp0); \
10806 __regs__ - 1; \
10807 })
10808
10809@@ -918,13 +921,13 @@ extern unsigned long thread_saved_pc(str
10810 /*
10811 * User space process size. 47bits minus one guard page.
10812 */
10813-#define TASK_SIZE_MAX ((1UL << 47) - PAGE_SIZE)
10814+#define TASK_SIZE_MAX ((1UL << TASK_SIZE_MAX_SHIFT) - PAGE_SIZE)
10815
10816 /* This decides where the kernel will search for a free chunk of vm
10817 * space during mmap's.
10818 */
10819 #define IA32_PAGE_OFFSET ((current->personality & ADDR_LIMIT_3GB) ? \
10820- 0xc0000000 : 0xFFFFe000)
10821+ 0xc0000000 : 0xFFFFf000)
10822
10823 #define TASK_SIZE (test_thread_flag(TIF_IA32) ? \
10824 IA32_PAGE_OFFSET : TASK_SIZE_MAX)
10825@@ -935,11 +938,11 @@ extern unsigned long thread_saved_pc(str
10826 #define STACK_TOP_MAX TASK_SIZE_MAX
10827
10828 #define INIT_THREAD { \
10829- .sp0 = (unsigned long)&init_stack + sizeof(init_stack) \
10830+ .sp0 = (unsigned long)&init_stack + sizeof(init_stack) - 16 \
10831 }
10832
10833 #define INIT_TSS { \
10834- .x86_tss.sp0 = (unsigned long)&init_stack + sizeof(init_stack) \
10835+ .x86_tss.sp0 = (unsigned long)&init_stack + sizeof(init_stack) - 16 \
10836 }
10837
10838 /*
10839@@ -961,6 +964,10 @@ extern void start_thread(struct pt_regs
10840 */
10841 #define TASK_UNMAPPED_BASE (PAGE_ALIGN(TASK_SIZE / 3))
10842
10843+#ifdef CONFIG_PAX_SEGMEXEC
10844+#define SEGMEXEC_TASK_UNMAPPED_BASE (PAGE_ALIGN(SEGMEXEC_TASK_SIZE / 3))
10845+#endif
10846+
10847 #define KSTK_EIP(task) (task_pt_regs(task)->ip)
10848
10849 /* Get/set a process' ability to use the timestamp counter instruction */
10850diff -urNp linux-2.6.39/arch/x86/include/asm/ptrace.h linux-2.6.39/arch/x86/include/asm/ptrace.h
10851--- linux-2.6.39/arch/x86/include/asm/ptrace.h 2011-05-19 00:06:34.000000000 -0400
10852+++ linux-2.6.39/arch/x86/include/asm/ptrace.h 2011-05-22 19:36:30.000000000 -0400
10853@@ -152,28 +152,29 @@ static inline unsigned long regs_return_
10854 }
10855
10856 /*
10857- * user_mode_vm(regs) determines whether a register set came from user mode.
10858+ * user_mode(regs) determines whether a register set came from user mode.
10859 * This is true if V8086 mode was enabled OR if the register set was from
10860 * protected mode with RPL-3 CS value. This tricky test checks that with
10861 * one comparison. Many places in the kernel can bypass this full check
10862- * if they have already ruled out V8086 mode, so user_mode(regs) can be used.
10863+ * if they have already ruled out V8086 mode, so user_mode_novm(regs) can
10864+ * be used.
10865 */
10866-static inline int user_mode(struct pt_regs *regs)
10867+static inline int user_mode_novm(struct pt_regs *regs)
10868 {
10869 #ifdef CONFIG_X86_32
10870 return (regs->cs & SEGMENT_RPL_MASK) == USER_RPL;
10871 #else
10872- return !!(regs->cs & 3);
10873+ return !!(regs->cs & SEGMENT_RPL_MASK);
10874 #endif
10875 }
10876
10877-static inline int user_mode_vm(struct pt_regs *regs)
10878+static inline int user_mode(struct pt_regs *regs)
10879 {
10880 #ifdef CONFIG_X86_32
10881 return ((regs->cs & SEGMENT_RPL_MASK) | (regs->flags & X86_VM_MASK)) >=
10882 USER_RPL;
10883 #else
10884- return user_mode(regs);
10885+ return user_mode_novm(regs);
10886 #endif
10887 }
10888
10889diff -urNp linux-2.6.39/arch/x86/include/asm/reboot.h linux-2.6.39/arch/x86/include/asm/reboot.h
10890--- linux-2.6.39/arch/x86/include/asm/reboot.h 2011-05-19 00:06:34.000000000 -0400
10891+++ linux-2.6.39/arch/x86/include/asm/reboot.h 2011-05-22 19:36:30.000000000 -0400
10892@@ -6,19 +6,19 @@
10893 struct pt_regs;
10894
10895 struct machine_ops {
10896- void (*restart)(char *cmd);
10897- void (*halt)(void);
10898- void (*power_off)(void);
10899+ void (* __noreturn restart)(char *cmd);
10900+ void (* __noreturn halt)(void);
10901+ void (* __noreturn power_off)(void);
10902 void (*shutdown)(void);
10903 void (*crash_shutdown)(struct pt_regs *);
10904- void (*emergency_restart)(void);
10905+ void (* __noreturn emergency_restart)(void);
10906 };
10907
10908 extern struct machine_ops machine_ops;
10909
10910 void native_machine_crash_shutdown(struct pt_regs *regs);
10911 void native_machine_shutdown(void);
10912-void machine_real_restart(unsigned int type);
10913+void machine_real_restart(unsigned int type) __noreturn;
10914 /* These must match dispatch_table in reboot_32.S */
10915 #define MRR_BIOS 0
10916 #define MRR_APM 1
10917diff -urNp linux-2.6.39/arch/x86/include/asm/rwsem.h linux-2.6.39/arch/x86/include/asm/rwsem.h
10918--- linux-2.6.39/arch/x86/include/asm/rwsem.h 2011-05-19 00:06:34.000000000 -0400
10919+++ linux-2.6.39/arch/x86/include/asm/rwsem.h 2011-05-22 19:36:30.000000000 -0400
10920@@ -64,6 +64,14 @@ static inline void __down_read(struct rw
10921 {
10922 asm volatile("# beginning down_read\n\t"
10923 LOCK_PREFIX _ASM_INC "(%1)\n\t"
10924+
10925+#ifdef CONFIG_PAX_REFCOUNT
10926+ "jno 0f\n"
10927+ LOCK_PREFIX _ASM_DEC "(%1)\n"
10928+ "int $4\n0:\n"
10929+ _ASM_EXTABLE(0b, 0b)
10930+#endif
10931+
10932 /* adds 0x00000001 */
10933 " jns 1f\n"
10934 " call call_rwsem_down_read_failed\n"
10935@@ -85,6 +93,14 @@ static inline int __down_read_trylock(st
10936 "1:\n\t"
10937 " mov %1,%2\n\t"
10938 " add %3,%2\n\t"
10939+
10940+#ifdef CONFIG_PAX_REFCOUNT
10941+ "jno 0f\n"
10942+ "sub %3,%2\n"
10943+ "int $4\n0:\n"
10944+ _ASM_EXTABLE(0b, 0b)
10945+#endif
10946+
10947 " jle 2f\n\t"
10948 LOCK_PREFIX " cmpxchg %2,%0\n\t"
10949 " jnz 1b\n\t"
10950@@ -104,6 +120,14 @@ static inline void __down_write_nested(s
10951 long tmp;
10952 asm volatile("# beginning down_write\n\t"
10953 LOCK_PREFIX " xadd %1,(%2)\n\t"
10954+
10955+#ifdef CONFIG_PAX_REFCOUNT
10956+ "jno 0f\n"
10957+ "mov %1,(%2)\n"
10958+ "int $4\n0:\n"
10959+ _ASM_EXTABLE(0b, 0b)
10960+#endif
10961+
10962 /* adds 0xffff0001, returns the old value */
10963 " test %1,%1\n\t"
10964 /* was the count 0 before? */
10965@@ -141,6 +165,14 @@ static inline void __up_read(struct rw_s
10966 long tmp;
10967 asm volatile("# beginning __up_read\n\t"
10968 LOCK_PREFIX " xadd %1,(%2)\n\t"
10969+
10970+#ifdef CONFIG_PAX_REFCOUNT
10971+ "jno 0f\n"
10972+ "mov %1,(%2)\n"
10973+ "int $4\n0:\n"
10974+ _ASM_EXTABLE(0b, 0b)
10975+#endif
10976+
10977 /* subtracts 1, returns the old value */
10978 " jns 1f\n\t"
10979 " call call_rwsem_wake\n" /* expects old value in %edx */
10980@@ -159,6 +191,14 @@ static inline void __up_write(struct rw_
10981 long tmp;
10982 asm volatile("# beginning __up_write\n\t"
10983 LOCK_PREFIX " xadd %1,(%2)\n\t"
10984+
10985+#ifdef CONFIG_PAX_REFCOUNT
10986+ "jno 0f\n"
10987+ "mov %1,(%2)\n"
10988+ "int $4\n0:\n"
10989+ _ASM_EXTABLE(0b, 0b)
10990+#endif
10991+
10992 /* subtracts 0xffff0001, returns the old value */
10993 " jns 1f\n\t"
10994 " call call_rwsem_wake\n" /* expects old value in %edx */
10995@@ -176,6 +216,14 @@ static inline void __downgrade_write(str
10996 {
10997 asm volatile("# beginning __downgrade_write\n\t"
10998 LOCK_PREFIX _ASM_ADD "%2,(%1)\n\t"
10999+
11000+#ifdef CONFIG_PAX_REFCOUNT
11001+ "jno 0f\n"
11002+ LOCK_PREFIX _ASM_SUB "%2,(%1)\n"
11003+ "int $4\n0:\n"
11004+ _ASM_EXTABLE(0b, 0b)
11005+#endif
11006+
11007 /*
11008 * transitions 0xZZZZ0001 -> 0xYYYY0001 (i386)
11009 * 0xZZZZZZZZ00000001 -> 0xYYYYYYYY00000001 (x86_64)
11010@@ -194,7 +242,15 @@ static inline void __downgrade_write(str
11011 */
11012 static inline void rwsem_atomic_add(long delta, struct rw_semaphore *sem)
11013 {
11014- asm volatile(LOCK_PREFIX _ASM_ADD "%1,%0"
11015+ asm volatile(LOCK_PREFIX _ASM_ADD "%1,%0\n"
11016+
11017+#ifdef CONFIG_PAX_REFCOUNT
11018+ "jno 0f\n"
11019+ LOCK_PREFIX _ASM_SUB "%1,%0\n"
11020+ "int $4\n0:\n"
11021+ _ASM_EXTABLE(0b, 0b)
11022+#endif
11023+
11024 : "+m" (sem->count)
11025 : "er" (delta));
11026 }
11027@@ -206,7 +262,15 @@ static inline long rwsem_atomic_update(l
11028 {
11029 long tmp = delta;
11030
11031- asm volatile(LOCK_PREFIX "xadd %0,%1"
11032+ asm volatile(LOCK_PREFIX "xadd %0,%1\n"
11033+
11034+#ifdef CONFIG_PAX_REFCOUNT
11035+ "jno 0f\n"
11036+ "mov %0,%1\n"
11037+ "int $4\n0:\n"
11038+ _ASM_EXTABLE(0b, 0b)
11039+#endif
11040+
11041 : "+r" (tmp), "+m" (sem->count)
11042 : : "memory");
11043
11044diff -urNp linux-2.6.39/arch/x86/include/asm/segment.h linux-2.6.39/arch/x86/include/asm/segment.h
11045--- linux-2.6.39/arch/x86/include/asm/segment.h 2011-05-19 00:06:34.000000000 -0400
11046+++ linux-2.6.39/arch/x86/include/asm/segment.h 2011-05-22 19:36:30.000000000 -0400
11047@@ -64,8 +64,8 @@
11048 * 26 - ESPFIX small SS
11049 * 27 - per-cpu [ offset to per-cpu data area ]
11050 * 28 - stack_canary-20 [ for stack protector ]
11051- * 29 - unused
11052- * 30 - unused
11053+ * 29 - PCI BIOS CS
11054+ * 30 - PCI BIOS DS
11055 * 31 - TSS for double fault handler
11056 */
11057 #define GDT_ENTRY_TLS_MIN 6
11058@@ -79,6 +79,8 @@
11059
11060 #define GDT_ENTRY_KERNEL_CS (GDT_ENTRY_KERNEL_BASE+0)
11061
11062+#define GDT_ENTRY_KERNEXEC_KERNEL_CS (4)
11063+
11064 #define GDT_ENTRY_KERNEL_DS (GDT_ENTRY_KERNEL_BASE+1)
11065
11066 #define GDT_ENTRY_TSS (GDT_ENTRY_KERNEL_BASE+4)
11067@@ -104,6 +106,12 @@
11068 #define __KERNEL_STACK_CANARY 0
11069 #endif
11070
11071+#define GDT_ENTRY_PCIBIOS_CS (GDT_ENTRY_KERNEL_BASE+17)
11072+#define __PCIBIOS_CS (GDT_ENTRY_PCIBIOS_CS * 8)
11073+
11074+#define GDT_ENTRY_PCIBIOS_DS (GDT_ENTRY_KERNEL_BASE+18)
11075+#define __PCIBIOS_DS (GDT_ENTRY_PCIBIOS_DS * 8)
11076+
11077 #define GDT_ENTRY_DOUBLEFAULT_TSS 31
11078
11079 /*
11080@@ -141,7 +149,7 @@
11081 */
11082
11083 /* Matches PNP_CS32 and PNP_CS16 (they must be consecutive) */
11084-#define SEGMENT_IS_PNP_CODE(x) (((x) & 0xf4) == GDT_ENTRY_PNPBIOS_BASE * 8)
11085+#define SEGMENT_IS_PNP_CODE(x) (((x) & 0xFFFCU) == PNP_CS32 || ((x) & 0xFFFCU) == PNP_CS16)
11086
11087
11088 #else
11089@@ -165,6 +173,8 @@
11090 #define __USER32_CS (GDT_ENTRY_DEFAULT_USER32_CS * 8 + 3)
11091 #define __USER32_DS __USER_DS
11092
11093+#define GDT_ENTRY_KERNEXEC_KERNEL_CS 7
11094+
11095 #define GDT_ENTRY_TSS 8 /* needs two entries */
11096 #define GDT_ENTRY_LDT 10 /* needs two entries */
11097 #define GDT_ENTRY_TLS_MIN 12
11098@@ -185,6 +195,7 @@
11099 #endif
11100
11101 #define __KERNEL_CS (GDT_ENTRY_KERNEL_CS*8)
11102+#define __KERNEXEC_KERNEL_CS (GDT_ENTRY_KERNEXEC_KERNEL_CS*8)
11103 #define __KERNEL_DS (GDT_ENTRY_KERNEL_DS*8)
11104 #define __USER_DS (GDT_ENTRY_DEFAULT_USER_DS*8+3)
11105 #define __USER_CS (GDT_ENTRY_DEFAULT_USER_CS*8+3)
11106diff -urNp linux-2.6.39/arch/x86/include/asm/smp.h linux-2.6.39/arch/x86/include/asm/smp.h
11107--- linux-2.6.39/arch/x86/include/asm/smp.h 2011-05-19 00:06:34.000000000 -0400
11108+++ linux-2.6.39/arch/x86/include/asm/smp.h 2011-05-22 19:36:30.000000000 -0400
11109@@ -36,7 +36,7 @@ DECLARE_PER_CPU(cpumask_var_t, cpu_core_
11110 /* cpus sharing the last level cache: */
11111 DECLARE_PER_CPU(cpumask_var_t, cpu_llc_shared_map);
11112 DECLARE_PER_CPU(u16, cpu_llc_id);
11113-DECLARE_PER_CPU(int, cpu_number);
11114+DECLARE_PER_CPU(unsigned int, cpu_number);
11115
11116 static inline struct cpumask *cpu_sibling_mask(int cpu)
11117 {
11118@@ -192,14 +192,8 @@ extern unsigned disabled_cpus __cpuinitd
11119 extern int safe_smp_processor_id(void);
11120
11121 #elif defined(CONFIG_X86_64_SMP)
11122-#define raw_smp_processor_id() (percpu_read(cpu_number))
11123-
11124-#define stack_smp_processor_id() \
11125-({ \
11126- struct thread_info *ti; \
11127- __asm__("andq %%rsp,%0; ":"=r" (ti) : "0" (CURRENT_MASK)); \
11128- ti->cpu; \
11129-})
11130+#define raw_smp_processor_id() (percpu_read(cpu_number))
11131+#define stack_smp_processor_id() raw_smp_processor_id()
11132 #define safe_smp_processor_id() smp_processor_id()
11133
11134 #endif
11135diff -urNp linux-2.6.39/arch/x86/include/asm/spinlock.h linux-2.6.39/arch/x86/include/asm/spinlock.h
11136--- linux-2.6.39/arch/x86/include/asm/spinlock.h 2011-05-19 00:06:34.000000000 -0400
11137+++ linux-2.6.39/arch/x86/include/asm/spinlock.h 2011-05-22 19:36:30.000000000 -0400
11138@@ -249,6 +249,14 @@ static inline int arch_write_can_lock(ar
11139 static inline void arch_read_lock(arch_rwlock_t *rw)
11140 {
11141 asm volatile(LOCK_PREFIX " subl $1,(%0)\n\t"
11142+
11143+#ifdef CONFIG_PAX_REFCOUNT
11144+ "jno 0f\n"
11145+ LOCK_PREFIX " addl $1,(%0)\n"
11146+ "int $4\n0:\n"
11147+ _ASM_EXTABLE(0b, 0b)
11148+#endif
11149+
11150 "jns 1f\n"
11151 "call __read_lock_failed\n\t"
11152 "1:\n"
11153@@ -258,6 +266,14 @@ static inline void arch_read_lock(arch_r
11154 static inline void arch_write_lock(arch_rwlock_t *rw)
11155 {
11156 asm volatile(LOCK_PREFIX " subl %1,(%0)\n\t"
11157+
11158+#ifdef CONFIG_PAX_REFCOUNT
11159+ "jno 0f\n"
11160+ LOCK_PREFIX " addl %1,(%0)\n"
11161+ "int $4\n0:\n"
11162+ _ASM_EXTABLE(0b, 0b)
11163+#endif
11164+
11165 "jz 1f\n"
11166 "call __write_lock_failed\n\t"
11167 "1:\n"
11168@@ -286,12 +302,29 @@ static inline int arch_write_trylock(arc
11169
11170 static inline void arch_read_unlock(arch_rwlock_t *rw)
11171 {
11172- asm volatile(LOCK_PREFIX "incl %0" :"+m" (rw->lock) : : "memory");
11173+ asm volatile(LOCK_PREFIX "incl %0\n"
11174+
11175+#ifdef CONFIG_PAX_REFCOUNT
11176+ "jno 0f\n"
11177+ LOCK_PREFIX "decl %0\n"
11178+ "int $4\n0:\n"
11179+ _ASM_EXTABLE(0b, 0b)
11180+#endif
11181+
11182+ :"+m" (rw->lock) : : "memory");
11183 }
11184
11185 static inline void arch_write_unlock(arch_rwlock_t *rw)
11186 {
11187- asm volatile(LOCK_PREFIX "addl %1, %0"
11188+ asm volatile(LOCK_PREFIX "addl %1, %0\n"
11189+
11190+#ifdef CONFIG_PAX_REFCOUNT
11191+ "jno 0f\n"
11192+ LOCK_PREFIX "subl %1, %0\n"
11193+ "int $4\n0:\n"
11194+ _ASM_EXTABLE(0b, 0b)
11195+#endif
11196+
11197 : "+m" (rw->lock) : "i" (RW_LOCK_BIAS) : "memory");
11198 }
11199
11200diff -urNp linux-2.6.39/arch/x86/include/asm/stackprotector.h linux-2.6.39/arch/x86/include/asm/stackprotector.h
11201--- linux-2.6.39/arch/x86/include/asm/stackprotector.h 2011-05-19 00:06:34.000000000 -0400
11202+++ linux-2.6.39/arch/x86/include/asm/stackprotector.h 2011-05-22 19:36:30.000000000 -0400
11203@@ -113,7 +113,7 @@ static inline void setup_stack_canary_se
11204
11205 static inline void load_stack_canary_segment(void)
11206 {
11207-#ifdef CONFIG_X86_32
11208+#if defined(CONFIG_X86_32) && !defined(CONFIG_PAX_MEMORY_UDEREF)
11209 asm volatile ("mov %0, %%gs" : : "r" (0));
11210 #endif
11211 }
11212diff -urNp linux-2.6.39/arch/x86/include/asm/stacktrace.h linux-2.6.39/arch/x86/include/asm/stacktrace.h
11213--- linux-2.6.39/arch/x86/include/asm/stacktrace.h 2011-05-19 00:06:34.000000000 -0400
11214+++ linux-2.6.39/arch/x86/include/asm/stacktrace.h 2011-05-22 19:36:30.000000000 -0400
11215@@ -11,28 +11,20 @@
11216
11217 extern int kstack_depth_to_print;
11218
11219-struct thread_info;
11220+struct task_struct;
11221 struct stacktrace_ops;
11222
11223-typedef unsigned long (*walk_stack_t)(struct thread_info *tinfo,
11224- unsigned long *stack,
11225- unsigned long bp,
11226- const struct stacktrace_ops *ops,
11227- void *data,
11228- unsigned long *end,
11229- int *graph);
11230-
11231-extern unsigned long
11232-print_context_stack(struct thread_info *tinfo,
11233- unsigned long *stack, unsigned long bp,
11234- const struct stacktrace_ops *ops, void *data,
11235- unsigned long *end, int *graph);
11236-
11237-extern unsigned long
11238-print_context_stack_bp(struct thread_info *tinfo,
11239- unsigned long *stack, unsigned long bp,
11240- const struct stacktrace_ops *ops, void *data,
11241- unsigned long *end, int *graph);
11242+typedef unsigned long walk_stack_t(struct task_struct *task,
11243+ void *stack_start,
11244+ unsigned long *stack,
11245+ unsigned long bp,
11246+ const struct stacktrace_ops *ops,
11247+ void *data,
11248+ unsigned long *end,
11249+ int *graph);
11250+
11251+extern walk_stack_t print_context_stack;
11252+extern walk_stack_t print_context_stack_bp;
11253
11254 /* Generic stack tracer with callbacks */
11255
11256@@ -43,7 +35,7 @@ struct stacktrace_ops {
11257 void (*address)(void *data, unsigned long address, int reliable);
11258 /* On negative return stop dumping */
11259 int (*stack)(void *data, char *name);
11260- walk_stack_t walk_stack;
11261+ walk_stack_t *walk_stack;
11262 };
11263
11264 void dump_trace(struct task_struct *tsk, struct pt_regs *regs,
11265diff -urNp linux-2.6.39/arch/x86/include/asm/system.h linux-2.6.39/arch/x86/include/asm/system.h
11266--- linux-2.6.39/arch/x86/include/asm/system.h 2011-05-19 00:06:34.000000000 -0400
11267+++ linux-2.6.39/arch/x86/include/asm/system.h 2011-05-22 19:36:30.000000000 -0400
11268@@ -129,7 +129,7 @@ do { \
11269 "call __switch_to\n\t" \
11270 "movq "__percpu_arg([current_task])",%%rsi\n\t" \
11271 __switch_canary \
11272- "movq %P[thread_info](%%rsi),%%r8\n\t" \
11273+ "movq "__percpu_arg([thread_info])",%%r8\n\t" \
11274 "movq %%rax,%%rdi\n\t" \
11275 "testl %[_tif_fork],%P[ti_flags](%%r8)\n\t" \
11276 "jnz ret_from_fork\n\t" \
11277@@ -140,7 +140,7 @@ do { \
11278 [threadrsp] "i" (offsetof(struct task_struct, thread.sp)), \
11279 [ti_flags] "i" (offsetof(struct thread_info, flags)), \
11280 [_tif_fork] "i" (_TIF_FORK), \
11281- [thread_info] "i" (offsetof(struct task_struct, stack)), \
11282+ [thread_info] "m" (current_tinfo), \
11283 [current_task] "m" (current_task) \
11284 __switch_canary_iparam \
11285 : "memory", "cc" __EXTRA_CLOBBER)
11286@@ -200,7 +200,7 @@ static inline unsigned long get_limit(un
11287 {
11288 unsigned long __limit;
11289 asm("lsll %1,%0" : "=r" (__limit) : "r" (segment));
11290- return __limit + 1;
11291+ return __limit;
11292 }
11293
11294 static inline void native_clts(void)
11295@@ -340,12 +340,12 @@ void enable_hlt(void);
11296
11297 void cpu_idle_wait(void);
11298
11299-extern unsigned long arch_align_stack(unsigned long sp);
11300+#define arch_align_stack(x) ((x) & ~0xfUL)
11301 extern void free_init_pages(char *what, unsigned long begin, unsigned long end);
11302
11303 void default_idle(void);
11304
11305-void stop_this_cpu(void *dummy);
11306+void stop_this_cpu(void *dummy) __noreturn;
11307
11308 /*
11309 * Force strict CPU ordering.
11310diff -urNp linux-2.6.39/arch/x86/include/asm/thread_info.h linux-2.6.39/arch/x86/include/asm/thread_info.h
11311--- linux-2.6.39/arch/x86/include/asm/thread_info.h 2011-05-19 00:06:34.000000000 -0400
11312+++ linux-2.6.39/arch/x86/include/asm/thread_info.h 2011-05-22 19:36:30.000000000 -0400
11313@@ -10,6 +10,7 @@
11314 #include <linux/compiler.h>
11315 #include <asm/page.h>
11316 #include <asm/types.h>
11317+#include <asm/percpu.h>
11318
11319 /*
11320 * low level task data that entry.S needs immediate access to
11321@@ -24,7 +25,6 @@ struct exec_domain;
11322 #include <asm/atomic.h>
11323
11324 struct thread_info {
11325- struct task_struct *task; /* main task structure */
11326 struct exec_domain *exec_domain; /* execution domain */
11327 __u32 flags; /* low level flags */
11328 __u32 status; /* thread synchronous flags */
11329@@ -34,18 +34,12 @@ struct thread_info {
11330 mm_segment_t addr_limit;
11331 struct restart_block restart_block;
11332 void __user *sysenter_return;
11333-#ifdef CONFIG_X86_32
11334- unsigned long previous_esp; /* ESP of the previous stack in
11335- case of nested (IRQ) stacks
11336- */
11337- __u8 supervisor_stack[0];
11338-#endif
11339+ unsigned long lowest_stack;
11340 int uaccess_err;
11341 };
11342
11343-#define INIT_THREAD_INFO(tsk) \
11344+#define INIT_THREAD_INFO \
11345 { \
11346- .task = &tsk, \
11347 .exec_domain = &default_exec_domain, \
11348 .flags = 0, \
11349 .cpu = 0, \
11350@@ -56,7 +50,7 @@ struct thread_info {
11351 }, \
11352 }
11353
11354-#define init_thread_info (init_thread_union.thread_info)
11355+#define init_thread_info (init_thread_union.stack)
11356 #define init_stack (init_thread_union.stack)
11357
11358 #else /* !__ASSEMBLY__ */
11359@@ -170,6 +164,23 @@ struct thread_info {
11360 ret; \
11361 })
11362
11363+#ifdef __ASSEMBLY__
11364+/* how to get the thread information struct from ASM */
11365+#define GET_THREAD_INFO(reg) \
11366+ mov PER_CPU_VAR(current_tinfo), reg
11367+
11368+/* use this one if reg already contains %esp */
11369+#define GET_THREAD_INFO_WITH_ESP(reg) GET_THREAD_INFO(reg)
11370+#else
11371+/* how to get the thread information struct from C */
11372+DECLARE_PER_CPU(struct thread_info *, current_tinfo);
11373+
11374+static __always_inline struct thread_info *current_thread_info(void)
11375+{
11376+ return percpu_read_stable(current_tinfo);
11377+}
11378+#endif
11379+
11380 #ifdef CONFIG_X86_32
11381
11382 #define STACK_WARN (THREAD_SIZE/8)
11383@@ -180,35 +191,13 @@ struct thread_info {
11384 */
11385 #ifndef __ASSEMBLY__
11386
11387-
11388 /* how to get the current stack pointer from C */
11389 register unsigned long current_stack_pointer asm("esp") __used;
11390
11391-/* how to get the thread information struct from C */
11392-static inline struct thread_info *current_thread_info(void)
11393-{
11394- return (struct thread_info *)
11395- (current_stack_pointer & ~(THREAD_SIZE - 1));
11396-}
11397-
11398-#else /* !__ASSEMBLY__ */
11399-
11400-/* how to get the thread information struct from ASM */
11401-#define GET_THREAD_INFO(reg) \
11402- movl $-THREAD_SIZE, reg; \
11403- andl %esp, reg
11404-
11405-/* use this one if reg already contains %esp */
11406-#define GET_THREAD_INFO_WITH_ESP(reg) \
11407- andl $-THREAD_SIZE, reg
11408-
11409 #endif
11410
11411 #else /* X86_32 */
11412
11413-#include <asm/percpu.h>
11414-#define KERNEL_STACK_OFFSET (5*8)
11415-
11416 /*
11417 * macros/functions for gaining access to the thread information structure
11418 * preempt_count needs to be 1 initially, until the scheduler is functional.
11419@@ -216,21 +205,8 @@ static inline struct thread_info *curren
11420 #ifndef __ASSEMBLY__
11421 DECLARE_PER_CPU(unsigned long, kernel_stack);
11422
11423-static inline struct thread_info *current_thread_info(void)
11424-{
11425- struct thread_info *ti;
11426- ti = (void *)(percpu_read_stable(kernel_stack) +
11427- KERNEL_STACK_OFFSET - THREAD_SIZE);
11428- return ti;
11429-}
11430-
11431-#else /* !__ASSEMBLY__ */
11432-
11433-/* how to get the thread information struct from ASM */
11434-#define GET_THREAD_INFO(reg) \
11435- movq PER_CPU_VAR(kernel_stack),reg ; \
11436- subq $(THREAD_SIZE-KERNEL_STACK_OFFSET),reg
11437-
11438+/* how to get the current stack pointer from C */
11439+register unsigned long current_stack_pointer asm("rsp") __used;
11440 #endif
11441
11442 #endif /* !X86_32 */
11443@@ -266,5 +242,16 @@ extern void arch_task_cache_init(void);
11444 extern void free_thread_info(struct thread_info *ti);
11445 extern int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src);
11446 #define arch_task_cache_init arch_task_cache_init
11447+
11448+#define __HAVE_THREAD_FUNCTIONS
11449+#define task_thread_info(task) (&(task)->tinfo)
11450+#define task_stack_page(task) ((task)->stack)
11451+#define setup_thread_stack(p, org) do {} while (0)
11452+#define end_of_stack(p) ((unsigned long *)task_stack_page(p) + 1)
11453+
11454+#define __HAVE_ARCH_TASK_STRUCT_ALLOCATOR
11455+extern struct task_struct *alloc_task_struct_node(int node);
11456+extern void free_task_struct(struct task_struct *);
11457+
11458 #endif
11459 #endif /* _ASM_X86_THREAD_INFO_H */
11460diff -urNp linux-2.6.39/arch/x86/include/asm/uaccess_32.h linux-2.6.39/arch/x86/include/asm/uaccess_32.h
11461--- linux-2.6.39/arch/x86/include/asm/uaccess_32.h 2011-05-19 00:06:34.000000000 -0400
11462+++ linux-2.6.39/arch/x86/include/asm/uaccess_32.h 2011-05-22 19:36:30.000000000 -0400
11463@@ -44,6 +44,11 @@ unsigned long __must_check __copy_from_u
11464 static __always_inline unsigned long __must_check
11465 __copy_to_user_inatomic(void __user *to, const void *from, unsigned long n)
11466 {
11467+ pax_track_stack();
11468+
11469+ if ((long)n < 0)
11470+ return n;
11471+
11472 if (__builtin_constant_p(n)) {
11473 unsigned long ret;
11474
11475@@ -62,6 +67,8 @@ __copy_to_user_inatomic(void __user *to,
11476 return ret;
11477 }
11478 }
11479+ if (!__builtin_constant_p(n))
11480+ check_object_size(from, n, true);
11481 return __copy_to_user_ll(to, from, n);
11482 }
11483
11484@@ -83,12 +90,16 @@ static __always_inline unsigned long __m
11485 __copy_to_user(void __user *to, const void *from, unsigned long n)
11486 {
11487 might_fault();
11488+
11489 return __copy_to_user_inatomic(to, from, n);
11490 }
11491
11492 static __always_inline unsigned long
11493 __copy_from_user_inatomic(void *to, const void __user *from, unsigned long n)
11494 {
11495+ if ((long)n < 0)
11496+ return n;
11497+
11498 /* Avoid zeroing the tail if the copy fails..
11499 * If 'n' is constant and 1, 2, or 4, we do still zero on a failure,
11500 * but as the zeroing behaviour is only significant when n is not
11501@@ -138,6 +149,12 @@ static __always_inline unsigned long
11502 __copy_from_user(void *to, const void __user *from, unsigned long n)
11503 {
11504 might_fault();
11505+
11506+ pax_track_stack();
11507+
11508+ if ((long)n < 0)
11509+ return n;
11510+
11511 if (__builtin_constant_p(n)) {
11512 unsigned long ret;
11513
11514@@ -153,6 +170,8 @@ __copy_from_user(void *to, const void __
11515 return ret;
11516 }
11517 }
11518+ if (!__builtin_constant_p(n))
11519+ check_object_size(to, n, false);
11520 return __copy_from_user_ll(to, from, n);
11521 }
11522
11523@@ -160,6 +179,10 @@ static __always_inline unsigned long __c
11524 const void __user *from, unsigned long n)
11525 {
11526 might_fault();
11527+
11528+ if ((long)n < 0)
11529+ return n;
11530+
11531 if (__builtin_constant_p(n)) {
11532 unsigned long ret;
11533
11534@@ -182,15 +205,19 @@ static __always_inline unsigned long
11535 __copy_from_user_inatomic_nocache(void *to, const void __user *from,
11536 unsigned long n)
11537 {
11538- return __copy_from_user_ll_nocache_nozero(to, from, n);
11539-}
11540+ if ((long)n < 0)
11541+ return n;
11542
11543-unsigned long __must_check copy_to_user(void __user *to,
11544- const void *from, unsigned long n);
11545-unsigned long __must_check _copy_from_user(void *to,
11546- const void __user *from,
11547- unsigned long n);
11548+ return __copy_from_user_ll_nocache_nozero(to, from, n);
11549+}
11550
11551+extern void copy_to_user_overflow(void)
11552+#ifdef CONFIG_DEBUG_STRICT_USER_COPY_CHECKS
11553+ __compiletime_error("copy_to_user() buffer size is not provably correct")
11554+#else
11555+ __compiletime_warning("copy_to_user() buffer size is not provably correct")
11556+#endif
11557+;
11558
11559 extern void copy_from_user_overflow(void)
11560 #ifdef CONFIG_DEBUG_STRICT_USER_COPY_CHECKS
11561@@ -200,17 +227,61 @@ extern void copy_from_user_overflow(void
11562 #endif
11563 ;
11564
11565-static inline unsigned long __must_check copy_from_user(void *to,
11566- const void __user *from,
11567- unsigned long n)
11568+/**
11569+ * copy_to_user: - Copy a block of data into user space.
11570+ * @to: Destination address, in user space.
11571+ * @from: Source address, in kernel space.
11572+ * @n: Number of bytes to copy.
11573+ *
11574+ * Context: User context only. This function may sleep.
11575+ *
11576+ * Copy data from kernel space to user space.
11577+ *
11578+ * Returns number of bytes that could not be copied.
11579+ * On success, this will be zero.
11580+ */
11581+static inline unsigned long __must_check
11582+copy_to_user(void __user *to, const void *from, unsigned long n)
11583+{
11584+ int sz = __compiletime_object_size(from);
11585+
11586+ if (unlikely(sz != -1 && sz < n))
11587+ copy_to_user_overflow();
11588+ else if (access_ok(VERIFY_WRITE, to, n))
11589+ n = __copy_to_user(to, from, n);
11590+ return n;
11591+}
11592+
11593+/**
11594+ * copy_from_user: - Copy a block of data from user space.
11595+ * @to: Destination address, in kernel space.
11596+ * @from: Source address, in user space.
11597+ * @n: Number of bytes to copy.
11598+ *
11599+ * Context: User context only. This function may sleep.
11600+ *
11601+ * Copy data from user space to kernel space.
11602+ *
11603+ * Returns number of bytes that could not be copied.
11604+ * On success, this will be zero.
11605+ *
11606+ * If some data could not be copied, this function will pad the copied
11607+ * data to the requested size using zero bytes.
11608+ */
11609+static inline unsigned long __must_check
11610+copy_from_user(void *to, const void __user *from, unsigned long n)
11611 {
11612 int sz = __compiletime_object_size(to);
11613
11614- if (likely(sz == -1 || sz >= n))
11615- n = _copy_from_user(to, from, n);
11616- else
11617+ if (unlikely(sz != -1 && sz < n))
11618 copy_from_user_overflow();
11619-
11620+ else if (access_ok(VERIFY_READ, from, n))
11621+ n = __copy_from_user(to, from, n);
11622+ else if ((long)n > 0) {
11623+ if (!__builtin_constant_p(n))
11624+ check_object_size(to, n, false);
11625+ memset(to, 0, n);
11626+ }
11627 return n;
11628 }
11629
11630diff -urNp linux-2.6.39/arch/x86/include/asm/uaccess_64.h linux-2.6.39/arch/x86/include/asm/uaccess_64.h
11631--- linux-2.6.39/arch/x86/include/asm/uaccess_64.h 2011-05-19 00:06:34.000000000 -0400
11632+++ linux-2.6.39/arch/x86/include/asm/uaccess_64.h 2011-05-22 19:36:30.000000000 -0400
11633@@ -11,6 +11,9 @@
11634 #include <asm/alternative.h>
11635 #include <asm/cpufeature.h>
11636 #include <asm/page.h>
11637+#include <asm/pgtable.h>
11638+
11639+#define set_fs(x) (current_thread_info()->addr_limit = (x))
11640
11641 /*
11642 * Copy To/From Userspace
11643@@ -37,26 +40,26 @@ copy_user_generic(void *to, const void *
11644 return ret;
11645 }
11646
11647-__must_check unsigned long
11648-_copy_to_user(void __user *to, const void *from, unsigned len);
11649-__must_check unsigned long
11650-_copy_from_user(void *to, const void __user *from, unsigned len);
11651+static __always_inline __must_check unsigned long
11652+__copy_to_user(void __user *to, const void *from, unsigned len);
11653+static __always_inline __must_check unsigned long
11654+__copy_from_user(void *to, const void __user *from, unsigned len);
11655 __must_check unsigned long
11656 copy_in_user(void __user *to, const void __user *from, unsigned len);
11657
11658 static inline unsigned long __must_check copy_from_user(void *to,
11659 const void __user *from,
11660- unsigned long n)
11661+ unsigned n)
11662 {
11663- int sz = __compiletime_object_size(to);
11664-
11665 might_fault();
11666- if (likely(sz == -1 || sz >= n))
11667- n = _copy_from_user(to, from, n);
11668-#ifdef CONFIG_DEBUG_VM
11669- else
11670- WARN(1, "Buffer overflow detected!\n");
11671-#endif
11672+
11673+ if (access_ok(VERIFY_READ, from, n))
11674+ n = __copy_from_user(to, from, n);
11675+ else if ((int)n > 0) {
11676+ if (!__builtin_constant_p(n))
11677+ check_object_size(to, n, false);
11678+ memset(to, 0, n);
11679+ }
11680 return n;
11681 }
11682
11683@@ -65,110 +68,198 @@ int copy_to_user(void __user *dst, const
11684 {
11685 might_fault();
11686
11687- return _copy_to_user(dst, src, size);
11688+ if (access_ok(VERIFY_WRITE, dst, size))
11689+ size = __copy_to_user(dst, src, size);
11690+ return size;
11691 }
11692
11693 static __always_inline __must_check
11694-int __copy_from_user(void *dst, const void __user *src, unsigned size)
11695+unsigned long __copy_from_user(void *dst, const void __user *src, unsigned size)
11696 {
11697- int ret = 0;
11698+ int sz = __compiletime_object_size(dst);
11699+ unsigned ret = 0;
11700
11701 might_fault();
11702- if (!__builtin_constant_p(size))
11703- return copy_user_generic(dst, (__force void *)src, size);
11704+
11705+ pax_track_stack();
11706+
11707+ if ((int)size < 0)
11708+ return size;
11709+
11710+#ifdef CONFIG_PAX_MEMORY_UDEREF
11711+ if (!__access_ok(VERIFY_READ, src, size))
11712+ return size;
11713+#endif
11714+
11715+ if (unlikely(sz != -1 && sz < size)) {
11716+#ifdef CONFIG_DEBUG_VM
11717+ WARN(1, "Buffer overflow detected!\n");
11718+#endif
11719+ return size;
11720+ }
11721+
11722+ if (!__builtin_constant_p(size)) {
11723+ check_object_size(dst, size, false);
11724+
11725+#ifdef CONFIG_PAX_MEMORY_UDEREF
11726+ if ((unsigned long)src < PAX_USER_SHADOW_BASE)
11727+ src += PAX_USER_SHADOW_BASE;
11728+#endif
11729+
11730+ return copy_user_generic(dst, (__force const void *)src, size);
11731+ }
11732 switch (size) {
11733- case 1:__get_user_asm(*(u8 *)dst, (u8 __user *)src,
11734+ case 1:__get_user_asm(*(u8 *)dst, (const u8 __user *)src,
11735 ret, "b", "b", "=q", 1);
11736 return ret;
11737- case 2:__get_user_asm(*(u16 *)dst, (u16 __user *)src,
11738+ case 2:__get_user_asm(*(u16 *)dst, (const u16 __user *)src,
11739 ret, "w", "w", "=r", 2);
11740 return ret;
11741- case 4:__get_user_asm(*(u32 *)dst, (u32 __user *)src,
11742+ case 4:__get_user_asm(*(u32 *)dst, (const u32 __user *)src,
11743 ret, "l", "k", "=r", 4);
11744 return ret;
11745- case 8:__get_user_asm(*(u64 *)dst, (u64 __user *)src,
11746+ case 8:__get_user_asm(*(u64 *)dst, (const u64 __user *)src,
11747 ret, "q", "", "=r", 8);
11748 return ret;
11749 case 10:
11750- __get_user_asm(*(u64 *)dst, (u64 __user *)src,
11751+ __get_user_asm(*(u64 *)dst, (const u64 __user *)src,
11752 ret, "q", "", "=r", 10);
11753 if (unlikely(ret))
11754 return ret;
11755 __get_user_asm(*(u16 *)(8 + (char *)dst),
11756- (u16 __user *)(8 + (char __user *)src),
11757+ (const u16 __user *)(8 + (const char __user *)src),
11758 ret, "w", "w", "=r", 2);
11759 return ret;
11760 case 16:
11761- __get_user_asm(*(u64 *)dst, (u64 __user *)src,
11762+ __get_user_asm(*(u64 *)dst, (const u64 __user *)src,
11763 ret, "q", "", "=r", 16);
11764 if (unlikely(ret))
11765 return ret;
11766 __get_user_asm(*(u64 *)(8 + (char *)dst),
11767- (u64 __user *)(8 + (char __user *)src),
11768+ (const u64 __user *)(8 + (const char __user *)src),
11769 ret, "q", "", "=r", 8);
11770 return ret;
11771 default:
11772- return copy_user_generic(dst, (__force void *)src, size);
11773+
11774+#ifdef CONFIG_PAX_MEMORY_UDEREF
11775+ if ((unsigned long)src < PAX_USER_SHADOW_BASE)
11776+ src += PAX_USER_SHADOW_BASE;
11777+#endif
11778+
11779+ return copy_user_generic(dst, (__force const void *)src, size);
11780 }
11781 }
11782
11783 static __always_inline __must_check
11784-int __copy_to_user(void __user *dst, const void *src, unsigned size)
11785+unsigned long __copy_to_user(void __user *dst, const void *src, unsigned size)
11786 {
11787- int ret = 0;
11788+ int sz = __compiletime_object_size(src);
11789+ unsigned ret = 0;
11790
11791 might_fault();
11792- if (!__builtin_constant_p(size))
11793+
11794+ pax_track_stack();
11795+
11796+ if ((int)size < 0)
11797+ return size;
11798+
11799+#ifdef CONFIG_PAX_MEMORY_UDEREF
11800+ if (!__access_ok(VERIFY_WRITE, dst, size))
11801+ return size;
11802+#endif
11803+
11804+ if (unlikely(sz != -1 && sz < size)) {
11805+#ifdef CONFIG_DEBUG_VM
11806+ WARN(1, "Buffer overflow detected!\n");
11807+#endif
11808+ return size;
11809+ }
11810+
11811+ if (!__builtin_constant_p(size)) {
11812+ check_object_size(src, size, true);
11813+
11814+#ifdef CONFIG_PAX_MEMORY_UDEREF
11815+ if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
11816+ dst += PAX_USER_SHADOW_BASE;
11817+#endif
11818+
11819 return copy_user_generic((__force void *)dst, src, size);
11820+ }
11821 switch (size) {
11822- case 1:__put_user_asm(*(u8 *)src, (u8 __user *)dst,
11823+ case 1:__put_user_asm(*(const u8 *)src, (u8 __user *)dst,
11824 ret, "b", "b", "iq", 1);
11825 return ret;
11826- case 2:__put_user_asm(*(u16 *)src, (u16 __user *)dst,
11827+ case 2:__put_user_asm(*(const u16 *)src, (u16 __user *)dst,
11828 ret, "w", "w", "ir", 2);
11829 return ret;
11830- case 4:__put_user_asm(*(u32 *)src, (u32 __user *)dst,
11831+ case 4:__put_user_asm(*(const u32 *)src, (u32 __user *)dst,
11832 ret, "l", "k", "ir", 4);
11833 return ret;
11834- case 8:__put_user_asm(*(u64 *)src, (u64 __user *)dst,
11835+ case 8:__put_user_asm(*(const u64 *)src, (u64 __user *)dst,
11836 ret, "q", "", "er", 8);
11837 return ret;
11838 case 10:
11839- __put_user_asm(*(u64 *)src, (u64 __user *)dst,
11840+ __put_user_asm(*(const u64 *)src, (u64 __user *)dst,
11841 ret, "q", "", "er", 10);
11842 if (unlikely(ret))
11843 return ret;
11844 asm("":::"memory");
11845- __put_user_asm(4[(u16 *)src], 4 + (u16 __user *)dst,
11846+ __put_user_asm(4[(const u16 *)src], 4 + (u16 __user *)dst,
11847 ret, "w", "w", "ir", 2);
11848 return ret;
11849 case 16:
11850- __put_user_asm(*(u64 *)src, (u64 __user *)dst,
11851+ __put_user_asm(*(const u64 *)src, (u64 __user *)dst,
11852 ret, "q", "", "er", 16);
11853 if (unlikely(ret))
11854 return ret;
11855 asm("":::"memory");
11856- __put_user_asm(1[(u64 *)src], 1 + (u64 __user *)dst,
11857+ __put_user_asm(1[(const u64 *)src], 1 + (u64 __user *)dst,
11858 ret, "q", "", "er", 8);
11859 return ret;
11860 default:
11861+
11862+#ifdef CONFIG_PAX_MEMORY_UDEREF
11863+ if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
11864+ dst += PAX_USER_SHADOW_BASE;
11865+#endif
11866+
11867 return copy_user_generic((__force void *)dst, src, size);
11868 }
11869 }
11870
11871 static __always_inline __must_check
11872-int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
11873+unsigned long __copy_in_user(void __user *dst, const void __user *src, unsigned size)
11874 {
11875- int ret = 0;
11876+ unsigned ret = 0;
11877
11878 might_fault();
11879- if (!__builtin_constant_p(size))
11880+
11881+ if ((int)size < 0)
11882+ return size;
11883+
11884+#ifdef CONFIG_PAX_MEMORY_UDEREF
11885+ if (!__access_ok(VERIFY_READ, src, size))
11886+ return size;
11887+ if (!__access_ok(VERIFY_WRITE, dst, size))
11888+ return size;
11889+#endif
11890+
11891+ if (!__builtin_constant_p(size)) {
11892+
11893+#ifdef CONFIG_PAX_MEMORY_UDEREF
11894+ if ((unsigned long)src < PAX_USER_SHADOW_BASE)
11895+ src += PAX_USER_SHADOW_BASE;
11896+ if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
11897+ dst += PAX_USER_SHADOW_BASE;
11898+#endif
11899+
11900 return copy_user_generic((__force void *)dst,
11901- (__force void *)src, size);
11902+ (__force const void *)src, size);
11903+ }
11904 switch (size) {
11905 case 1: {
11906 u8 tmp;
11907- __get_user_asm(tmp, (u8 __user *)src,
11908+ __get_user_asm(tmp, (const u8 __user *)src,
11909 ret, "b", "b", "=q", 1);
11910 if (likely(!ret))
11911 __put_user_asm(tmp, (u8 __user *)dst,
11912@@ -177,7 +268,7 @@ int __copy_in_user(void __user *dst, con
11913 }
11914 case 2: {
11915 u16 tmp;
11916- __get_user_asm(tmp, (u16 __user *)src,
11917+ __get_user_asm(tmp, (const u16 __user *)src,
11918 ret, "w", "w", "=r", 2);
11919 if (likely(!ret))
11920 __put_user_asm(tmp, (u16 __user *)dst,
11921@@ -187,7 +278,7 @@ int __copy_in_user(void __user *dst, con
11922
11923 case 4: {
11924 u32 tmp;
11925- __get_user_asm(tmp, (u32 __user *)src,
11926+ __get_user_asm(tmp, (const u32 __user *)src,
11927 ret, "l", "k", "=r", 4);
11928 if (likely(!ret))
11929 __put_user_asm(tmp, (u32 __user *)dst,
11930@@ -196,7 +287,7 @@ int __copy_in_user(void __user *dst, con
11931 }
11932 case 8: {
11933 u64 tmp;
11934- __get_user_asm(tmp, (u64 __user *)src,
11935+ __get_user_asm(tmp, (const u64 __user *)src,
11936 ret, "q", "", "=r", 8);
11937 if (likely(!ret))
11938 __put_user_asm(tmp, (u64 __user *)dst,
11939@@ -204,8 +295,16 @@ int __copy_in_user(void __user *dst, con
11940 return ret;
11941 }
11942 default:
11943+
11944+#ifdef CONFIG_PAX_MEMORY_UDEREF
11945+ if ((unsigned long)src < PAX_USER_SHADOW_BASE)
11946+ src += PAX_USER_SHADOW_BASE;
11947+ if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
11948+ dst += PAX_USER_SHADOW_BASE;
11949+#endif
11950+
11951 return copy_user_generic((__force void *)dst,
11952- (__force void *)src, size);
11953+ (__force const void *)src, size);
11954 }
11955 }
11956
11957@@ -222,33 +321,72 @@ __must_check unsigned long __clear_user(
11958 static __must_check __always_inline int
11959 __copy_from_user_inatomic(void *dst, const void __user *src, unsigned size)
11960 {
11961+ pax_track_stack();
11962+
11963+ if ((int)size < 0)
11964+ return size;
11965+
11966+#ifdef CONFIG_PAX_MEMORY_UDEREF
11967+ if (!__access_ok(VERIFY_READ, src, size))
11968+ return size;
11969+
11970+ if ((unsigned long)src < PAX_USER_SHADOW_BASE)
11971+ src += PAX_USER_SHADOW_BASE;
11972+#endif
11973+
11974 return copy_user_generic(dst, (__force const void *)src, size);
11975 }
11976
11977-static __must_check __always_inline int
11978+static __must_check __always_inline unsigned long
11979 __copy_to_user_inatomic(void __user *dst, const void *src, unsigned size)
11980 {
11981+ if ((int)size < 0)
11982+ return size;
11983+
11984+#ifdef CONFIG_PAX_MEMORY_UDEREF
11985+ if (!__access_ok(VERIFY_WRITE, dst, size))
11986+ return size;
11987+
11988+ if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
11989+ dst += PAX_USER_SHADOW_BASE;
11990+#endif
11991+
11992 return copy_user_generic((__force void *)dst, src, size);
11993 }
11994
11995-extern long __copy_user_nocache(void *dst, const void __user *src,
11996+extern unsigned long __copy_user_nocache(void *dst, const void __user *src,
11997 unsigned size, int zerorest);
11998
11999-static inline int
12000-__copy_from_user_nocache(void *dst, const void __user *src, unsigned size)
12001+static inline unsigned long __copy_from_user_nocache(void *dst, const void __user *src, unsigned size)
12002 {
12003 might_sleep();
12004+
12005+ if ((int)size < 0)
12006+ return size;
12007+
12008+#ifdef CONFIG_PAX_MEMORY_UDEREF
12009+ if (!__access_ok(VERIFY_READ, src, size))
12010+ return size;
12011+#endif
12012+
12013 return __copy_user_nocache(dst, src, size, 1);
12014 }
12015
12016-static inline int
12017-__copy_from_user_inatomic_nocache(void *dst, const void __user *src,
12018+static inline unsigned long __copy_from_user_inatomic_nocache(void *dst, const void __user *src,
12019 unsigned size)
12020 {
12021+ if ((int)size < 0)
12022+ return size;
12023+
12024+#ifdef CONFIG_PAX_MEMORY_UDEREF
12025+ if (!__access_ok(VERIFY_READ, src, size))
12026+ return size;
12027+#endif
12028+
12029 return __copy_user_nocache(dst, src, size, 0);
12030 }
12031
12032-unsigned long
12033+extern unsigned long
12034 copy_user_handle_tail(char *to, char *from, unsigned len, unsigned zerorest);
12035
12036 #endif /* _ASM_X86_UACCESS_64_H */
12037diff -urNp linux-2.6.39/arch/x86/include/asm/uaccess.h linux-2.6.39/arch/x86/include/asm/uaccess.h
12038--- linux-2.6.39/arch/x86/include/asm/uaccess.h 2011-05-19 00:06:34.000000000 -0400
12039+++ linux-2.6.39/arch/x86/include/asm/uaccess.h 2011-05-22 19:36:30.000000000 -0400
12040@@ -8,12 +8,15 @@
12041 #include <linux/thread_info.h>
12042 #include <linux/prefetch.h>
12043 #include <linux/string.h>
12044+#include <linux/sched.h>
12045 #include <asm/asm.h>
12046 #include <asm/page.h>
12047
12048 #define VERIFY_READ 0
12049 #define VERIFY_WRITE 1
12050
12051+extern void check_object_size(const void *ptr, unsigned long n, bool to);
12052+
12053 /*
12054 * The fs value determines whether argument validity checking should be
12055 * performed or not. If get_fs() == USER_DS, checking is performed, with
12056@@ -29,7 +32,12 @@
12057
12058 #define get_ds() (KERNEL_DS)
12059 #define get_fs() (current_thread_info()->addr_limit)
12060+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
12061+void __set_fs(mm_segment_t x);
12062+void set_fs(mm_segment_t x);
12063+#else
12064 #define set_fs(x) (current_thread_info()->addr_limit = (x))
12065+#endif
12066
12067 #define segment_eq(a, b) ((a).seg == (b).seg)
12068
12069@@ -77,7 +85,33 @@
12070 * checks that the pointer is in the user space range - after calling
12071 * this function, memory access functions may still return -EFAULT.
12072 */
12073-#define access_ok(type, addr, size) (likely(__range_not_ok(addr, size) == 0))
12074+#define __access_ok(type, addr, size) (likely(__range_not_ok(addr, size) == 0))
12075+#define access_ok(type, addr, size) \
12076+({ \
12077+ long __size = size; \
12078+ unsigned long __addr = (unsigned long)addr; \
12079+ unsigned long __addr_ao = __addr & PAGE_MASK; \
12080+ unsigned long __end_ao = __addr + __size - 1; \
12081+ bool __ret_ao = __range_not_ok(__addr, __size) == 0; \
12082+ if (__ret_ao && unlikely((__end_ao ^ __addr_ao) & PAGE_MASK)) { \
12083+ while(__addr_ao <= __end_ao) { \
12084+ char __c_ao; \
12085+ __addr_ao += PAGE_SIZE; \
12086+ if (__size > PAGE_SIZE) \
12087+ cond_resched(); \
12088+ if (__get_user(__c_ao, (char __user *)__addr)) \
12089+ break; \
12090+ if (type != VERIFY_WRITE) { \
12091+ __addr = __addr_ao; \
12092+ continue; \
12093+ } \
12094+ if (__put_user(__c_ao, (char __user *)__addr)) \
12095+ break; \
12096+ __addr = __addr_ao; \
12097+ } \
12098+ } \
12099+ __ret_ao; \
12100+})
12101
12102 /*
12103 * The exception table consists of pairs of addresses: the first is the
12104@@ -183,12 +217,20 @@ extern int __get_user_bad(void);
12105 asm volatile("call __put_user_" #size : "=a" (__ret_pu) \
12106 : "0" ((typeof(*(ptr)))(x)), "c" (ptr) : "ebx")
12107
12108-
12109+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
12110+#define __copyuser_seg "gs;"
12111+#define __COPYUSER_SET_ES "pushl %%gs; popl %%es\n"
12112+#define __COPYUSER_RESTORE_ES "pushl %%ss; popl %%es\n"
12113+#else
12114+#define __copyuser_seg
12115+#define __COPYUSER_SET_ES
12116+#define __COPYUSER_RESTORE_ES
12117+#endif
12118
12119 #ifdef CONFIG_X86_32
12120 #define __put_user_asm_u64(x, addr, err, errret) \
12121- asm volatile("1: movl %%eax,0(%2)\n" \
12122- "2: movl %%edx,4(%2)\n" \
12123+ asm volatile("1: "__copyuser_seg"movl %%eax,0(%2)\n" \
12124+ "2: "__copyuser_seg"movl %%edx,4(%2)\n" \
12125 "3:\n" \
12126 ".section .fixup,\"ax\"\n" \
12127 "4: movl %3,%0\n" \
12128@@ -200,8 +242,8 @@ extern int __get_user_bad(void);
12129 : "A" (x), "r" (addr), "i" (errret), "0" (err))
12130
12131 #define __put_user_asm_ex_u64(x, addr) \
12132- asm volatile("1: movl %%eax,0(%1)\n" \
12133- "2: movl %%edx,4(%1)\n" \
12134+ asm volatile("1: "__copyuser_seg"movl %%eax,0(%1)\n" \
12135+ "2: "__copyuser_seg"movl %%edx,4(%1)\n" \
12136 "3:\n" \
12137 _ASM_EXTABLE(1b, 2b - 1b) \
12138 _ASM_EXTABLE(2b, 3b - 2b) \
12139@@ -374,7 +416,7 @@ do { \
12140 } while (0)
12141
12142 #define __get_user_asm(x, addr, err, itype, rtype, ltype, errret) \
12143- asm volatile("1: mov"itype" %2,%"rtype"1\n" \
12144+ asm volatile("1: "__copyuser_seg"mov"itype" %2,%"rtype"1\n"\
12145 "2:\n" \
12146 ".section .fixup,\"ax\"\n" \
12147 "3: mov %3,%0\n" \
12148@@ -382,7 +424,7 @@ do { \
12149 " jmp 2b\n" \
12150 ".previous\n" \
12151 _ASM_EXTABLE(1b, 3b) \
12152- : "=r" (err), ltype(x) \
12153+ : "=r" (err), ltype (x) \
12154 : "m" (__m(addr)), "i" (errret), "0" (err))
12155
12156 #define __get_user_size_ex(x, ptr, size) \
12157@@ -407,7 +449,7 @@ do { \
12158 } while (0)
12159
12160 #define __get_user_asm_ex(x, addr, itype, rtype, ltype) \
12161- asm volatile("1: mov"itype" %1,%"rtype"0\n" \
12162+ asm volatile("1: "__copyuser_seg"mov"itype" %1,%"rtype"0\n"\
12163 "2:\n" \
12164 _ASM_EXTABLE(1b, 2b - 1b) \
12165 : ltype(x) : "m" (__m(addr)))
12166@@ -424,13 +466,24 @@ do { \
12167 int __gu_err; \
12168 unsigned long __gu_val; \
12169 __get_user_size(__gu_val, (ptr), (size), __gu_err, -EFAULT); \
12170- (x) = (__force __typeof__(*(ptr)))__gu_val; \
12171+ (x) = (__typeof__(*(ptr)))__gu_val; \
12172 __gu_err; \
12173 })
12174
12175 /* FIXME: this hack is definitely wrong -AK */
12176 struct __large_struct { unsigned long buf[100]; };
12177-#define __m(x) (*(struct __large_struct __user *)(x))
12178+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
12179+#define ____m(x) \
12180+({ \
12181+ unsigned long ____x = (unsigned long)(x); \
12182+ if (____x < PAX_USER_SHADOW_BASE) \
12183+ ____x += PAX_USER_SHADOW_BASE; \
12184+ (void __user *)____x; \
12185+})
12186+#else
12187+#define ____m(x) (x)
12188+#endif
12189+#define __m(x) (*(struct __large_struct __user *)____m(x))
12190
12191 /*
12192 * Tell gcc we read from memory instead of writing: this is because
12193@@ -438,7 +491,7 @@ struct __large_struct { unsigned long bu
12194 * aliasing issues.
12195 */
12196 #define __put_user_asm(x, addr, err, itype, rtype, ltype, errret) \
12197- asm volatile("1: mov"itype" %"rtype"1,%2\n" \
12198+ asm volatile("1: "__copyuser_seg"mov"itype" %"rtype"1,%2\n"\
12199 "2:\n" \
12200 ".section .fixup,\"ax\"\n" \
12201 "3: mov %3,%0\n" \
12202@@ -446,10 +499,10 @@ struct __large_struct { unsigned long bu
12203 ".previous\n" \
12204 _ASM_EXTABLE(1b, 3b) \
12205 : "=r"(err) \
12206- : ltype(x), "m" (__m(addr)), "i" (errret), "0" (err))
12207+ : ltype (x), "m" (__m(addr)), "i" (errret), "0" (err))
12208
12209 #define __put_user_asm_ex(x, addr, itype, rtype, ltype) \
12210- asm volatile("1: mov"itype" %"rtype"0,%1\n" \
12211+ asm volatile("1: "__copyuser_seg"mov"itype" %"rtype"0,%1\n"\
12212 "2:\n" \
12213 _ASM_EXTABLE(1b, 2b - 1b) \
12214 : : ltype(x), "m" (__m(addr)))
12215@@ -488,8 +541,12 @@ struct __large_struct { unsigned long bu
12216 * On error, the variable @x is set to zero.
12217 */
12218
12219+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
12220+#define __get_user(x, ptr) get_user((x), (ptr))
12221+#else
12222 #define __get_user(x, ptr) \
12223 __get_user_nocheck((x), (ptr), sizeof(*(ptr)))
12224+#endif
12225
12226 /**
12227 * __put_user: - Write a simple value into user space, with less checking.
12228@@ -511,8 +568,12 @@ struct __large_struct { unsigned long bu
12229 * Returns zero on success, or -EFAULT on error.
12230 */
12231
12232+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
12233+#define __put_user(x, ptr) put_user((x), (ptr))
12234+#else
12235 #define __put_user(x, ptr) \
12236 __put_user_nocheck((__typeof__(*(ptr)))(x), (ptr), sizeof(*(ptr)))
12237+#endif
12238
12239 #define __get_user_unaligned __get_user
12240 #define __put_user_unaligned __put_user
12241@@ -530,7 +591,7 @@ struct __large_struct { unsigned long bu
12242 #define get_user_ex(x, ptr) do { \
12243 unsigned long __gue_val; \
12244 __get_user_size_ex((__gue_val), (ptr), (sizeof(*(ptr)))); \
12245- (x) = (__force __typeof__(*(ptr)))__gue_val; \
12246+ (x) = (__typeof__(*(ptr)))__gue_val; \
12247 } while (0)
12248
12249 #ifdef CONFIG_X86_WP_WORKS_OK
12250@@ -567,6 +628,7 @@ extern struct movsl_mask {
12251
12252 #define ARCH_HAS_NOCACHE_UACCESS 1
12253
12254+#define ARCH_HAS_SORT_EXTABLE
12255 #ifdef CONFIG_X86_32
12256 # include "uaccess_32.h"
12257 #else
12258diff -urNp linux-2.6.39/arch/x86/include/asm/vgtod.h linux-2.6.39/arch/x86/include/asm/vgtod.h
12259--- linux-2.6.39/arch/x86/include/asm/vgtod.h 2011-05-19 00:06:34.000000000 -0400
12260+++ linux-2.6.39/arch/x86/include/asm/vgtod.h 2011-05-22 19:36:30.000000000 -0400
12261@@ -14,6 +14,7 @@ struct vsyscall_gtod_data {
12262 int sysctl_enabled;
12263 struct timezone sys_tz;
12264 struct { /* extract of a clocksource struct */
12265+ char name[8];
12266 cycle_t (*vread)(void);
12267 cycle_t cycle_last;
12268 cycle_t mask;
12269diff -urNp linux-2.6.39/arch/x86/include/asm/vsyscall.h linux-2.6.39/arch/x86/include/asm/vsyscall.h
12270--- linux-2.6.39/arch/x86/include/asm/vsyscall.h 2011-05-19 00:06:34.000000000 -0400
12271+++ linux-2.6.39/arch/x86/include/asm/vsyscall.h 2011-05-22 19:36:30.000000000 -0400
12272@@ -15,9 +15,10 @@ enum vsyscall_num {
12273
12274 #ifdef __KERNEL__
12275 #include <linux/seqlock.h>
12276+#include <linux/getcpu.h>
12277+#include <linux/time.h>
12278
12279 #define __section_vgetcpu_mode __attribute__ ((unused, __section__ (".vgetcpu_mode"), aligned(16)))
12280-#define __section_jiffies __attribute__ ((unused, __section__ (".jiffies"), aligned(16)))
12281
12282 /* Definitions for CONFIG_GENERIC_TIME definitions */
12283 #define __section_vsyscall_gtod_data __attribute__ \
12284@@ -31,7 +32,6 @@ enum vsyscall_num {
12285 #define VGETCPU_LSL 2
12286
12287 extern int __vgetcpu_mode;
12288-extern volatile unsigned long __jiffies;
12289
12290 /* kernel space (writeable) */
12291 extern int vgetcpu_mode;
12292@@ -39,6 +39,9 @@ extern struct timezone sys_tz;
12293
12294 extern void map_vsyscall(void);
12295
12296+extern int vgettimeofday(struct timeval * tv, struct timezone * tz);
12297+extern time_t vtime(time_t *t);
12298+extern long vgetcpu(unsigned *cpu, unsigned *node, struct getcpu_cache *tcache);
12299 #endif /* __KERNEL__ */
12300
12301 #endif /* _ASM_X86_VSYSCALL_H */
12302diff -urNp linux-2.6.39/arch/x86/include/asm/xen/pci.h linux-2.6.39/arch/x86/include/asm/xen/pci.h
12303--- linux-2.6.39/arch/x86/include/asm/xen/pci.h 2011-05-19 00:06:34.000000000 -0400
12304+++ linux-2.6.39/arch/x86/include/asm/xen/pci.h 2011-05-22 19:36:30.000000000 -0400
12305@@ -33,7 +33,7 @@ struct xen_pci_frontend_ops {
12306 void (*disable_msix)(struct pci_dev *dev);
12307 };
12308
12309-extern struct xen_pci_frontend_ops *xen_pci_frontend;
12310+extern const struct xen_pci_frontend_ops *xen_pci_frontend;
12311
12312 static inline int xen_pci_frontend_enable_msi(struct pci_dev *dev,
12313 int vectors[])
12314diff -urNp linux-2.6.39/arch/x86/include/asm/xsave.h linux-2.6.39/arch/x86/include/asm/xsave.h
12315--- linux-2.6.39/arch/x86/include/asm/xsave.h 2011-05-19 00:06:34.000000000 -0400
12316+++ linux-2.6.39/arch/x86/include/asm/xsave.h 2011-05-22 19:36:30.000000000 -0400
12317@@ -65,6 +65,11 @@ static inline int xsave_user(struct xsav
12318 {
12319 int err;
12320
12321+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
12322+ if ((unsigned long)buf < PAX_USER_SHADOW_BASE)
12323+ buf = (struct xsave_struct __user *)((void __user*)buf + PAX_USER_SHADOW_BASE);
12324+#endif
12325+
12326 /*
12327 * Clear the xsave header first, so that reserved fields are
12328 * initialized to zero.
12329@@ -100,6 +105,11 @@ static inline int xrestore_user(struct x
12330 u32 lmask = mask;
12331 u32 hmask = mask >> 32;
12332
12333+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
12334+ if ((unsigned long)xstate < PAX_USER_SHADOW_BASE)
12335+ xstate = (struct xsave_struct *)((void *)xstate + PAX_USER_SHADOW_BASE);
12336+#endif
12337+
12338 __asm__ __volatile__("1: .byte " REX_PREFIX "0x0f,0xae,0x2f\n"
12339 "2:\n"
12340 ".section .fixup,\"ax\"\n"
12341diff -urNp linux-2.6.39/arch/x86/Kconfig linux-2.6.39/arch/x86/Kconfig
12342--- linux-2.6.39/arch/x86/Kconfig 2011-05-19 00:06:34.000000000 -0400
12343+++ linux-2.6.39/arch/x86/Kconfig 2011-05-22 19:41:32.000000000 -0400
12344@@ -224,7 +224,7 @@ config X86_HT
12345
12346 config X86_32_LAZY_GS
12347 def_bool y
12348- depends on X86_32 && !CC_STACKPROTECTOR
12349+ depends on X86_32 && !CC_STACKPROTECTOR && !PAX_MEMORY_UDEREF
12350
12351 config ARCH_HWEIGHT_CFLAGS
12352 string
12353@@ -1022,7 +1022,7 @@ choice
12354
12355 config NOHIGHMEM
12356 bool "off"
12357- depends on !X86_NUMAQ
12358+ depends on !X86_NUMAQ && !(PAX_PAGEEXEC && PAX_ENABLE_PAE)
12359 ---help---
12360 Linux can use up to 64 Gigabytes of physical memory on x86 systems.
12361 However, the address space of 32-bit x86 processors is only 4
12362@@ -1059,7 +1059,7 @@ config NOHIGHMEM
12363
12364 config HIGHMEM4G
12365 bool "4GB"
12366- depends on !X86_NUMAQ
12367+ depends on !X86_NUMAQ && !(PAX_PAGEEXEC && PAX_ENABLE_PAE)
12368 ---help---
12369 Select this if you have a 32-bit processor and between 1 and 4
12370 gigabytes of physical RAM.
12371@@ -1113,7 +1113,7 @@ config PAGE_OFFSET
12372 hex
12373 default 0xB0000000 if VMSPLIT_3G_OPT
12374 default 0x80000000 if VMSPLIT_2G
12375- default 0x78000000 if VMSPLIT_2G_OPT
12376+ default 0x70000000 if VMSPLIT_2G_OPT
12377 default 0x40000000 if VMSPLIT_1G
12378 default 0xC0000000
12379 depends on X86_32
12380@@ -1457,7 +1457,7 @@ config ARCH_USES_PG_UNCACHED
12381
12382 config EFI
12383 bool "EFI runtime service support"
12384- depends on ACPI
12385+ depends on ACPI && !PAX_KERNEXEC
12386 ---help---
12387 This enables the kernel to use EFI runtime services that are
12388 available (such as the EFI variable services).
12389@@ -1487,6 +1487,7 @@ config SECCOMP
12390
12391 config CC_STACKPROTECTOR
12392 bool "Enable -fstack-protector buffer overflow detection (EXPERIMENTAL)"
12393+ depends on X86_64 || !PAX_MEMORY_UDEREF
12394 ---help---
12395 This option turns on the -fstack-protector GCC feature. This
12396 feature puts, at the beginning of functions, a canary value on
12397@@ -1544,6 +1545,7 @@ config KEXEC_JUMP
12398 config PHYSICAL_START
12399 hex "Physical address where the kernel is loaded" if (EXPERT || CRASH_DUMP)
12400 default "0x1000000"
12401+ range 0x400000 0x40000000
12402 ---help---
12403 This gives the physical address where the kernel is loaded.
12404
12405@@ -1607,6 +1609,7 @@ config X86_NEED_RELOCS
12406 config PHYSICAL_ALIGN
12407 hex "Alignment value to which kernel should be aligned" if X86_32
12408 default "0x1000000"
12409+ range 0x400000 0x1000000 if PAX_KERNEXEC
12410 range 0x2000 0x1000000
12411 ---help---
12412 This value puts the alignment restrictions on physical address
12413@@ -1638,9 +1641,10 @@ config HOTPLUG_CPU
12414 Say N if you want to disable CPU hotplug.
12415
12416 config COMPAT_VDSO
12417- def_bool y
12418+ def_bool n
12419 prompt "Compat VDSO support"
12420 depends on X86_32 || IA32_EMULATION
12421+ depends on !PAX_NOEXEC && !PAX_MEMORY_UDEREF
12422 ---help---
12423 Map the 32-bit VDSO to the predictable old-style address too.
12424
12425diff -urNp linux-2.6.39/arch/x86/Kconfig.cpu linux-2.6.39/arch/x86/Kconfig.cpu
12426--- linux-2.6.39/arch/x86/Kconfig.cpu 2011-05-19 00:06:34.000000000 -0400
12427+++ linux-2.6.39/arch/x86/Kconfig.cpu 2011-05-22 19:36:30.000000000 -0400
12428@@ -334,7 +334,7 @@ config X86_PPRO_FENCE
12429
12430 config X86_F00F_BUG
12431 def_bool y
12432- depends on M586MMX || M586TSC || M586 || M486 || M386
12433+ depends on (M586MMX || M586TSC || M586 || M486 || M386) && !PAX_KERNEXEC
12434
12435 config X86_INVD_BUG
12436 def_bool y
12437@@ -358,7 +358,7 @@ config X86_POPAD_OK
12438
12439 config X86_ALIGNMENT_16
12440 def_bool y
12441- depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || X86_ELAN || MK6 || M586MMX || M586TSC || M586 || M486 || MVIAC3_2 || MGEODEGX1
12442+ depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || X86_ELAN || MK8 || MK7 || MK6 || MCORE2 || MPENTIUM4 || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || M586 || M486 || MVIAC3_2 || MGEODEGX1
12443
12444 config X86_INTEL_USERCOPY
12445 def_bool y
12446@@ -404,7 +404,7 @@ config X86_CMPXCHG64
12447 # generates cmov.
12448 config X86_CMOV
12449 def_bool y
12450- depends on (MK8 || MK7 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM || MGEODE_LX)
12451+ depends on (MK8 || MK7 || MCORE2 || MPSC || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM || MGEODE_LX)
12452
12453 config X86_MINIMUM_CPU_FAMILY
12454 int
12455diff -urNp linux-2.6.39/arch/x86/Kconfig.debug linux-2.6.39/arch/x86/Kconfig.debug
12456--- linux-2.6.39/arch/x86/Kconfig.debug 2011-05-19 00:06:34.000000000 -0400
12457+++ linux-2.6.39/arch/x86/Kconfig.debug 2011-05-22 19:36:30.000000000 -0400
12458@@ -101,7 +101,7 @@ config X86_PTDUMP
12459 config DEBUG_RODATA
12460 bool "Write protect kernel read-only data structures"
12461 default y
12462- depends on DEBUG_KERNEL
12463+ depends on DEBUG_KERNEL && BROKEN
12464 ---help---
12465 Mark the kernel read-only data as write-protected in the pagetables,
12466 in order to catch accidental (and incorrect) writes to such const
12467@@ -119,7 +119,7 @@ config DEBUG_RODATA_TEST
12468
12469 config DEBUG_SET_MODULE_RONX
12470 bool "Set loadable kernel module data as NX and text as RO"
12471- depends on MODULES
12472+ depends on MODULES && BROKEN
12473 ---help---
12474 This option helps catch unintended modifications to loadable
12475 kernel module's text and read-only data. It also prevents execution
12476diff -urNp linux-2.6.39/arch/x86/kernel/acpi/sleep.c linux-2.6.39/arch/x86/kernel/acpi/sleep.c
12477--- linux-2.6.39/arch/x86/kernel/acpi/sleep.c 2011-05-19 00:06:34.000000000 -0400
12478+++ linux-2.6.39/arch/x86/kernel/acpi/sleep.c 2011-05-22 19:36:30.000000000 -0400
12479@@ -88,8 +88,12 @@ int acpi_suspend_lowlevel(void)
12480 header->trampoline_segment = trampoline_address() >> 4;
12481 #ifdef CONFIG_SMP
12482 stack_start = (unsigned long)temp_stack + sizeof(temp_stack);
12483+
12484+ pax_open_kernel();
12485 early_gdt_descr.address =
12486 (unsigned long)get_cpu_gdt_table(smp_processor_id());
12487+ pax_close_kernel();
12488+
12489 initial_gs = per_cpu_offset(smp_processor_id());
12490 #endif
12491 initial_code = (unsigned long)wakeup_long64;
12492diff -urNp linux-2.6.39/arch/x86/kernel/acpi/wakeup_32.S linux-2.6.39/arch/x86/kernel/acpi/wakeup_32.S
12493--- linux-2.6.39/arch/x86/kernel/acpi/wakeup_32.S 2011-05-19 00:06:34.000000000 -0400
12494+++ linux-2.6.39/arch/x86/kernel/acpi/wakeup_32.S 2011-05-22 19:36:30.000000000 -0400
12495@@ -30,13 +30,11 @@ wakeup_pmode_return:
12496 # and restore the stack ... but you need gdt for this to work
12497 movl saved_context_esp, %esp
12498
12499- movl %cs:saved_magic, %eax
12500- cmpl $0x12345678, %eax
12501+ cmpl $0x12345678, saved_magic
12502 jne bogus_magic
12503
12504 # jump to place where we left off
12505- movl saved_eip, %eax
12506- jmp *%eax
12507+ jmp *(saved_eip)
12508
12509 bogus_magic:
12510 jmp bogus_magic
12511diff -urNp linux-2.6.39/arch/x86/kernel/alternative.c linux-2.6.39/arch/x86/kernel/alternative.c
12512--- linux-2.6.39/arch/x86/kernel/alternative.c 2011-05-19 00:06:34.000000000 -0400
12513+++ linux-2.6.39/arch/x86/kernel/alternative.c 2011-05-22 19:36:30.000000000 -0400
12514@@ -248,7 +248,7 @@ static void alternatives_smp_lock(const
12515 if (!*poff || ptr < text || ptr >= text_end)
12516 continue;
12517 /* turn DS segment override prefix into lock prefix */
12518- if (*ptr == 0x3e)
12519+ if (*ktla_ktva(ptr) == 0x3e)
12520 text_poke(ptr, ((unsigned char []){0xf0}), 1);
12521 };
12522 mutex_unlock(&text_mutex);
12523@@ -269,7 +269,7 @@ static void alternatives_smp_unlock(cons
12524 if (!*poff || ptr < text || ptr >= text_end)
12525 continue;
12526 /* turn lock prefix into DS segment override prefix */
12527- if (*ptr == 0xf0)
12528+ if (*ktla_ktva(ptr) == 0xf0)
12529 text_poke(ptr, ((unsigned char []){0x3E}), 1);
12530 };
12531 mutex_unlock(&text_mutex);
12532@@ -438,7 +438,7 @@ void __init_or_module apply_paravirt(str
12533
12534 BUG_ON(p->len > MAX_PATCH_LEN);
12535 /* prep the buffer with the original instructions */
12536- memcpy(insnbuf, p->instr, p->len);
12537+ memcpy(insnbuf, ktla_ktva(p->instr), p->len);
12538 used = pv_init_ops.patch(p->instrtype, p->clobbers, insnbuf,
12539 (unsigned long)p->instr, p->len);
12540
12541@@ -506,7 +506,7 @@ void __init alternative_instructions(voi
12542 if (smp_alt_once)
12543 free_init_pages("SMP alternatives",
12544 (unsigned long)__smp_locks,
12545- (unsigned long)__smp_locks_end);
12546+ PAGE_ALIGN((unsigned long)__smp_locks_end));
12547
12548 restart_nmi();
12549 }
12550@@ -523,13 +523,17 @@ void __init alternative_instructions(voi
12551 * instructions. And on the local CPU you need to be protected again NMI or MCE
12552 * handlers seeing an inconsistent instruction while you patch.
12553 */
12554-void *__init_or_module text_poke_early(void *addr, const void *opcode,
12555+void *__kprobes text_poke_early(void *addr, const void *opcode,
12556 size_t len)
12557 {
12558 unsigned long flags;
12559 local_irq_save(flags);
12560- memcpy(addr, opcode, len);
12561+
12562+ pax_open_kernel();
12563+ memcpy(ktla_ktva(addr), opcode, len);
12564 sync_core();
12565+ pax_close_kernel();
12566+
12567 local_irq_restore(flags);
12568 /* Could also do a CLFLUSH here to speed up CPU recovery; but
12569 that causes hangs on some VIA CPUs. */
12570@@ -551,36 +555,22 @@ void *__init_or_module text_poke_early(v
12571 */
12572 void *__kprobes text_poke(void *addr, const void *opcode, size_t len)
12573 {
12574- unsigned long flags;
12575- char *vaddr;
12576+ unsigned char *vaddr = ktla_ktva(addr);
12577 struct page *pages[2];
12578- int i;
12579+ size_t i;
12580
12581 if (!core_kernel_text((unsigned long)addr)) {
12582- pages[0] = vmalloc_to_page(addr);
12583- pages[1] = vmalloc_to_page(addr + PAGE_SIZE);
12584+ pages[0] = vmalloc_to_page(vaddr);
12585+ pages[1] = vmalloc_to_page(vaddr + PAGE_SIZE);
12586 } else {
12587- pages[0] = virt_to_page(addr);
12588+ pages[0] = virt_to_page(vaddr);
12589 WARN_ON(!PageReserved(pages[0]));
12590- pages[1] = virt_to_page(addr + PAGE_SIZE);
12591+ pages[1] = virt_to_page(vaddr + PAGE_SIZE);
12592 }
12593 BUG_ON(!pages[0]);
12594- local_irq_save(flags);
12595- set_fixmap(FIX_TEXT_POKE0, page_to_phys(pages[0]));
12596- if (pages[1])
12597- set_fixmap(FIX_TEXT_POKE1, page_to_phys(pages[1]));
12598- vaddr = (char *)fix_to_virt(FIX_TEXT_POKE0);
12599- memcpy(&vaddr[(unsigned long)addr & ~PAGE_MASK], opcode, len);
12600- clear_fixmap(FIX_TEXT_POKE0);
12601- if (pages[1])
12602- clear_fixmap(FIX_TEXT_POKE1);
12603- local_flush_tlb();
12604- sync_core();
12605- /* Could also do a CLFLUSH here to speed up CPU recovery; but
12606- that causes hangs on some VIA CPUs. */
12607+ text_poke_early(addr, opcode, len);
12608 for (i = 0; i < len; i++)
12609- BUG_ON(((char *)addr)[i] != ((char *)opcode)[i]);
12610- local_irq_restore(flags);
12611+ BUG_ON((vaddr)[i] != ((const unsigned char *)opcode)[i]);
12612 return addr;
12613 }
12614
12615@@ -682,9 +672,9 @@ void __kprobes text_poke_smp_batch(struc
12616 #if defined(CONFIG_DYNAMIC_FTRACE) || defined(HAVE_JUMP_LABEL)
12617
12618 #ifdef CONFIG_X86_64
12619-unsigned char ideal_nop5[5] = { 0x66, 0x66, 0x66, 0x66, 0x90 };
12620+unsigned char ideal_nop5[5] __read_only = { 0x66, 0x66, 0x66, 0x66, 0x90 };
12621 #else
12622-unsigned char ideal_nop5[5] = { 0x3e, 0x8d, 0x74, 0x26, 0x00 };
12623+unsigned char ideal_nop5[5] __read_only = { 0x3e, 0x8d, 0x74, 0x26, 0x00 };
12624 #endif
12625
12626 void __init arch_init_ideal_nop5(void)
12627diff -urNp linux-2.6.39/arch/x86/kernel/amd_iommu.c linux-2.6.39/arch/x86/kernel/amd_iommu.c
12628--- linux-2.6.39/arch/x86/kernel/amd_iommu.c 2011-05-19 00:06:34.000000000 -0400
12629+++ linux-2.6.39/arch/x86/kernel/amd_iommu.c 2011-05-22 19:36:30.000000000 -0400
12630@@ -48,7 +48,7 @@ static DEFINE_SPINLOCK(iommu_pd_list_loc
12631 */
12632 static struct protection_domain *pt_domain;
12633
12634-static struct iommu_ops amd_iommu_ops;
12635+static const struct iommu_ops amd_iommu_ops;
12636
12637 /*
12638 * general struct to manage commands send to an IOMMU
12639@@ -2286,7 +2286,7 @@ static void prealloc_protection_domains(
12640 }
12641 }
12642
12643-static struct dma_map_ops amd_iommu_dma_ops = {
12644+static const struct dma_map_ops amd_iommu_dma_ops = {
12645 .alloc_coherent = alloc_coherent,
12646 .free_coherent = free_coherent,
12647 .map_page = map_page,
12648@@ -2582,7 +2582,7 @@ static int amd_iommu_domain_has_cap(stru
12649 return 0;
12650 }
12651
12652-static struct iommu_ops amd_iommu_ops = {
12653+static const struct iommu_ops amd_iommu_ops = {
12654 .domain_init = amd_iommu_domain_init,
12655 .domain_destroy = amd_iommu_domain_destroy,
12656 .attach_dev = amd_iommu_attach_device,
12657diff -urNp linux-2.6.39/arch/x86/kernel/apic/apic.c linux-2.6.39/arch/x86/kernel/apic/apic.c
12658--- linux-2.6.39/arch/x86/kernel/apic/apic.c 2011-05-19 00:06:34.000000000 -0400
12659+++ linux-2.6.39/arch/x86/kernel/apic/apic.c 2011-05-22 19:36:30.000000000 -0400
12660@@ -1821,7 +1821,7 @@ void smp_error_interrupt(struct pt_regs
12661 apic_write(APIC_ESR, 0);
12662 v1 = apic_read(APIC_ESR);
12663 ack_APIC_irq();
12664- atomic_inc(&irq_err_count);
12665+ atomic_inc_unchecked(&irq_err_count);
12666
12667 /*
12668 * Here is what the APIC error bits mean:
12669@@ -2204,6 +2204,8 @@ static int __cpuinit apic_cluster_num(vo
12670 u16 *bios_cpu_apicid;
12671 DECLARE_BITMAP(clustermap, NUM_APIC_CLUSTERS);
12672
12673+ pax_track_stack();
12674+
12675 bios_cpu_apicid = early_per_cpu_ptr(x86_bios_cpu_apicid);
12676 bitmap_zero(clustermap, NUM_APIC_CLUSTERS);
12677
12678diff -urNp linux-2.6.39/arch/x86/kernel/apic/io_apic.c linux-2.6.39/arch/x86/kernel/apic/io_apic.c
12679--- linux-2.6.39/arch/x86/kernel/apic/io_apic.c 2011-05-19 00:06:34.000000000 -0400
12680+++ linux-2.6.39/arch/x86/kernel/apic/io_apic.c 2011-05-22 19:36:30.000000000 -0400
12681@@ -623,7 +623,7 @@ struct IO_APIC_route_entry **alloc_ioapi
12682 ioapic_entries = kzalloc(sizeof(*ioapic_entries) * nr_ioapics,
12683 GFP_KERNEL);
12684 if (!ioapic_entries)
12685- return 0;
12686+ return NULL;
12687
12688 for (apic = 0; apic < nr_ioapics; apic++) {
12689 ioapic_entries[apic] =
12690@@ -640,7 +640,7 @@ nomem:
12691 kfree(ioapic_entries[apic]);
12692 kfree(ioapic_entries);
12693
12694- return 0;
12695+ return NULL;
12696 }
12697
12698 /*
12699@@ -1040,7 +1040,7 @@ int IO_APIC_get_PCI_irq_vector(int bus,
12700 }
12701 EXPORT_SYMBOL(IO_APIC_get_PCI_irq_vector);
12702
12703-void lock_vector_lock(void)
12704+void lock_vector_lock(void) __acquires(vector_lock)
12705 {
12706 /* Used to the online set of cpus does not change
12707 * during assign_irq_vector.
12708@@ -1048,7 +1048,7 @@ void lock_vector_lock(void)
12709 raw_spin_lock(&vector_lock);
12710 }
12711
12712-void unlock_vector_lock(void)
12713+void unlock_vector_lock(void) __releases(vector_lock)
12714 {
12715 raw_spin_unlock(&vector_lock);
12716 }
12717@@ -2379,7 +2379,7 @@ static void ack_apic_edge(struct irq_dat
12718 ack_APIC_irq();
12719 }
12720
12721-atomic_t irq_mis_count;
12722+atomic_unchecked_t irq_mis_count;
12723
12724 /*
12725 * IO-APIC versions below 0x20 don't support EOI register.
12726@@ -2487,7 +2487,7 @@ static void ack_apic_level(struct irq_da
12727 * at the cpu.
12728 */
12729 if (!(v & (1 << (i & 0x1f)))) {
12730- atomic_inc(&irq_mis_count);
12731+ atomic_inc_unchecked(&irq_mis_count);
12732
12733 eoi_ioapic_irq(irq, cfg);
12734 }
12735diff -urNp linux-2.6.39/arch/x86/kernel/apm_32.c linux-2.6.39/arch/x86/kernel/apm_32.c
12736--- linux-2.6.39/arch/x86/kernel/apm_32.c 2011-05-19 00:06:34.000000000 -0400
12737+++ linux-2.6.39/arch/x86/kernel/apm_32.c 2011-05-22 19:36:30.000000000 -0400
12738@@ -412,7 +412,7 @@ static DEFINE_MUTEX(apm_mutex);
12739 * This is for buggy BIOS's that refer to (real mode) segment 0x40
12740 * even though they are called in protected mode.
12741 */
12742-static struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4092,
12743+static const struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4093,
12744 (unsigned long)__va(0x400UL), PAGE_SIZE - 0x400 - 1);
12745
12746 static const char driver_version[] = "1.16ac"; /* no spaces */
12747@@ -590,7 +590,10 @@ static long __apm_bios_call(void *_call)
12748 BUG_ON(cpu != 0);
12749 gdt = get_cpu_gdt_table(cpu);
12750 save_desc_40 = gdt[0x40 / 8];
12751+
12752+ pax_open_kernel();
12753 gdt[0x40 / 8] = bad_bios_desc;
12754+ pax_close_kernel();
12755
12756 apm_irq_save(flags);
12757 APM_DO_SAVE_SEGS;
12758@@ -599,7 +602,11 @@ static long __apm_bios_call(void *_call)
12759 &call->esi);
12760 APM_DO_RESTORE_SEGS;
12761 apm_irq_restore(flags);
12762+
12763+ pax_open_kernel();
12764 gdt[0x40 / 8] = save_desc_40;
12765+ pax_close_kernel();
12766+
12767 put_cpu();
12768
12769 return call->eax & 0xff;
12770@@ -666,7 +673,10 @@ static long __apm_bios_call_simple(void
12771 BUG_ON(cpu != 0);
12772 gdt = get_cpu_gdt_table(cpu);
12773 save_desc_40 = gdt[0x40 / 8];
12774+
12775+ pax_open_kernel();
12776 gdt[0x40 / 8] = bad_bios_desc;
12777+ pax_close_kernel();
12778
12779 apm_irq_save(flags);
12780 APM_DO_SAVE_SEGS;
12781@@ -674,7 +684,11 @@ static long __apm_bios_call_simple(void
12782 &call->eax);
12783 APM_DO_RESTORE_SEGS;
12784 apm_irq_restore(flags);
12785+
12786+ pax_open_kernel();
12787 gdt[0x40 / 8] = save_desc_40;
12788+ pax_close_kernel();
12789+
12790 put_cpu();
12791 return error;
12792 }
12793@@ -2351,12 +2365,15 @@ static int __init apm_init(void)
12794 * code to that CPU.
12795 */
12796 gdt = get_cpu_gdt_table(0);
12797+
12798+ pax_open_kernel();
12799 set_desc_base(&gdt[APM_CS >> 3],
12800 (unsigned long)__va((unsigned long)apm_info.bios.cseg << 4));
12801 set_desc_base(&gdt[APM_CS_16 >> 3],
12802 (unsigned long)__va((unsigned long)apm_info.bios.cseg_16 << 4));
12803 set_desc_base(&gdt[APM_DS >> 3],
12804 (unsigned long)__va((unsigned long)apm_info.bios.dseg << 4));
12805+ pax_close_kernel();
12806
12807 proc_create("apm", 0, NULL, &apm_file_ops);
12808
12809diff -urNp linux-2.6.39/arch/x86/kernel/asm-offsets_64.c linux-2.6.39/arch/x86/kernel/asm-offsets_64.c
12810--- linux-2.6.39/arch/x86/kernel/asm-offsets_64.c 2011-05-19 00:06:34.000000000 -0400
12811+++ linux-2.6.39/arch/x86/kernel/asm-offsets_64.c 2011-05-22 19:36:30.000000000 -0400
12812@@ -69,6 +69,7 @@ int main(void)
12813 BLANK();
12814 #undef ENTRY
12815
12816+ DEFINE(TSS_size, sizeof(struct tss_struct));
12817 OFFSET(TSS_ist, tss_struct, x86_tss.ist);
12818 BLANK();
12819
12820diff -urNp linux-2.6.39/arch/x86/kernel/asm-offsets.c linux-2.6.39/arch/x86/kernel/asm-offsets.c
12821--- linux-2.6.39/arch/x86/kernel/asm-offsets.c 2011-05-19 00:06:34.000000000 -0400
12822+++ linux-2.6.39/arch/x86/kernel/asm-offsets.c 2011-05-25 17:35:48.000000000 -0400
12823@@ -33,6 +33,8 @@ void common(void) {
12824 OFFSET(TI_status, thread_info, status);
12825 OFFSET(TI_addr_limit, thread_info, addr_limit);
12826 OFFSET(TI_preempt_count, thread_info, preempt_count);
12827+ OFFSET(TI_lowest_stack, thread_info, lowest_stack);
12828+ DEFINE(TI_task_thread_sp0, offsetof(struct task_struct, thread.sp0) - offsetof(struct task_struct, tinfo));
12829
12830 BLANK();
12831 OFFSET(crypto_tfm_ctx_offset, crypto_tfm, __crt_ctx);
12832@@ -53,8 +55,26 @@ void common(void) {
12833 OFFSET(PV_CPU_irq_enable_sysexit, pv_cpu_ops, irq_enable_sysexit);
12834 OFFSET(PV_CPU_read_cr0, pv_cpu_ops, read_cr0);
12835 OFFSET(PV_MMU_read_cr2, pv_mmu_ops, read_cr2);
12836+
12837+#ifdef CONFIG_PAX_KERNEXEC
12838+ OFFSET(PV_CPU_write_cr0, pv_cpu_ops, write_cr0);
12839+#endif
12840+
12841+#ifdef CONFIG_PAX_MEMORY_UDEREF
12842+ OFFSET(PV_MMU_read_cr3, pv_mmu_ops, read_cr3);
12843+ OFFSET(PV_MMU_write_cr3, pv_mmu_ops, write_cr3);
12844+#ifdef CONFIG_X86_64
12845+ OFFSET(PV_MMU_set_pgd, pv_mmu_ops, set_pgd);
12846+#endif
12847 #endif
12848
12849+#endif
12850+
12851+ BLANK();
12852+ DEFINE(PAGE_SIZE_asm, PAGE_SIZE);
12853+ DEFINE(PAGE_SHIFT_asm, PAGE_SHIFT);
12854+ DEFINE(THREAD_SIZE_asm, THREAD_SIZE);
12855+
12856 #ifdef CONFIG_XEN
12857 BLANK();
12858 OFFSET(XEN_vcpu_info_mask, vcpu_info, evtchn_upcall_mask);
12859diff -urNp linux-2.6.39/arch/x86/kernel/cpu/amd.c linux-2.6.39/arch/x86/kernel/cpu/amd.c
12860--- linux-2.6.39/arch/x86/kernel/cpu/amd.c 2011-05-19 00:06:34.000000000 -0400
12861+++ linux-2.6.39/arch/x86/kernel/cpu/amd.c 2011-05-22 19:36:30.000000000 -0400
12862@@ -641,7 +641,7 @@ static unsigned int __cpuinit amd_size_c
12863 unsigned int size)
12864 {
12865 /* AMD errata T13 (order #21922) */
12866- if ((c->x86 == 6)) {
12867+ if (c->x86 == 6) {
12868 /* Duron Rev A0 */
12869 if (c->x86_model == 3 && c->x86_mask == 0)
12870 size = 64;
12871diff -urNp linux-2.6.39/arch/x86/kernel/cpu/common.c linux-2.6.39/arch/x86/kernel/cpu/common.c
12872--- linux-2.6.39/arch/x86/kernel/cpu/common.c 2011-05-19 00:06:34.000000000 -0400
12873+++ linux-2.6.39/arch/x86/kernel/cpu/common.c 2011-05-22 19:36:30.000000000 -0400
12874@@ -83,60 +83,6 @@ static const struct cpu_dev __cpuinitcon
12875
12876 static const struct cpu_dev *this_cpu __cpuinitdata = &default_cpu;
12877
12878-DEFINE_PER_CPU_PAGE_ALIGNED(struct gdt_page, gdt_page) = { .gdt = {
12879-#ifdef CONFIG_X86_64
12880- /*
12881- * We need valid kernel segments for data and code in long mode too
12882- * IRET will check the segment types kkeil 2000/10/28
12883- * Also sysret mandates a special GDT layout
12884- *
12885- * TLS descriptors are currently at a different place compared to i386.
12886- * Hopefully nobody expects them at a fixed place (Wine?)
12887- */
12888- [GDT_ENTRY_KERNEL32_CS] = GDT_ENTRY_INIT(0xc09b, 0, 0xfffff),
12889- [GDT_ENTRY_KERNEL_CS] = GDT_ENTRY_INIT(0xa09b, 0, 0xfffff),
12890- [GDT_ENTRY_KERNEL_DS] = GDT_ENTRY_INIT(0xc093, 0, 0xfffff),
12891- [GDT_ENTRY_DEFAULT_USER32_CS] = GDT_ENTRY_INIT(0xc0fb, 0, 0xfffff),
12892- [GDT_ENTRY_DEFAULT_USER_DS] = GDT_ENTRY_INIT(0xc0f3, 0, 0xfffff),
12893- [GDT_ENTRY_DEFAULT_USER_CS] = GDT_ENTRY_INIT(0xa0fb, 0, 0xfffff),
12894-#else
12895- [GDT_ENTRY_KERNEL_CS] = GDT_ENTRY_INIT(0xc09a, 0, 0xfffff),
12896- [GDT_ENTRY_KERNEL_DS] = GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
12897- [GDT_ENTRY_DEFAULT_USER_CS] = GDT_ENTRY_INIT(0xc0fa, 0, 0xfffff),
12898- [GDT_ENTRY_DEFAULT_USER_DS] = GDT_ENTRY_INIT(0xc0f2, 0, 0xfffff),
12899- /*
12900- * Segments used for calling PnP BIOS have byte granularity.
12901- * They code segments and data segments have fixed 64k limits,
12902- * the transfer segment sizes are set at run time.
12903- */
12904- /* 32-bit code */
12905- [GDT_ENTRY_PNPBIOS_CS32] = GDT_ENTRY_INIT(0x409a, 0, 0xffff),
12906- /* 16-bit code */
12907- [GDT_ENTRY_PNPBIOS_CS16] = GDT_ENTRY_INIT(0x009a, 0, 0xffff),
12908- /* 16-bit data */
12909- [GDT_ENTRY_PNPBIOS_DS] = GDT_ENTRY_INIT(0x0092, 0, 0xffff),
12910- /* 16-bit data */
12911- [GDT_ENTRY_PNPBIOS_TS1] = GDT_ENTRY_INIT(0x0092, 0, 0),
12912- /* 16-bit data */
12913- [GDT_ENTRY_PNPBIOS_TS2] = GDT_ENTRY_INIT(0x0092, 0, 0),
12914- /*
12915- * The APM segments have byte granularity and their bases
12916- * are set at run time. All have 64k limits.
12917- */
12918- /* 32-bit code */
12919- [GDT_ENTRY_APMBIOS_BASE] = GDT_ENTRY_INIT(0x409a, 0, 0xffff),
12920- /* 16-bit code */
12921- [GDT_ENTRY_APMBIOS_BASE+1] = GDT_ENTRY_INIT(0x009a, 0, 0xffff),
12922- /* data */
12923- [GDT_ENTRY_APMBIOS_BASE+2] = GDT_ENTRY_INIT(0x4092, 0, 0xffff),
12924-
12925- [GDT_ENTRY_ESPFIX_SS] = GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
12926- [GDT_ENTRY_PERCPU] = GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
12927- GDT_STACK_CANARY_INIT
12928-#endif
12929-} };
12930-EXPORT_PER_CPU_SYMBOL_GPL(gdt_page);
12931-
12932 static int __init x86_xsave_setup(char *s)
12933 {
12934 setup_clear_cpu_cap(X86_FEATURE_XSAVE);
12935@@ -352,7 +298,7 @@ void switch_to_new_gdt(int cpu)
12936 {
12937 struct desc_ptr gdt_descr;
12938
12939- gdt_descr.address = (long)get_cpu_gdt_table(cpu);
12940+ gdt_descr.address = (unsigned long)get_cpu_gdt_table(cpu);
12941 gdt_descr.size = GDT_SIZE - 1;
12942 load_gdt(&gdt_descr);
12943 /* Reload the per-cpu base */
12944@@ -825,6 +771,10 @@ static void __cpuinit identify_cpu(struc
12945 /* Filter out anything that depends on CPUID levels we don't have */
12946 filter_cpuid_features(c, true);
12947
12948+#if defined(CONFIG_PAX_SEGMEXEC) || defined(CONFIG_PAX_KERNEXEC) || (defined(CONFIG_PAX_MEMORY_UDEREF) && defined(CONFIG_X86_32))
12949+ setup_clear_cpu_cap(X86_FEATURE_SEP);
12950+#endif
12951+
12952 /* If the model name is still unset, do table lookup. */
12953 if (!c->x86_model_id[0]) {
12954 const char *p;
12955@@ -1004,6 +954,9 @@ static __init int setup_disablecpuid(cha
12956 }
12957 __setup("clearcpuid=", setup_disablecpuid);
12958
12959+DEFINE_PER_CPU(struct thread_info *, current_tinfo) = &init_task.tinfo;
12960+EXPORT_PER_CPU_SYMBOL(current_tinfo);
12961+
12962 #ifdef CONFIG_X86_64
12963 struct desc_ptr idt_descr = { NR_VECTORS * 16 - 1, (unsigned long) idt_table };
12964
12965@@ -1019,7 +972,7 @@ DEFINE_PER_CPU(struct task_struct *, cur
12966 EXPORT_PER_CPU_SYMBOL(current_task);
12967
12968 DEFINE_PER_CPU(unsigned long, kernel_stack) =
12969- (unsigned long)&init_thread_union - KERNEL_STACK_OFFSET + THREAD_SIZE;
12970+ (unsigned long)&init_thread_union - 16 + THREAD_SIZE;
12971 EXPORT_PER_CPU_SYMBOL(kernel_stack);
12972
12973 DEFINE_PER_CPU(char *, irq_stack_ptr) =
12974@@ -1084,7 +1037,7 @@ struct pt_regs * __cpuinit idle_regs(str
12975 {
12976 memset(regs, 0, sizeof(struct pt_regs));
12977 regs->fs = __KERNEL_PERCPU;
12978- regs->gs = __KERNEL_STACK_CANARY;
12979+ savesegment(gs, regs->gs);
12980
12981 return regs;
12982 }
12983@@ -1139,7 +1092,7 @@ void __cpuinit cpu_init(void)
12984 int i;
12985
12986 cpu = stack_smp_processor_id();
12987- t = &per_cpu(init_tss, cpu);
12988+ t = init_tss + cpu;
12989 oist = &per_cpu(orig_ist, cpu);
12990
12991 #ifdef CONFIG_NUMA
12992@@ -1165,7 +1118,7 @@ void __cpuinit cpu_init(void)
12993 switch_to_new_gdt(cpu);
12994 loadsegment(fs, 0);
12995
12996- load_idt((const struct desc_ptr *)&idt_descr);
12997+ load_idt(&idt_descr);
12998
12999 memset(me->thread.tls_array, 0, GDT_ENTRY_TLS_ENTRIES * 8);
13000 syscall_init();
13001@@ -1174,7 +1127,6 @@ void __cpuinit cpu_init(void)
13002 wrmsrl(MSR_KERNEL_GS_BASE, 0);
13003 barrier();
13004
13005- x86_configure_nx();
13006 if (cpu != 0)
13007 enable_x2apic();
13008
13009@@ -1228,7 +1180,7 @@ void __cpuinit cpu_init(void)
13010 {
13011 int cpu = smp_processor_id();
13012 struct task_struct *curr = current;
13013- struct tss_struct *t = &per_cpu(init_tss, cpu);
13014+ struct tss_struct *t = init_tss + cpu;
13015 struct thread_struct *thread = &curr->thread;
13016
13017 if (cpumask_test_and_set_cpu(cpu, cpu_initialized_mask)) {
13018diff -urNp linux-2.6.39/arch/x86/kernel/cpu/intel.c linux-2.6.39/arch/x86/kernel/cpu/intel.c
13019--- linux-2.6.39/arch/x86/kernel/cpu/intel.c 2011-05-19 00:06:34.000000000 -0400
13020+++ linux-2.6.39/arch/x86/kernel/cpu/intel.c 2011-05-22 19:36:30.000000000 -0400
13021@@ -161,7 +161,7 @@ static void __cpuinit trap_init_f00f_bug
13022 * Update the IDT descriptor and reload the IDT so that
13023 * it uses the read-only mapped virtual address.
13024 */
13025- idt_descr.address = fix_to_virt(FIX_F00F_IDT);
13026+ idt_descr.address = (struct desc_struct *)fix_to_virt(FIX_F00F_IDT);
13027 load_idt(&idt_descr);
13028 }
13029 #endif
13030diff -urNp linux-2.6.39/arch/x86/kernel/cpu/Makefile linux-2.6.39/arch/x86/kernel/cpu/Makefile
13031--- linux-2.6.39/arch/x86/kernel/cpu/Makefile 2011-05-19 00:06:34.000000000 -0400
13032+++ linux-2.6.39/arch/x86/kernel/cpu/Makefile 2011-05-22 19:36:30.000000000 -0400
13033@@ -8,10 +8,6 @@ CFLAGS_REMOVE_common.o = -pg
13034 CFLAGS_REMOVE_perf_event.o = -pg
13035 endif
13036
13037-# Make sure load_percpu_segment has no stackprotector
13038-nostackp := $(call cc-option, -fno-stack-protector)
13039-CFLAGS_common.o := $(nostackp)
13040-
13041 obj-y := intel_cacheinfo.o scattered.o topology.o
13042 obj-y += proc.o capflags.o powerflags.o common.o
13043 obj-y += vmware.o hypervisor.o sched.o mshyperv.o
13044diff -urNp linux-2.6.39/arch/x86/kernel/cpu/mcheck/mce.c linux-2.6.39/arch/x86/kernel/cpu/mcheck/mce.c
13045--- linux-2.6.39/arch/x86/kernel/cpu/mcheck/mce.c 2011-05-19 00:06:34.000000000 -0400
13046+++ linux-2.6.39/arch/x86/kernel/cpu/mcheck/mce.c 2011-05-22 19:36:30.000000000 -0400
13047@@ -46,6 +46,7 @@
13048 #include <asm/ipi.h>
13049 #include <asm/mce.h>
13050 #include <asm/msr.h>
13051+#include <asm/local.h>
13052
13053 #include "mce-internal.h"
13054
13055@@ -220,7 +221,7 @@ static void print_mce(struct mce *m)
13056 !(m->mcgstatus & MCG_STATUS_EIPV) ? " !INEXACT!" : "",
13057 m->cs, m->ip);
13058
13059- if (m->cs == __KERNEL_CS)
13060+ if (m->cs == __KERNEL_CS || m->cs == __KERNEXEC_KERNEL_CS)
13061 print_symbol("{%s}", m->ip);
13062 pr_cont("\n");
13063 }
13064@@ -244,10 +245,10 @@ static void print_mce(struct mce *m)
13065
13066 #define PANIC_TIMEOUT 5 /* 5 seconds */
13067
13068-static atomic_t mce_paniced;
13069+static atomic_unchecked_t mce_paniced;
13070
13071 static int fake_panic;
13072-static atomic_t mce_fake_paniced;
13073+static atomic_unchecked_t mce_fake_paniced;
13074
13075 /* Panic in progress. Enable interrupts and wait for final IPI */
13076 static void wait_for_panic(void)
13077@@ -271,7 +272,7 @@ static void mce_panic(char *msg, struct
13078 /*
13079 * Make sure only one CPU runs in machine check panic
13080 */
13081- if (atomic_inc_return(&mce_paniced) > 1)
13082+ if (atomic_inc_return_unchecked(&mce_paniced) > 1)
13083 wait_for_panic();
13084 barrier();
13085
13086@@ -279,7 +280,7 @@ static void mce_panic(char *msg, struct
13087 console_verbose();
13088 } else {
13089 /* Don't log too much for fake panic */
13090- if (atomic_inc_return(&mce_fake_paniced) > 1)
13091+ if (atomic_inc_return_unchecked(&mce_fake_paniced) > 1)
13092 return;
13093 }
13094 /* First print corrected ones that are still unlogged */
13095@@ -647,7 +648,7 @@ static int mce_timed_out(u64 *t)
13096 * might have been modified by someone else.
13097 */
13098 rmb();
13099- if (atomic_read(&mce_paniced))
13100+ if (atomic_read_unchecked(&mce_paniced))
13101 wait_for_panic();
13102 if (!monarch_timeout)
13103 goto out;
13104@@ -1461,14 +1462,14 @@ void __cpuinit mcheck_cpu_init(struct cp
13105 */
13106
13107 static DEFINE_SPINLOCK(mce_state_lock);
13108-static int open_count; /* #times opened */
13109+static local_t open_count; /* #times opened */
13110 static int open_exclu; /* already open exclusive? */
13111
13112 static int mce_open(struct inode *inode, struct file *file)
13113 {
13114 spin_lock(&mce_state_lock);
13115
13116- if (open_exclu || (open_count && (file->f_flags & O_EXCL))) {
13117+ if (open_exclu || (local_read(&open_count) && (file->f_flags & O_EXCL))) {
13118 spin_unlock(&mce_state_lock);
13119
13120 return -EBUSY;
13121@@ -1476,7 +1477,7 @@ static int mce_open(struct inode *inode,
13122
13123 if (file->f_flags & O_EXCL)
13124 open_exclu = 1;
13125- open_count++;
13126+ local_inc(&open_count);
13127
13128 spin_unlock(&mce_state_lock);
13129
13130@@ -1487,7 +1488,7 @@ static int mce_release(struct inode *ino
13131 {
13132 spin_lock(&mce_state_lock);
13133
13134- open_count--;
13135+ local_dec(&open_count);
13136 open_exclu = 0;
13137
13138 spin_unlock(&mce_state_lock);
13139@@ -2174,7 +2175,7 @@ struct dentry *mce_get_debugfs_dir(void)
13140 static void mce_reset(void)
13141 {
13142 cpu_missing = 0;
13143- atomic_set(&mce_fake_paniced, 0);
13144+ atomic_set_unchecked(&mce_fake_paniced, 0);
13145 atomic_set(&mce_executing, 0);
13146 atomic_set(&mce_callin, 0);
13147 atomic_set(&global_nwo, 0);
13148diff -urNp linux-2.6.39/arch/x86/kernel/cpu/mtrr/main.c linux-2.6.39/arch/x86/kernel/cpu/mtrr/main.c
13149--- linux-2.6.39/arch/x86/kernel/cpu/mtrr/main.c 2011-05-19 00:06:34.000000000 -0400
13150+++ linux-2.6.39/arch/x86/kernel/cpu/mtrr/main.c 2011-05-22 19:36:30.000000000 -0400
13151@@ -62,7 +62,7 @@ static DEFINE_MUTEX(mtrr_mutex);
13152 u64 size_or_mask, size_and_mask;
13153 static bool mtrr_aps_delayed_init;
13154
13155-static const struct mtrr_ops *mtrr_ops[X86_VENDOR_NUM];
13156+static const struct mtrr_ops *mtrr_ops[X86_VENDOR_NUM] __read_only;
13157
13158 const struct mtrr_ops *mtrr_if;
13159
13160diff -urNp linux-2.6.39/arch/x86/kernel/cpu/mtrr/mtrr.h linux-2.6.39/arch/x86/kernel/cpu/mtrr/mtrr.h
13161--- linux-2.6.39/arch/x86/kernel/cpu/mtrr/mtrr.h 2011-05-19 00:06:34.000000000 -0400
13162+++ linux-2.6.39/arch/x86/kernel/cpu/mtrr/mtrr.h 2011-05-22 19:36:30.000000000 -0400
13163@@ -12,19 +12,19 @@
13164 extern unsigned int mtrr_usage_table[MTRR_MAX_VAR_RANGES];
13165
13166 struct mtrr_ops {
13167- u32 vendor;
13168- u32 use_intel_if;
13169- void (*set)(unsigned int reg, unsigned long base,
13170+ const u32 vendor;
13171+ const u32 use_intel_if;
13172+ void (* const set)(unsigned int reg, unsigned long base,
13173 unsigned long size, mtrr_type type);
13174- void (*set_all)(void);
13175+ void (* const set_all)(void);
13176
13177- void (*get)(unsigned int reg, unsigned long *base,
13178+ void (* const get)(unsigned int reg, unsigned long *base,
13179 unsigned long *size, mtrr_type *type);
13180- int (*get_free_region)(unsigned long base, unsigned long size,
13181+ int (* const get_free_region)(unsigned long base, unsigned long size,
13182 int replace_reg);
13183- int (*validate_add_page)(unsigned long base, unsigned long size,
13184+ int (* const validate_add_page)(unsigned long base, unsigned long size,
13185 unsigned int type);
13186- int (*have_wrcomb)(void);
13187+ int (* const have_wrcomb)(void);
13188 };
13189
13190 extern int generic_get_free_region(unsigned long base, unsigned long size,
13191diff -urNp linux-2.6.39/arch/x86/kernel/cpu/perf_event.c linux-2.6.39/arch/x86/kernel/cpu/perf_event.c
13192--- linux-2.6.39/arch/x86/kernel/cpu/perf_event.c 2011-05-19 00:06:34.000000000 -0400
13193+++ linux-2.6.39/arch/x86/kernel/cpu/perf_event.c 2011-05-22 19:36:30.000000000 -0400
13194@@ -774,6 +774,8 @@ static int x86_schedule_events(struct cp
13195 int i, j, w, wmax, num = 0;
13196 struct hw_perf_event *hwc;
13197
13198+ pax_track_stack();
13199+
13200 bitmap_zero(used_mask, X86_PMC_IDX_MAX);
13201
13202 for (i = 0; i < n; i++) {
13203@@ -1878,7 +1880,7 @@ perf_callchain_user(struct perf_callchai
13204 break;
13205
13206 perf_callchain_store(entry, frame.return_address);
13207- fp = frame.next_frame;
13208+ fp = (__force const void __user *)frame.next_frame;
13209 }
13210 }
13211
13212diff -urNp linux-2.6.39/arch/x86/kernel/crash.c linux-2.6.39/arch/x86/kernel/crash.c
13213--- linux-2.6.39/arch/x86/kernel/crash.c 2011-05-19 00:06:34.000000000 -0400
13214+++ linux-2.6.39/arch/x86/kernel/crash.c 2011-05-22 19:36:30.000000000 -0400
13215@@ -42,7 +42,7 @@ static void kdump_nmi_callback(int cpu,
13216 regs = args->regs;
13217
13218 #ifdef CONFIG_X86_32
13219- if (!user_mode_vm(regs)) {
13220+ if (!user_mode(regs)) {
13221 crash_fixup_ss_esp(&fixed_regs, regs);
13222 regs = &fixed_regs;
13223 }
13224diff -urNp linux-2.6.39/arch/x86/kernel/doublefault_32.c linux-2.6.39/arch/x86/kernel/doublefault_32.c
13225--- linux-2.6.39/arch/x86/kernel/doublefault_32.c 2011-05-19 00:06:34.000000000 -0400
13226+++ linux-2.6.39/arch/x86/kernel/doublefault_32.c 2011-05-22 19:36:30.000000000 -0400
13227@@ -11,7 +11,7 @@
13228
13229 #define DOUBLEFAULT_STACKSIZE (1024)
13230 static unsigned long doublefault_stack[DOUBLEFAULT_STACKSIZE];
13231-#define STACK_START (unsigned long)(doublefault_stack+DOUBLEFAULT_STACKSIZE)
13232+#define STACK_START (unsigned long)(doublefault_stack+DOUBLEFAULT_STACKSIZE-2)
13233
13234 #define ptr_ok(x) ((x) > PAGE_OFFSET && (x) < PAGE_OFFSET + MAXMEM)
13235
13236@@ -21,7 +21,7 @@ static void doublefault_fn(void)
13237 unsigned long gdt, tss;
13238
13239 store_gdt(&gdt_desc);
13240- gdt = gdt_desc.address;
13241+ gdt = (unsigned long)gdt_desc.address;
13242
13243 printk(KERN_EMERG "PANIC: double fault, gdt at %08lx [%d bytes]\n", gdt, gdt_desc.size);
13244
13245@@ -58,10 +58,10 @@ struct tss_struct doublefault_tss __cach
13246 /* 0x2 bit is always set */
13247 .flags = X86_EFLAGS_SF | 0x2,
13248 .sp = STACK_START,
13249- .es = __USER_DS,
13250+ .es = __KERNEL_DS,
13251 .cs = __KERNEL_CS,
13252 .ss = __KERNEL_DS,
13253- .ds = __USER_DS,
13254+ .ds = __KERNEL_DS,
13255 .fs = __KERNEL_PERCPU,
13256
13257 .__cr3 = __pa_nodebug(swapper_pg_dir),
13258diff -urNp linux-2.6.39/arch/x86/kernel/dumpstack_32.c linux-2.6.39/arch/x86/kernel/dumpstack_32.c
13259--- linux-2.6.39/arch/x86/kernel/dumpstack_32.c 2011-05-19 00:06:34.000000000 -0400
13260+++ linux-2.6.39/arch/x86/kernel/dumpstack_32.c 2011-05-22 19:36:30.000000000 -0400
13261@@ -38,15 +38,13 @@ void dump_trace(struct task_struct *task
13262 bp = stack_frame(task, regs);
13263
13264 for (;;) {
13265- struct thread_info *context;
13266+ void *stack_start = (void *)((unsigned long)stack & ~(THREAD_SIZE-1));
13267
13268- context = (struct thread_info *)
13269- ((unsigned long)stack & (~(THREAD_SIZE - 1)));
13270- bp = ops->walk_stack(context, stack, bp, ops, data, NULL, &graph);
13271+ bp = ops->walk_stack(task, stack_start, stack, bp, ops, data, NULL, &graph);
13272
13273- stack = (unsigned long *)context->previous_esp;
13274- if (!stack)
13275+ if (stack_start == task_stack_page(task))
13276 break;
13277+ stack = *(unsigned long **)stack_start;
13278 if (ops->stack(data, "IRQ") < 0)
13279 break;
13280 touch_nmi_watchdog();
13281@@ -96,21 +94,22 @@ void show_registers(struct pt_regs *regs
13282 * When in-kernel, we also print out the stack and code at the
13283 * time of the fault..
13284 */
13285- if (!user_mode_vm(regs)) {
13286+ if (!user_mode(regs)) {
13287 unsigned int code_prologue = code_bytes * 43 / 64;
13288 unsigned int code_len = code_bytes;
13289 unsigned char c;
13290 u8 *ip;
13291+ unsigned long cs_base = get_desc_base(&get_cpu_gdt_table(smp_processor_id())[(0xffff & regs->cs) >> 3]);
13292
13293 printk(KERN_EMERG "Stack:\n");
13294 show_stack_log_lvl(NULL, regs, &regs->sp, 0, KERN_EMERG);
13295
13296 printk(KERN_EMERG "Code: ");
13297
13298- ip = (u8 *)regs->ip - code_prologue;
13299+ ip = (u8 *)regs->ip - code_prologue + cs_base;
13300 if (ip < (u8 *)PAGE_OFFSET || probe_kernel_address(ip, c)) {
13301 /* try starting at IP */
13302- ip = (u8 *)regs->ip;
13303+ ip = (u8 *)regs->ip + cs_base;
13304 code_len = code_len - code_prologue + 1;
13305 }
13306 for (i = 0; i < code_len; i++, ip++) {
13307@@ -119,7 +118,7 @@ void show_registers(struct pt_regs *regs
13308 printk(" Bad EIP value.");
13309 break;
13310 }
13311- if (ip == (u8 *)regs->ip)
13312+ if (ip == (u8 *)regs->ip + cs_base)
13313 printk("<%02x> ", c);
13314 else
13315 printk("%02x ", c);
13316@@ -132,6 +131,7 @@ int is_valid_bugaddr(unsigned long ip)
13317 {
13318 unsigned short ud2;
13319
13320+ ip = ktla_ktva(ip);
13321 if (ip < PAGE_OFFSET)
13322 return 0;
13323 if (probe_kernel_address((unsigned short *)ip, ud2))
13324diff -urNp linux-2.6.39/arch/x86/kernel/dumpstack_64.c linux-2.6.39/arch/x86/kernel/dumpstack_64.c
13325--- linux-2.6.39/arch/x86/kernel/dumpstack_64.c 2011-05-19 00:06:34.000000000 -0400
13326+++ linux-2.6.39/arch/x86/kernel/dumpstack_64.c 2011-05-22 19:36:30.000000000 -0400
13327@@ -147,9 +147,9 @@ void dump_trace(struct task_struct *task
13328 unsigned long *irq_stack_end =
13329 (unsigned long *)per_cpu(irq_stack_ptr, cpu);
13330 unsigned used = 0;
13331- struct thread_info *tinfo;
13332 int graph = 0;
13333 unsigned long dummy;
13334+ void *stack_start;
13335
13336 if (!task)
13337 task = current;
13338@@ -167,10 +167,10 @@ void dump_trace(struct task_struct *task
13339 * current stack address. If the stacks consist of nested
13340 * exceptions
13341 */
13342- tinfo = task_thread_info(task);
13343 for (;;) {
13344 char *id;
13345 unsigned long *estack_end;
13346+
13347 estack_end = in_exception_stack(cpu, (unsigned long)stack,
13348 &used, &id);
13349
13350@@ -178,7 +178,7 @@ void dump_trace(struct task_struct *task
13351 if (ops->stack(data, id) < 0)
13352 break;
13353
13354- bp = ops->walk_stack(tinfo, stack, bp, ops,
13355+ bp = ops->walk_stack(task, estack_end - EXCEPTION_STKSZ, stack, bp, ops,
13356 data, estack_end, &graph);
13357 ops->stack(data, "<EOE>");
13358 /*
13359@@ -197,7 +197,7 @@ void dump_trace(struct task_struct *task
13360 if (in_irq_stack(stack, irq_stack, irq_stack_end)) {
13361 if (ops->stack(data, "IRQ") < 0)
13362 break;
13363- bp = ops->walk_stack(tinfo, stack, bp,
13364+ bp = ops->walk_stack(task, irq_stack, stack, bp,
13365 ops, data, irq_stack_end, &graph);
13366 /*
13367 * We link to the next stack (which would be
13368@@ -218,7 +218,8 @@ void dump_trace(struct task_struct *task
13369 /*
13370 * This handles the process stack:
13371 */
13372- bp = ops->walk_stack(tinfo, stack, bp, ops, data, NULL, &graph);
13373+ stack_start = (void *)((unsigned long)stack & ~(THREAD_SIZE-1));
13374+ bp = ops->walk_stack(task, stack_start, stack, bp, ops, data, NULL, &graph);
13375 put_cpu();
13376 }
13377 EXPORT_SYMBOL(dump_trace);
13378diff -urNp linux-2.6.39/arch/x86/kernel/dumpstack.c linux-2.6.39/arch/x86/kernel/dumpstack.c
13379--- linux-2.6.39/arch/x86/kernel/dumpstack.c 2011-05-19 00:06:34.000000000 -0400
13380+++ linux-2.6.39/arch/x86/kernel/dumpstack.c 2011-05-22 19:41:32.000000000 -0400
13381@@ -2,6 +2,9 @@
13382 * Copyright (C) 1991, 1992 Linus Torvalds
13383 * Copyright (C) 2000, 2001, 2002 Andi Kleen, SuSE Labs
13384 */
13385+#ifdef CONFIG_GRKERNSEC_HIDESYM
13386+#define __INCLUDED_BY_HIDESYM 1
13387+#endif
13388 #include <linux/kallsyms.h>
13389 #include <linux/kprobes.h>
13390 #include <linux/uaccess.h>
13391@@ -35,9 +38,8 @@ void printk_address(unsigned long addres
13392 static void
13393 print_ftrace_graph_addr(unsigned long addr, void *data,
13394 const struct stacktrace_ops *ops,
13395- struct thread_info *tinfo, int *graph)
13396+ struct task_struct *task, int *graph)
13397 {
13398- struct task_struct *task = tinfo->task;
13399 unsigned long ret_addr;
13400 int index = task->curr_ret_stack;
13401
13402@@ -58,7 +60,7 @@ print_ftrace_graph_addr(unsigned long ad
13403 static inline void
13404 print_ftrace_graph_addr(unsigned long addr, void *data,
13405 const struct stacktrace_ops *ops,
13406- struct thread_info *tinfo, int *graph)
13407+ struct task_struct *task, int *graph)
13408 { }
13409 #endif
13410
13411@@ -69,10 +71,8 @@ print_ftrace_graph_addr(unsigned long ad
13412 * severe exception (double fault, nmi, stack fault, debug, mce) hardware stack
13413 */
13414
13415-static inline int valid_stack_ptr(struct thread_info *tinfo,
13416- void *p, unsigned int size, void *end)
13417+static inline int valid_stack_ptr(void *t, void *p, unsigned int size, void *end)
13418 {
13419- void *t = tinfo;
13420 if (end) {
13421 if (p < end && p >= (end-THREAD_SIZE))
13422 return 1;
13423@@ -83,14 +83,14 @@ static inline int valid_stack_ptr(struct
13424 }
13425
13426 unsigned long
13427-print_context_stack(struct thread_info *tinfo,
13428+print_context_stack(struct task_struct *task, void *stack_start,
13429 unsigned long *stack, unsigned long bp,
13430 const struct stacktrace_ops *ops, void *data,
13431 unsigned long *end, int *graph)
13432 {
13433 struct stack_frame *frame = (struct stack_frame *)bp;
13434
13435- while (valid_stack_ptr(tinfo, stack, sizeof(*stack), end)) {
13436+ while (valid_stack_ptr(stack_start, stack, sizeof(*stack), end)) {
13437 unsigned long addr;
13438
13439 addr = *stack;
13440@@ -102,7 +102,7 @@ print_context_stack(struct thread_info *
13441 } else {
13442 ops->address(data, addr, 0);
13443 }
13444- print_ftrace_graph_addr(addr, data, ops, tinfo, graph);
13445+ print_ftrace_graph_addr(addr, data, ops, task, graph);
13446 }
13447 stack++;
13448 }
13449@@ -111,7 +111,7 @@ print_context_stack(struct thread_info *
13450 EXPORT_SYMBOL_GPL(print_context_stack);
13451
13452 unsigned long
13453-print_context_stack_bp(struct thread_info *tinfo,
13454+print_context_stack_bp(struct task_struct *task, void *stack_start,
13455 unsigned long *stack, unsigned long bp,
13456 const struct stacktrace_ops *ops, void *data,
13457 unsigned long *end, int *graph)
13458@@ -119,7 +119,7 @@ print_context_stack_bp(struct thread_inf
13459 struct stack_frame *frame = (struct stack_frame *)bp;
13460 unsigned long *ret_addr = &frame->return_address;
13461
13462- while (valid_stack_ptr(tinfo, ret_addr, sizeof(*ret_addr), end)) {
13463+ while (valid_stack_ptr(stack_start, ret_addr, sizeof(*ret_addr), end)) {
13464 unsigned long addr = *ret_addr;
13465
13466 if (!__kernel_text_address(addr))
13467@@ -128,7 +128,7 @@ print_context_stack_bp(struct thread_inf
13468 ops->address(data, addr, 1);
13469 frame = frame->next_frame;
13470 ret_addr = &frame->return_address;
13471- print_ftrace_graph_addr(addr, data, ops, tinfo, graph);
13472+ print_ftrace_graph_addr(addr, data, ops, task, graph);
13473 }
13474
13475 return (unsigned long)frame;
13476@@ -202,7 +202,7 @@ void dump_stack(void)
13477
13478 bp = stack_frame(current, NULL);
13479 printk("Pid: %d, comm: %.20s %s %s %.*s\n",
13480- current->pid, current->comm, print_tainted(),
13481+ task_pid_nr(current), current->comm, print_tainted(),
13482 init_utsname()->release,
13483 (int)strcspn(init_utsname()->version, " "),
13484 init_utsname()->version);
13485@@ -238,6 +238,8 @@ unsigned __kprobes long oops_begin(void)
13486 }
13487 EXPORT_SYMBOL_GPL(oops_begin);
13488
13489+extern void gr_handle_kernel_exploit(void);
13490+
13491 void __kprobes oops_end(unsigned long flags, struct pt_regs *regs, int signr)
13492 {
13493 if (regs && kexec_should_crash(current))
13494@@ -259,7 +261,10 @@ void __kprobes oops_end(unsigned long fl
13495 panic("Fatal exception in interrupt");
13496 if (panic_on_oops)
13497 panic("Fatal exception");
13498- do_exit(signr);
13499+
13500+ gr_handle_kernel_exploit();
13501+
13502+ do_group_exit(signr);
13503 }
13504
13505 int __kprobes __die(const char *str, struct pt_regs *regs, long err)
13506@@ -286,7 +291,7 @@ int __kprobes __die(const char *str, str
13507
13508 show_registers(regs);
13509 #ifdef CONFIG_X86_32
13510- if (user_mode_vm(regs)) {
13511+ if (user_mode(regs)) {
13512 sp = regs->sp;
13513 ss = regs->ss & 0xffff;
13514 } else {
13515@@ -314,7 +319,7 @@ void die(const char *str, struct pt_regs
13516 unsigned long flags = oops_begin();
13517 int sig = SIGSEGV;
13518
13519- if (!user_mode_vm(regs))
13520+ if (!user_mode(regs))
13521 report_bug(regs->ip, regs);
13522
13523 if (__die(str, regs, err))
13524diff -urNp linux-2.6.39/arch/x86/kernel/early_printk.c linux-2.6.39/arch/x86/kernel/early_printk.c
13525--- linux-2.6.39/arch/x86/kernel/early_printk.c 2011-05-19 00:06:34.000000000 -0400
13526+++ linux-2.6.39/arch/x86/kernel/early_printk.c 2011-05-22 19:36:30.000000000 -0400
13527@@ -7,6 +7,7 @@
13528 #include <linux/pci_regs.h>
13529 #include <linux/pci_ids.h>
13530 #include <linux/errno.h>
13531+#include <linux/sched.h>
13532 #include <asm/io.h>
13533 #include <asm/processor.h>
13534 #include <asm/fcntl.h>
13535@@ -179,6 +180,8 @@ asmlinkage void early_printk(const char
13536 int n;
13537 va_list ap;
13538
13539+ pax_track_stack();
13540+
13541 va_start(ap, fmt);
13542 n = vscnprintf(buf, sizeof(buf), fmt, ap);
13543 early_console->write(early_console, buf, n);
13544diff -urNp linux-2.6.39/arch/x86/kernel/entry_32.S linux-2.6.39/arch/x86/kernel/entry_32.S
13545--- linux-2.6.39/arch/x86/kernel/entry_32.S 2011-05-19 00:06:34.000000000 -0400
13546+++ linux-2.6.39/arch/x86/kernel/entry_32.S 2011-05-23 17:07:00.000000000 -0400
13547@@ -185,13 +185,146 @@
13548 /*CFI_REL_OFFSET gs, PT_GS*/
13549 .endm
13550 .macro SET_KERNEL_GS reg
13551+
13552+#ifdef CONFIG_CC_STACKPROTECTOR
13553 movl $(__KERNEL_STACK_CANARY), \reg
13554+#elif defined(CONFIG_PAX_MEMORY_UDEREF)
13555+ movl $(__USER_DS), \reg
13556+#else
13557+ xorl \reg, \reg
13558+#endif
13559+
13560 movl \reg, %gs
13561 .endm
13562
13563 #endif /* CONFIG_X86_32_LAZY_GS */
13564
13565-.macro SAVE_ALL
13566+.macro pax_enter_kernel
13567+#ifdef CONFIG_PAX_KERNEXEC
13568+ call pax_enter_kernel
13569+#endif
13570+.endm
13571+
13572+.macro pax_exit_kernel
13573+#ifdef CONFIG_PAX_KERNEXEC
13574+ call pax_exit_kernel
13575+#endif
13576+.endm
13577+
13578+#ifdef CONFIG_PAX_KERNEXEC
13579+ENTRY(pax_enter_kernel)
13580+#ifdef CONFIG_PARAVIRT
13581+ pushl %eax
13582+ pushl %ecx
13583+ call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0)
13584+ mov %eax, %esi
13585+#else
13586+ mov %cr0, %esi
13587+#endif
13588+ bts $16, %esi
13589+ jnc 1f
13590+ mov %cs, %esi
13591+ cmp $__KERNEL_CS, %esi
13592+ jz 3f
13593+ ljmp $__KERNEL_CS, $3f
13594+1: ljmp $__KERNEXEC_KERNEL_CS, $2f
13595+2:
13596+#ifdef CONFIG_PARAVIRT
13597+ mov %esi, %eax
13598+ call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0)
13599+#else
13600+ mov %esi, %cr0
13601+#endif
13602+3:
13603+#ifdef CONFIG_PARAVIRT
13604+ popl %ecx
13605+ popl %eax
13606+#endif
13607+ ret
13608+ENDPROC(pax_enter_kernel)
13609+
13610+ENTRY(pax_exit_kernel)
13611+#ifdef CONFIG_PARAVIRT
13612+ pushl %eax
13613+ pushl %ecx
13614+#endif
13615+ mov %cs, %esi
13616+ cmp $__KERNEXEC_KERNEL_CS, %esi
13617+ jnz 2f
13618+#ifdef CONFIG_PARAVIRT
13619+ call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0);
13620+ mov %eax, %esi
13621+#else
13622+ mov %cr0, %esi
13623+#endif
13624+ btr $16, %esi
13625+ ljmp $__KERNEL_CS, $1f
13626+1:
13627+#ifdef CONFIG_PARAVIRT
13628+ mov %esi, %eax
13629+ call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0);
13630+#else
13631+ mov %esi, %cr0
13632+#endif
13633+2:
13634+#ifdef CONFIG_PARAVIRT
13635+ popl %ecx
13636+ popl %eax
13637+#endif
13638+ ret
13639+ENDPROC(pax_exit_kernel)
13640+#endif
13641+
13642+.macro pax_erase_kstack
13643+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
13644+ call pax_erase_kstack
13645+#endif
13646+.endm
13647+
13648+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
13649+/*
13650+ * ebp: thread_info
13651+ * ecx, edx: can be clobbered
13652+ */
13653+ENTRY(pax_erase_kstack)
13654+ pushl %edi
13655+ pushl %eax
13656+
13657+ mov TI_lowest_stack(%ebp), %edi
13658+ mov $-0xBEEF, %eax
13659+ std
13660+
13661+1: mov %edi, %ecx
13662+ and $THREAD_SIZE_asm - 1, %ecx
13663+ shr $2, %ecx
13664+ repne scasl
13665+ jecxz 2f
13666+
13667+ cmp $2*16, %ecx
13668+ jc 2f
13669+
13670+ mov $2*16, %ecx
13671+ repe scasl
13672+ jecxz 2f
13673+ jne 1b
13674+
13675+2: cld
13676+ mov %esp, %ecx
13677+ sub %edi, %ecx
13678+ shr $2, %ecx
13679+ rep stosl
13680+
13681+ mov TI_task_thread_sp0(%ebp), %edi
13682+ sub $128, %edi
13683+ mov %edi, TI_lowest_stack(%ebp)
13684+
13685+ popl %eax
13686+ popl %edi
13687+ ret
13688+ENDPROC(pax_erase_kstack)
13689+#endif
13690+
13691+.macro __SAVE_ALL _DS
13692 cld
13693 PUSH_GS
13694 pushl_cfi %fs
13695@@ -214,7 +347,7 @@
13696 CFI_REL_OFFSET ecx, 0
13697 pushl_cfi %ebx
13698 CFI_REL_OFFSET ebx, 0
13699- movl $(__USER_DS), %edx
13700+ movl $\_DS, %edx
13701 movl %edx, %ds
13702 movl %edx, %es
13703 movl $(__KERNEL_PERCPU), %edx
13704@@ -222,6 +355,15 @@
13705 SET_KERNEL_GS %edx
13706 .endm
13707
13708+.macro SAVE_ALL
13709+#if defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
13710+ __SAVE_ALL __KERNEL_DS
13711+ pax_enter_kernel
13712+#else
13713+ __SAVE_ALL __USER_DS
13714+#endif
13715+.endm
13716+
13717 .macro RESTORE_INT_REGS
13718 popl_cfi %ebx
13719 CFI_RESTORE ebx
13720@@ -332,7 +474,15 @@ check_userspace:
13721 movb PT_CS(%esp), %al
13722 andl $(X86_EFLAGS_VM | SEGMENT_RPL_MASK), %eax
13723 cmpl $USER_RPL, %eax
13724+
13725+#ifdef CONFIG_PAX_KERNEXEC
13726+ jae resume_userspace
13727+
13728+ PAX_EXIT_KERNEL
13729+ jmp resume_kernel
13730+#else
13731 jb resume_kernel # not returning to v8086 or userspace
13732+#endif
13733
13734 ENTRY(resume_userspace)
13735 LOCKDEP_SYS_EXIT
13736@@ -344,7 +494,7 @@ ENTRY(resume_userspace)
13737 andl $_TIF_WORK_MASK, %ecx # is there any work to be done on
13738 # int/exception return?
13739 jne work_pending
13740- jmp restore_all
13741+ jmp restore_all_pax
13742 END(ret_from_exception)
13743
13744 #ifdef CONFIG_PREEMPT
13745@@ -394,23 +544,34 @@ sysenter_past_esp:
13746 /*CFI_REL_OFFSET cs, 0*/
13747 /*
13748 * Push current_thread_info()->sysenter_return to the stack.
13749- * A tiny bit of offset fixup is necessary - 4*4 means the 4 words
13750- * pushed above; +8 corresponds to copy_thread's esp0 setting.
13751 */
13752- pushl_cfi ((TI_sysenter_return)-THREAD_SIZE+8+4*4)(%esp)
13753+ pushl_cfi $0
13754 CFI_REL_OFFSET eip, 0
13755
13756 pushl_cfi %eax
13757 SAVE_ALL
13758+ GET_THREAD_INFO(%ebp)
13759+ movl TI_sysenter_return(%ebp),%ebp
13760+ movl %ebp,PT_EIP(%esp)
13761 ENABLE_INTERRUPTS(CLBR_NONE)
13762
13763 /*
13764 * Load the potential sixth argument from user stack.
13765 * Careful about security.
13766 */
13767+ movl PT_OLDESP(%esp),%ebp
13768+
13769+#ifdef CONFIG_PAX_MEMORY_UDEREF
13770+ mov PT_OLDSS(%esp),%ds
13771+1: movl %ds:(%ebp),%ebp
13772+ push %ss
13773+ pop %ds
13774+#else
13775 cmpl $__PAGE_OFFSET-3,%ebp
13776 jae syscall_fault
13777 1: movl (%ebp),%ebp
13778+#endif
13779+
13780 movl %ebp,PT_EBP(%esp)
13781 .section __ex_table,"a"
13782 .align 4
13783@@ -433,12 +594,23 @@ sysenter_do_call:
13784 testl $_TIF_ALLWORK_MASK, %ecx
13785 jne sysexit_audit
13786 sysenter_exit:
13787+
13788+#ifdef CONFIG_PAX_RANDKSTACK
13789+ pushl_cfi %eax
13790+ call pax_randomize_kstack
13791+ popl_cfi %eax
13792+#endif
13793+
13794+ pax_erase_kstack
13795+
13796 /* if something modifies registers it must also disable sysexit */
13797 movl PT_EIP(%esp), %edx
13798 movl PT_OLDESP(%esp), %ecx
13799 xorl %ebp,%ebp
13800 TRACE_IRQS_ON
13801 1: mov PT_FS(%esp), %fs
13802+2: mov PT_DS(%esp), %ds
13803+3: mov PT_ES(%esp), %es
13804 PTGS_TO_GS
13805 ENABLE_INTERRUPTS_SYSEXIT
13806
13807@@ -455,6 +627,9 @@ sysenter_audit:
13808 movl %eax,%edx /* 2nd arg: syscall number */
13809 movl $AUDIT_ARCH_I386,%eax /* 1st arg: audit arch */
13810 call audit_syscall_entry
13811+
13812+ pax_erase_kstack
13813+
13814 pushl_cfi %ebx
13815 movl PT_EAX(%esp),%eax /* reload syscall number */
13816 jmp sysenter_do_call
13817@@ -481,11 +656,17 @@ sysexit_audit:
13818
13819 CFI_ENDPROC
13820 .pushsection .fixup,"ax"
13821-2: movl $0,PT_FS(%esp)
13822+4: movl $0,PT_FS(%esp)
13823+ jmp 1b
13824+5: movl $0,PT_DS(%esp)
13825+ jmp 1b
13826+6: movl $0,PT_ES(%esp)
13827 jmp 1b
13828 .section __ex_table,"a"
13829 .align 4
13830- .long 1b,2b
13831+ .long 1b,4b
13832+ .long 2b,5b
13833+ .long 3b,6b
13834 .popsection
13835 PTGS_TO_GS_EX
13836 ENDPROC(ia32_sysenter_target)
13837@@ -518,6 +699,14 @@ syscall_exit:
13838 testl $_TIF_ALLWORK_MASK, %ecx # current->work
13839 jne syscall_exit_work
13840
13841+restore_all_pax:
13842+
13843+#ifdef CONFIG_PAX_RANDKSTACK
13844+ call pax_randomize_kstack
13845+#endif
13846+
13847+ pax_erase_kstack
13848+
13849 restore_all:
13850 TRACE_IRQS_IRET
13851 restore_all_notrace:
13852@@ -577,14 +766,21 @@ ldt_ss:
13853 * compensating for the offset by changing to the ESPFIX segment with
13854 * a base address that matches for the difference.
13855 */
13856-#define GDT_ESPFIX_SS PER_CPU_VAR(gdt_page) + (GDT_ENTRY_ESPFIX_SS * 8)
13857+#define GDT_ESPFIX_SS (GDT_ENTRY_ESPFIX_SS * 8)(%ebx)
13858 mov %esp, %edx /* load kernel esp */
13859 mov PT_OLDESP(%esp), %eax /* load userspace esp */
13860 mov %dx, %ax /* eax: new kernel esp */
13861 sub %eax, %edx /* offset (low word is 0) */
13862+#ifdef CONFIG_SMP
13863+ movl PER_CPU_VAR(cpu_number), %ebx
13864+ shll $PAGE_SHIFT_asm, %ebx
13865+ addl $cpu_gdt_table, %ebx
13866+#else
13867+ movl $cpu_gdt_table, %ebx
13868+#endif
13869 shr $16, %edx
13870- mov %dl, GDT_ESPFIX_SS + 4 /* bits 16..23 */
13871- mov %dh, GDT_ESPFIX_SS + 7 /* bits 24..31 */
13872+ mov %dl, 4 + GDT_ESPFIX_SS /* bits 16..23 */
13873+ mov %dh, 7 + GDT_ESPFIX_SS /* bits 24..31 */
13874 pushl_cfi $__ESPFIX_SS
13875 pushl_cfi %eax /* new kernel esp */
13876 /* Disable interrupts, but do not irqtrace this section: we
13877@@ -613,29 +809,23 @@ work_resched:
13878 movl TI_flags(%ebp), %ecx
13879 andl $_TIF_WORK_MASK, %ecx # is there any work to be done other
13880 # than syscall tracing?
13881- jz restore_all
13882+ jz restore_all_pax
13883 testb $_TIF_NEED_RESCHED, %cl
13884 jnz work_resched
13885
13886 work_notifysig: # deal with pending signals and
13887 # notify-resume requests
13888+ movl %esp, %eax
13889 #ifdef CONFIG_VM86
13890 testl $X86_EFLAGS_VM, PT_EFLAGS(%esp)
13891- movl %esp, %eax
13892- jne work_notifysig_v86 # returning to kernel-space or
13893+ jz 1f # returning to kernel-space or
13894 # vm86-space
13895- xorl %edx, %edx
13896- call do_notify_resume
13897- jmp resume_userspace_sig
13898
13899- ALIGN
13900-work_notifysig_v86:
13901 pushl_cfi %ecx # save ti_flags for do_notify_resume
13902 call save_v86_state # %eax contains pt_regs pointer
13903 popl_cfi %ecx
13904 movl %eax, %esp
13905-#else
13906- movl %esp, %eax
13907+1:
13908 #endif
13909 xorl %edx, %edx
13910 call do_notify_resume
13911@@ -648,6 +838,9 @@ syscall_trace_entry:
13912 movl $-ENOSYS,PT_EAX(%esp)
13913 movl %esp, %eax
13914 call syscall_trace_enter
13915+
13916+ pax_erase_kstack
13917+
13918 /* What it returned is what we'll actually use. */
13919 cmpl $(nr_syscalls), %eax
13920 jnae syscall_call
13921@@ -670,6 +863,10 @@ END(syscall_exit_work)
13922
13923 RING0_INT_FRAME # can't unwind into user space anyway
13924 syscall_fault:
13925+#ifdef CONFIG_PAX_MEMORY_UDEREF
13926+ push %ss
13927+ pop %ds
13928+#endif
13929 GET_THREAD_INFO(%ebp)
13930 movl $-EFAULT,PT_EAX(%esp)
13931 jmp resume_userspace
13932@@ -752,6 +949,36 @@ ptregs_clone:
13933 CFI_ENDPROC
13934 ENDPROC(ptregs_clone)
13935
13936+ ALIGN;
13937+ENTRY(kernel_execve)
13938+ CFI_STARTPROC
13939+ pushl_cfi %ebp
13940+ sub $PT_OLDSS+4,%esp
13941+ pushl_cfi %edi
13942+ pushl_cfi %ecx
13943+ pushl_cfi %eax
13944+ lea 3*4(%esp),%edi
13945+ mov $PT_OLDSS/4+1,%ecx
13946+ xorl %eax,%eax
13947+ rep stosl
13948+ popl_cfi %eax
13949+ popl_cfi %ecx
13950+ popl_cfi %edi
13951+ movl $X86_EFLAGS_IF,PT_EFLAGS(%esp)
13952+ pushl_cfi %esp
13953+ call sys_execve
13954+ add $4,%esp
13955+ CFI_ADJUST_CFA_OFFSET -4
13956+ GET_THREAD_INFO(%ebp)
13957+ test %eax,%eax
13958+ jz syscall_exit
13959+ add $PT_OLDSS+4,%esp
13960+ CFI_ADJUST_CFA_OFFSET -PT_OLDSS-4
13961+ popl_cfi %ebp
13962+ ret
13963+ CFI_ENDPROC
13964+ENDPROC(kernel_execve)
13965+
13966 .macro FIXUP_ESPFIX_STACK
13967 /*
13968 * Switch back for ESPFIX stack to the normal zerobased stack
13969@@ -761,8 +988,15 @@ ENDPROC(ptregs_clone)
13970 * normal stack and adjusts ESP with the matching offset.
13971 */
13972 /* fixup the stack */
13973- mov GDT_ESPFIX_SS + 4, %al /* bits 16..23 */
13974- mov GDT_ESPFIX_SS + 7, %ah /* bits 24..31 */
13975+#ifdef CONFIG_SMP
13976+ movl PER_CPU_VAR(cpu_number), %ebx
13977+ shll $PAGE_SHIFT_asm, %ebx
13978+ addl $cpu_gdt_table, %ebx
13979+#else
13980+ movl $cpu_gdt_table, %ebx
13981+#endif
13982+ mov 4 + GDT_ESPFIX_SS, %al /* bits 16..23 */
13983+ mov 7 + GDT_ESPFIX_SS, %ah /* bits 24..31 */
13984 shl $16, %eax
13985 addl %esp, %eax /* the adjusted stack pointer */
13986 pushl_cfi $__KERNEL_DS
13987@@ -1213,7 +1447,6 @@ return_to_handler:
13988 jmp *%ecx
13989 #endif
13990
13991-.section .rodata,"a"
13992 #include "syscall_table_32.S"
13993
13994 syscall_table_size=(.-sys_call_table)
13995@@ -1259,9 +1492,12 @@ error_code:
13996 movl $-1, PT_ORIG_EAX(%esp) # no syscall to restart
13997 REG_TO_PTGS %ecx
13998 SET_KERNEL_GS %ecx
13999- movl $(__USER_DS), %ecx
14000+ movl $(__KERNEL_DS), %ecx
14001 movl %ecx, %ds
14002 movl %ecx, %es
14003+
14004+ pax_enter_kernel
14005+
14006 TRACE_IRQS_OFF
14007 movl %esp,%eax # pt_regs pointer
14008 call *%edi
14009@@ -1346,6 +1582,9 @@ nmi_stack_correct:
14010 xorl %edx,%edx # zero error code
14011 movl %esp,%eax # pt_regs pointer
14012 call do_nmi
14013+
14014+ pax_exit_kernel
14015+
14016 jmp restore_all_notrace
14017 CFI_ENDPROC
14018
14019@@ -1382,6 +1621,9 @@ nmi_espfix_stack:
14020 FIXUP_ESPFIX_STACK # %eax == %esp
14021 xorl %edx,%edx # zero error code
14022 call do_nmi
14023+
14024+ pax_exit_kernel
14025+
14026 RESTORE_REGS
14027 lss 12+4(%esp), %esp # back to espfix stack
14028 CFI_ADJUST_CFA_OFFSET -24
14029diff -urNp linux-2.6.39/arch/x86/kernel/entry_64.S linux-2.6.39/arch/x86/kernel/entry_64.S
14030--- linux-2.6.39/arch/x86/kernel/entry_64.S 2011-05-19 00:06:34.000000000 -0400
14031+++ linux-2.6.39/arch/x86/kernel/entry_64.S 2011-05-23 17:10:49.000000000 -0400
14032@@ -53,6 +53,7 @@
14033 #include <asm/paravirt.h>
14034 #include <asm/ftrace.h>
14035 #include <asm/percpu.h>
14036+#include <asm/pgtable.h>
14037
14038 /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this. */
14039 #include <linux/elf-em.h>
14040@@ -176,6 +177,259 @@ ENTRY(native_usergs_sysret64)
14041 ENDPROC(native_usergs_sysret64)
14042 #endif /* CONFIG_PARAVIRT */
14043
14044+ .macro ljmpq sel, off
14045+#if defined(CONFIG_MPSC) || defined(CONFIG_MCORE2) || defined (CONFIG_MATOM)
14046+ .byte 0x48; ljmp *1234f(%rip)
14047+ .pushsection .rodata
14048+ .align 16
14049+ 1234: .quad \off; .word \sel
14050+ .popsection
14051+#else
14052+ pushq $\sel
14053+ pushq $\off
14054+ lretq
14055+#endif
14056+ .endm
14057+
14058+ .macro pax_enter_kernel
14059+#ifdef CONFIG_PAX_KERNEXEC
14060+ call pax_enter_kernel
14061+#endif
14062+ .endm
14063+
14064+ .macro pax_exit_kernel
14065+#ifdef CONFIG_PAX_KERNEXEC
14066+ call pax_exit_kernel
14067+#endif
14068+ .endm
14069+
14070+#ifdef CONFIG_PAX_KERNEXEC
14071+ENTRY(pax_enter_kernel)
14072+ pushq %rdi
14073+
14074+#ifdef CONFIG_PARAVIRT
14075+ PV_SAVE_REGS(CLBR_RDI)
14076+#endif
14077+
14078+ GET_CR0_INTO_RDI
14079+ bts $16,%rdi
14080+ jnc 1f
14081+ mov %cs,%edi
14082+ cmp $__KERNEL_CS,%edi
14083+ jz 3f
14084+ ljmpq __KERNEL_CS,3f
14085+1: ljmpq __KERNEXEC_KERNEL_CS,2f
14086+2: SET_RDI_INTO_CR0
14087+3:
14088+
14089+#ifdef CONFIG_PARAVIRT
14090+ PV_RESTORE_REGS(CLBR_RDI)
14091+#endif
14092+
14093+ popq %rdi
14094+ retq
14095+ENDPROC(pax_enter_kernel)
14096+
14097+ENTRY(pax_exit_kernel)
14098+ pushq %rdi
14099+
14100+#ifdef CONFIG_PARAVIRT
14101+ PV_SAVE_REGS(CLBR_RDI)
14102+#endif
14103+
14104+ mov %cs,%rdi
14105+ cmp $__KERNEXEC_KERNEL_CS,%edi
14106+ jnz 2f
14107+ GET_CR0_INTO_RDI
14108+ btr $16,%rdi
14109+ ljmpq __KERNEL_CS,1f
14110+1: SET_RDI_INTO_CR0
14111+2:
14112+
14113+#ifdef CONFIG_PARAVIRT
14114+ PV_RESTORE_REGS(CLBR_RDI);
14115+#endif
14116+
14117+ popq %rdi
14118+ retq
14119+ENDPROC(pax_exit_kernel)
14120+#endif
14121+
14122+ .macro pax_enter_kernel_user
14123+#ifdef CONFIG_PAX_MEMORY_UDEREF
14124+ call pax_enter_kernel_user
14125+#endif
14126+ .endm
14127+
14128+ .macro pax_exit_kernel_user
14129+#ifdef CONFIG_PAX_MEMORY_UDEREF
14130+ call pax_exit_kernel_user
14131+#endif
14132+#ifdef CONFIG_PAX_RANDKSTACK
14133+ push %rax
14134+ call pax_randomize_kstack
14135+ pop %rax
14136+#endif
14137+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
14138+ call pax_erase_kstack
14139+#endif
14140+ .endm
14141+
14142+#ifdef CONFIG_PAX_MEMORY_UDEREF
14143+ENTRY(pax_enter_kernel_user)
14144+ pushq %rdi
14145+ pushq %rbx
14146+
14147+#ifdef CONFIG_PARAVIRT
14148+ PV_SAVE_REGS(CLBR_RDI)
14149+#endif
14150+
14151+ GET_CR3_INTO_RDI
14152+ mov %rdi,%rbx
14153+ add $__START_KERNEL_map,%rbx
14154+ sub phys_base(%rip),%rbx
14155+
14156+#ifdef CONFIG_PARAVIRT
14157+ pushq %rdi
14158+ cmpl $0, pv_info+PARAVIRT_enabled
14159+ jz 1f
14160+ i = 0
14161+ .rept USER_PGD_PTRS
14162+ mov i*8(%rbx),%rsi
14163+ mov $0,%sil
14164+ lea i*8(%rbx),%rdi
14165+ call PARA_INDIRECT(pv_mmu_ops+PV_MMU_set_pgd)
14166+ i = i + 1
14167+ .endr
14168+ jmp 2f
14169+1:
14170+#endif
14171+
14172+ i = 0
14173+ .rept USER_PGD_PTRS
14174+ movb $0,i*8(%rbx)
14175+ i = i + 1
14176+ .endr
14177+
14178+#ifdef CONFIG_PARAVIRT
14179+2: popq %rdi
14180+#endif
14181+ SET_RDI_INTO_CR3
14182+
14183+#ifdef CONFIG_PAX_KERNEXEC
14184+ GET_CR0_INTO_RDI
14185+ bts $16,%rdi
14186+ SET_RDI_INTO_CR0
14187+#endif
14188+
14189+#ifdef CONFIG_PARAVIRT
14190+ PV_RESTORE_REGS(CLBR_RDI)
14191+#endif
14192+
14193+ popq %rbx
14194+ popq %rdi
14195+ retq
14196+ENDPROC(pax_enter_kernel_user)
14197+
14198+ENTRY(pax_exit_kernel_user)
14199+ push %rdi
14200+
14201+#ifdef CONFIG_PARAVIRT
14202+ pushq %rbx
14203+ PV_SAVE_REGS(CLBR_RDI)
14204+#endif
14205+
14206+#ifdef CONFIG_PAX_KERNEXEC
14207+ GET_CR0_INTO_RDI
14208+ btr $16,%rdi
14209+ SET_RDI_INTO_CR0
14210+#endif
14211+
14212+ GET_CR3_INTO_RDI
14213+ add $__START_KERNEL_map,%rdi
14214+ sub phys_base(%rip),%rdi
14215+
14216+#ifdef CONFIG_PARAVIRT
14217+ cmpl $0, pv_info+PARAVIRT_enabled
14218+ jz 1f
14219+ mov %rdi,%rbx
14220+ i = 0
14221+ .rept USER_PGD_PTRS
14222+ mov i*8(%rbx),%rsi
14223+ mov $0x67,%sil
14224+ lea i*8(%rbx),%rdi
14225+ call PARA_INDIRECT(pv_mmu_ops+PV_MMU_set_pgd)
14226+ i = i + 1
14227+ .endr
14228+ jmp 2f
14229+1:
14230+#endif
14231+
14232+ i = 0
14233+ .rept USER_PGD_PTRS
14234+ movb $0x67,i*8(%rdi)
14235+ i = i + 1
14236+ .endr
14237+
14238+#ifdef CONFIG_PARAVIRT
14239+2: PV_RESTORE_REGS(CLBR_RDI)
14240+ popq %rbx
14241+#endif
14242+
14243+ popq %rdi
14244+ retq
14245+ENDPROC(pax_exit_kernel_user)
14246+#endif
14247+
14248+ .macro pax_erase_kstack
14249+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
14250+ call pax_erase_kstack
14251+#endif
14252+ .endm
14253+
14254+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
14255+/*
14256+ * r10: thread_info
14257+ * rcx, rdx: can be clobbered
14258+ */
14259+ENTRY(pax_erase_kstack)
14260+ pushq %rdi
14261+ pushq %rax
14262+
14263+ GET_THREAD_INFO(%r10)
14264+ mov TI_lowest_stack(%r10), %rdi
14265+ mov $-0xBEEF, %rax
14266+ std
14267+
14268+1: mov %edi, %ecx
14269+ and $THREAD_SIZE_asm - 1, %ecx
14270+ shr $3, %ecx
14271+ repne scasq
14272+ jecxz 2f
14273+
14274+ cmp $2*8, %ecx
14275+ jc 2f
14276+
14277+ mov $2*8, %ecx
14278+ repe scasq
14279+ jecxz 2f
14280+ jne 1b
14281+
14282+2: cld
14283+ mov %esp, %ecx
14284+ sub %edi, %ecx
14285+ shr $3, %ecx
14286+ rep stosq
14287+
14288+ mov TI_task_thread_sp0(%r10), %rdi
14289+ sub $256, %rdi
14290+ mov %rdi, TI_lowest_stack(%r10)
14291+
14292+ popq %rax
14293+ popq %rdi
14294+ ret
14295+ENDPROC(pax_erase_kstack)
14296+#endif
14297
14298 .macro TRACE_IRQS_IRETQ offset=ARGOFFSET
14299 #ifdef CONFIG_TRACE_IRQFLAGS
14300@@ -318,7 +572,7 @@ ENTRY(save_args)
14301 leaq -RBP+8(%rsp),%rdi /* arg1 for handler */
14302 movq_cfi rbp, 8 /* push %rbp */
14303 leaq 8(%rsp), %rbp /* mov %rsp, %ebp */
14304- testl $3, CS(%rdi)
14305+ testb $3, CS(%rdi)
14306 je 1f
14307 SWAPGS
14308 /*
14309@@ -409,7 +663,7 @@ ENTRY(ret_from_fork)
14310
14311 RESTORE_REST
14312
14313- testl $3, CS-ARGOFFSET(%rsp) # from kernel_thread?
14314+ testb $3, CS-ARGOFFSET(%rsp) # from kernel_thread?
14315 je int_ret_from_sys_call
14316
14317 testl $_TIF_IA32, TI_flags(%rcx) # 32-bit compat task needs IRET
14318@@ -455,7 +709,7 @@ END(ret_from_fork)
14319 ENTRY(system_call)
14320 CFI_STARTPROC simple
14321 CFI_SIGNAL_FRAME
14322- CFI_DEF_CFA rsp,KERNEL_STACK_OFFSET
14323+ CFI_DEF_CFA rsp,0
14324 CFI_REGISTER rip,rcx
14325 /*CFI_REGISTER rflags,r11*/
14326 SWAPGS_UNSAFE_STACK
14327@@ -468,12 +722,13 @@ ENTRY(system_call_after_swapgs)
14328
14329 movq %rsp,PER_CPU_VAR(old_rsp)
14330 movq PER_CPU_VAR(kernel_stack),%rsp
14331+ pax_enter_kernel_user
14332 /*
14333 * No need to follow this irqs off/on section - it's straight
14334 * and short:
14335 */
14336 ENABLE_INTERRUPTS(CLBR_NONE)
14337- SAVE_ARGS 8,1
14338+ SAVE_ARGS 8*6,1
14339 movq %rax,ORIG_RAX-ARGOFFSET(%rsp)
14340 movq %rcx,RIP-ARGOFFSET(%rsp)
14341 CFI_REL_OFFSET rip,RIP-ARGOFFSET
14342@@ -502,6 +757,7 @@ sysret_check:
14343 andl %edi,%edx
14344 jnz sysret_careful
14345 CFI_REMEMBER_STATE
14346+ pax_exit_kernel_user
14347 /*
14348 * sysretq will re-enable interrupts:
14349 */
14350@@ -560,6 +816,9 @@ auditsys:
14351 movq %rax,%rsi /* 2nd arg: syscall number */
14352 movl $AUDIT_ARCH_X86_64,%edi /* 1st arg: audit arch */
14353 call audit_syscall_entry
14354+
14355+ pax_erase_kstack
14356+
14357 LOAD_ARGS 0 /* reload call-clobbered registers */
14358 jmp system_call_fastpath
14359
14360@@ -590,6 +849,9 @@ tracesys:
14361 FIXUP_TOP_OF_STACK %rdi
14362 movq %rsp,%rdi
14363 call syscall_trace_enter
14364+
14365+ pax_erase_kstack
14366+
14367 /*
14368 * Reload arg registers from stack in case ptrace changed them.
14369 * We don't reload %rax because syscall_trace_enter() returned
14370@@ -611,7 +873,7 @@ tracesys:
14371 GLOBAL(int_ret_from_sys_call)
14372 DISABLE_INTERRUPTS(CLBR_NONE)
14373 TRACE_IRQS_OFF
14374- testl $3,CS-ARGOFFSET(%rsp)
14375+ testb $3,CS-ARGOFFSET(%rsp)
14376 je retint_restore_args
14377 movl $_TIF_ALLWORK_MASK,%edi
14378 /* edi: mask to check */
14379@@ -793,6 +1055,16 @@ END(interrupt)
14380 CFI_ADJUST_CFA_OFFSET ORIG_RAX-RBP
14381 call save_args
14382 PARTIAL_FRAME 0
14383+#ifdef CONFIG_PAX_MEMORY_UDEREF
14384+ testb $3, CS(%rdi)
14385+ jnz 1f
14386+ pax_enter_kernel
14387+ jmp 2f
14388+1: pax_enter_kernel_user
14389+2:
14390+#else
14391+ pax_enter_kernel
14392+#endif
14393 call \func
14394 .endm
14395
14396@@ -825,7 +1097,7 @@ ret_from_intr:
14397 CFI_ADJUST_CFA_OFFSET -8
14398 exit_intr:
14399 GET_THREAD_INFO(%rcx)
14400- testl $3,CS-ARGOFFSET(%rsp)
14401+ testb $3,CS-ARGOFFSET(%rsp)
14402 je retint_kernel
14403
14404 /* Interrupt came from user space */
14405@@ -847,12 +1119,14 @@ retint_swapgs: /* return to user-space
14406 * The iretq could re-enable interrupts:
14407 */
14408 DISABLE_INTERRUPTS(CLBR_ANY)
14409+ pax_exit_kernel_user
14410 TRACE_IRQS_IRETQ
14411 SWAPGS
14412 jmp restore_args
14413
14414 retint_restore_args: /* return to kernel space */
14415 DISABLE_INTERRUPTS(CLBR_ANY)
14416+ pax_exit_kernel
14417 /*
14418 * The iretq could re-enable interrupts:
14419 */
14420@@ -1027,6 +1301,16 @@ ENTRY(\sym)
14421 CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
14422 call error_entry
14423 DEFAULT_FRAME 0
14424+#ifdef CONFIG_PAX_MEMORY_UDEREF
14425+ testb $3, CS(%rsp)
14426+ jnz 1f
14427+ pax_enter_kernel
14428+ jmp 2f
14429+1: pax_enter_kernel_user
14430+2:
14431+#else
14432+ pax_enter_kernel
14433+#endif
14434 movq %rsp,%rdi /* pt_regs pointer */
14435 xorl %esi,%esi /* no error code */
14436 call \do_sym
14437@@ -1044,6 +1328,16 @@ ENTRY(\sym)
14438 CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
14439 call save_paranoid
14440 TRACE_IRQS_OFF
14441+#ifdef CONFIG_PAX_MEMORY_UDEREF
14442+ testb $3, CS(%rsp)
14443+ jnz 1f
14444+ pax_enter_kernel
14445+ jmp 2f
14446+1: pax_enter_kernel_user
14447+2:
14448+#else
14449+ pax_enter_kernel
14450+#endif
14451 movq %rsp,%rdi /* pt_regs pointer */
14452 xorl %esi,%esi /* no error code */
14453 call \do_sym
14454@@ -1052,7 +1346,7 @@ ENTRY(\sym)
14455 END(\sym)
14456 .endm
14457
14458-#define INIT_TSS_IST(x) PER_CPU_VAR(init_tss) + (TSS_ist + ((x) - 1) * 8)
14459+#define INIT_TSS_IST(x) (TSS_ist + ((x) - 1) * 8)(%r12)
14460 .macro paranoidzeroentry_ist sym do_sym ist
14461 ENTRY(\sym)
14462 INTR_FRAME
14463@@ -1062,8 +1356,24 @@ ENTRY(\sym)
14464 CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
14465 call save_paranoid
14466 TRACE_IRQS_OFF
14467+#ifdef CONFIG_PAX_MEMORY_UDEREF
14468+ testb $3, CS(%rsp)
14469+ jnz 1f
14470+ pax_enter_kernel
14471+ jmp 2f
14472+1: pax_enter_kernel_user
14473+2:
14474+#else
14475+ pax_enter_kernel
14476+#endif
14477 movq %rsp,%rdi /* pt_regs pointer */
14478 xorl %esi,%esi /* no error code */
14479+#ifdef CONFIG_SMP
14480+ imul $TSS_size, PER_CPU_VAR(cpu_number), %r12d
14481+ lea init_tss(%r12), %r12
14482+#else
14483+ lea init_tss(%rip), %r12
14484+#endif
14485 subq $EXCEPTION_STKSZ, INIT_TSS_IST(\ist)
14486 call \do_sym
14487 addq $EXCEPTION_STKSZ, INIT_TSS_IST(\ist)
14488@@ -1080,6 +1390,16 @@ ENTRY(\sym)
14489 CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
14490 call error_entry
14491 DEFAULT_FRAME 0
14492+#ifdef CONFIG_PAX_MEMORY_UDEREF
14493+ testb $3, CS(%rsp)
14494+ jnz 1f
14495+ pax_enter_kernel
14496+ jmp 2f
14497+1: pax_enter_kernel_user
14498+2:
14499+#else
14500+ pax_enter_kernel
14501+#endif
14502 movq %rsp,%rdi /* pt_regs pointer */
14503 movq ORIG_RAX(%rsp),%rsi /* get error code */
14504 movq $-1,ORIG_RAX(%rsp) /* no syscall to restart */
14505@@ -1099,6 +1419,16 @@ ENTRY(\sym)
14506 call save_paranoid
14507 DEFAULT_FRAME 0
14508 TRACE_IRQS_OFF
14509+#ifdef CONFIG_PAX_MEMORY_UDEREF
14510+ testb $3, CS(%rsp)
14511+ jnz 1f
14512+ pax_enter_kernel
14513+ jmp 2f
14514+1: pax_enter_kernel_user
14515+2:
14516+#else
14517+ pax_enter_kernel
14518+#endif
14519 movq %rsp,%rdi /* pt_regs pointer */
14520 movq ORIG_RAX(%rsp),%rsi /* get error code */
14521 movq $-1,ORIG_RAX(%rsp) /* no syscall to restart */
14522@@ -1361,14 +1691,27 @@ ENTRY(paranoid_exit)
14523 TRACE_IRQS_OFF
14524 testl %ebx,%ebx /* swapgs needed? */
14525 jnz paranoid_restore
14526- testl $3,CS(%rsp)
14527+ testb $3,CS(%rsp)
14528 jnz paranoid_userspace
14529+#ifdef CONFIG_PAX_MEMORY_UDEREF
14530+ pax_exit_kernel
14531+ TRACE_IRQS_IRETQ 0
14532+ SWAPGS_UNSAFE_STACK
14533+ RESTORE_ALL 8
14534+ jmp irq_return
14535+#endif
14536 paranoid_swapgs:
14537+#ifdef CONFIG_PAX_MEMORY_UDEREF
14538+ pax_exit_kernel_user
14539+#else
14540+ pax_exit_kernel
14541+#endif
14542 TRACE_IRQS_IRETQ 0
14543 SWAPGS_UNSAFE_STACK
14544 RESTORE_ALL 8
14545 jmp irq_return
14546 paranoid_restore:
14547+ pax_exit_kernel
14548 TRACE_IRQS_IRETQ 0
14549 RESTORE_ALL 8
14550 jmp irq_return
14551@@ -1426,7 +1769,7 @@ ENTRY(error_entry)
14552 movq_cfi r14, R14+8
14553 movq_cfi r15, R15+8
14554 xorl %ebx,%ebx
14555- testl $3,CS+8(%rsp)
14556+ testb $3,CS+8(%rsp)
14557 je error_kernelspace
14558 error_swapgs:
14559 SWAPGS
14560@@ -1490,6 +1833,16 @@ ENTRY(nmi)
14561 CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
14562 call save_paranoid
14563 DEFAULT_FRAME 0
14564+#ifdef CONFIG_PAX_MEMORY_UDEREF
14565+ testb $3, CS(%rsp)
14566+ jnz 1f
14567+ pax_enter_kernel
14568+ jmp 2f
14569+1: pax_enter_kernel_user
14570+2:
14571+#else
14572+ pax_enter_kernel
14573+#endif
14574 /* paranoidentry do_nmi, 0; without TRACE_IRQS_OFF */
14575 movq %rsp,%rdi
14576 movq $-1,%rsi
14577@@ -1500,11 +1853,25 @@ ENTRY(nmi)
14578 DISABLE_INTERRUPTS(CLBR_NONE)
14579 testl %ebx,%ebx /* swapgs needed? */
14580 jnz nmi_restore
14581- testl $3,CS(%rsp)
14582+ testb $3,CS(%rsp)
14583 jnz nmi_userspace
14584+#ifdef CONFIG_PAX_MEMORY_UDEREF
14585+ pax_exit_kernel
14586+ SWAPGS_UNSAFE_STACK
14587+ RESTORE_ALL 8
14588+ jmp irq_return
14589+#endif
14590 nmi_swapgs:
14591+#ifdef CONFIG_PAX_MEMORY_UDEREF
14592+ pax_exit_kernel_user
14593+#else
14594+ pax_exit_kernel
14595+#endif
14596 SWAPGS_UNSAFE_STACK
14597+ RESTORE_ALL 8
14598+ jmp irq_return
14599 nmi_restore:
14600+ pax_exit_kernel
14601 RESTORE_ALL 8
14602 jmp irq_return
14603 nmi_userspace:
14604diff -urNp linux-2.6.39/arch/x86/kernel/ftrace.c linux-2.6.39/arch/x86/kernel/ftrace.c
14605--- linux-2.6.39/arch/x86/kernel/ftrace.c 2011-05-19 00:06:34.000000000 -0400
14606+++ linux-2.6.39/arch/x86/kernel/ftrace.c 2011-05-22 19:36:30.000000000 -0400
14607@@ -126,7 +126,7 @@ static void *mod_code_ip; /* holds the
14608 static void *mod_code_newcode; /* holds the text to write to the IP */
14609
14610 static unsigned nmi_wait_count;
14611-static atomic_t nmi_update_count = ATOMIC_INIT(0);
14612+static atomic_unchecked_t nmi_update_count = ATOMIC_INIT(0);
14613
14614 int ftrace_arch_read_dyn_info(char *buf, int size)
14615 {
14616@@ -134,7 +134,7 @@ int ftrace_arch_read_dyn_info(char *buf,
14617
14618 r = snprintf(buf, size, "%u %u",
14619 nmi_wait_count,
14620- atomic_read(&nmi_update_count));
14621+ atomic_read_unchecked(&nmi_update_count));
14622 return r;
14623 }
14624
14625@@ -177,8 +177,10 @@ void ftrace_nmi_enter(void)
14626
14627 if (atomic_inc_return(&nmi_running) & MOD_CODE_WRITE_FLAG) {
14628 smp_rmb();
14629+ pax_open_kernel();
14630 ftrace_mod_code();
14631- atomic_inc(&nmi_update_count);
14632+ pax_close_kernel();
14633+ atomic_inc_unchecked(&nmi_update_count);
14634 }
14635 /* Must have previous changes seen before executions */
14636 smp_mb();
14637@@ -271,6 +273,8 @@ ftrace_modify_code(unsigned long ip, uns
14638 {
14639 unsigned char replaced[MCOUNT_INSN_SIZE];
14640
14641+ ip = ktla_ktva(ip);
14642+
14643 /*
14644 * Note: Due to modules and __init, code can
14645 * disappear and change, we need to protect against faulting
14646@@ -327,7 +331,7 @@ int ftrace_update_ftrace_func(ftrace_fun
14647 unsigned char old[MCOUNT_INSN_SIZE], *new;
14648 int ret;
14649
14650- memcpy(old, &ftrace_call, MCOUNT_INSN_SIZE);
14651+ memcpy(old, (void *)ktla_ktva((unsigned long)ftrace_call), MCOUNT_INSN_SIZE);
14652 new = ftrace_call_replace(ip, (unsigned long)func);
14653 ret = ftrace_modify_code(ip, old, new);
14654
14655@@ -353,6 +357,8 @@ static int ftrace_mod_jmp(unsigned long
14656 {
14657 unsigned char code[MCOUNT_INSN_SIZE];
14658
14659+ ip = ktla_ktva(ip);
14660+
14661 if (probe_kernel_read(code, (void *)ip, MCOUNT_INSN_SIZE))
14662 return -EFAULT;
14663
14664diff -urNp linux-2.6.39/arch/x86/kernel/head32.c linux-2.6.39/arch/x86/kernel/head32.c
14665--- linux-2.6.39/arch/x86/kernel/head32.c 2011-05-19 00:06:34.000000000 -0400
14666+++ linux-2.6.39/arch/x86/kernel/head32.c 2011-05-22 19:36:30.000000000 -0400
14667@@ -19,6 +19,7 @@
14668 #include <asm/io_apic.h>
14669 #include <asm/bios_ebda.h>
14670 #include <asm/tlbflush.h>
14671+#include <asm/boot.h>
14672
14673 static void __init i386_default_early_setup(void)
14674 {
14675@@ -34,7 +35,7 @@ void __init i386_start_kernel(void)
14676 {
14677 memblock_init();
14678
14679- memblock_x86_reserve_range(__pa_symbol(&_text), __pa_symbol(&__bss_stop), "TEXT DATA BSS");
14680+ memblock_x86_reserve_range(LOAD_PHYSICAL_ADDR, __pa_symbol(&__bss_stop), "TEXT DATA BSS");
14681
14682 #ifdef CONFIG_BLK_DEV_INITRD
14683 /* Reserve INITRD */
14684diff -urNp linux-2.6.39/arch/x86/kernel/head_32.S linux-2.6.39/arch/x86/kernel/head_32.S
14685--- linux-2.6.39/arch/x86/kernel/head_32.S 2011-05-19 00:06:34.000000000 -0400
14686+++ linux-2.6.39/arch/x86/kernel/head_32.S 2011-05-22 19:36:30.000000000 -0400
14687@@ -25,6 +25,12 @@
14688 /* Physical address */
14689 #define pa(X) ((X) - __PAGE_OFFSET)
14690
14691+#ifdef CONFIG_PAX_KERNEXEC
14692+#define ta(X) (X)
14693+#else
14694+#define ta(X) ((X) - __PAGE_OFFSET)
14695+#endif
14696+
14697 /*
14698 * References to members of the new_cpu_data structure.
14699 */
14700@@ -54,11 +60,7 @@
14701 * and small than max_low_pfn, otherwise will waste some page table entries
14702 */
14703
14704-#if PTRS_PER_PMD > 1
14705-#define PAGE_TABLE_SIZE(pages) (((pages) / PTRS_PER_PMD) + PTRS_PER_PGD)
14706-#else
14707-#define PAGE_TABLE_SIZE(pages) ((pages) / PTRS_PER_PGD)
14708-#endif
14709+#define PAGE_TABLE_SIZE(pages) ((pages) / PTRS_PER_PTE)
14710
14711 /* Number of possible pages in the lowmem region */
14712 LOWMEM_PAGES = (((1<<32) - __PAGE_OFFSET) >> PAGE_SHIFT)
14713@@ -77,6 +79,12 @@ INIT_MAP_SIZE = PAGE_TABLE_SIZE(KERNEL_P
14714 RESERVE_BRK(pagetables, INIT_MAP_SIZE)
14715
14716 /*
14717+ * Real beginning of normal "text" segment
14718+ */
14719+ENTRY(stext)
14720+ENTRY(_stext)
14721+
14722+/*
14723 * 32-bit kernel entrypoint; only used by the boot CPU. On entry,
14724 * %esi points to the real-mode code as a 32-bit pointer.
14725 * CS and DS must be 4 GB flat segments, but we don't depend on
14726@@ -84,6 +92,13 @@ RESERVE_BRK(pagetables, INIT_MAP_SIZE)
14727 * can.
14728 */
14729 __HEAD
14730+
14731+#ifdef CONFIG_PAX_KERNEXEC
14732+ jmp startup_32
14733+/* PaX: fill first page in .text with int3 to catch NULL derefs in kernel mode */
14734+.fill PAGE_SIZE-5,1,0xcc
14735+#endif
14736+
14737 ENTRY(startup_32)
14738 movl pa(stack_start),%ecx
14739
14740@@ -105,6 +120,57 @@ ENTRY(startup_32)
14741 2:
14742 leal -__PAGE_OFFSET(%ecx),%esp
14743
14744+#ifdef CONFIG_SMP
14745+ movl $pa(cpu_gdt_table),%edi
14746+ movl $__per_cpu_load,%eax
14747+ movw %ax,__KERNEL_PERCPU + 2(%edi)
14748+ rorl $16,%eax
14749+ movb %al,__KERNEL_PERCPU + 4(%edi)
14750+ movb %ah,__KERNEL_PERCPU + 7(%edi)
14751+ movl $__per_cpu_end - 1,%eax
14752+ subl $__per_cpu_start,%eax
14753+ movw %ax,__KERNEL_PERCPU + 0(%edi)
14754+#endif
14755+
14756+#ifdef CONFIG_PAX_MEMORY_UDEREF
14757+ movl $NR_CPUS,%ecx
14758+ movl $pa(cpu_gdt_table),%edi
14759+1:
14760+ movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c09700),GDT_ENTRY_KERNEL_DS * 8 + 4(%edi)
14761+ movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c0fb00),GDT_ENTRY_DEFAULT_USER_CS * 8 + 4(%edi)
14762+ movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c0f300),GDT_ENTRY_DEFAULT_USER_DS * 8 + 4(%edi)
14763+ addl $PAGE_SIZE_asm,%edi
14764+ loop 1b
14765+#endif
14766+
14767+#ifdef CONFIG_PAX_KERNEXEC
14768+ movl $pa(boot_gdt),%edi
14769+ movl $__LOAD_PHYSICAL_ADDR,%eax
14770+ movw %ax,__BOOT_CS + 2(%edi)
14771+ rorl $16,%eax
14772+ movb %al,__BOOT_CS + 4(%edi)
14773+ movb %ah,__BOOT_CS + 7(%edi)
14774+ rorl $16,%eax
14775+
14776+ ljmp $(__BOOT_CS),$1f
14777+1:
14778+
14779+ movl $NR_CPUS,%ecx
14780+ movl $pa(cpu_gdt_table),%edi
14781+ addl $__PAGE_OFFSET,%eax
14782+1:
14783+ movw %ax,__KERNEL_CS + 2(%edi)
14784+ movw %ax,__KERNEXEC_KERNEL_CS + 2(%edi)
14785+ rorl $16,%eax
14786+ movb %al,__KERNEL_CS + 4(%edi)
14787+ movb %al,__KERNEXEC_KERNEL_CS + 4(%edi)
14788+ movb %ah,__KERNEL_CS + 7(%edi)
14789+ movb %ah,__KERNEXEC_KERNEL_CS + 7(%edi)
14790+ rorl $16,%eax
14791+ addl $PAGE_SIZE_asm,%edi
14792+ loop 1b
14793+#endif
14794+
14795 /*
14796 * Clear BSS first so that there are no surprises...
14797 */
14798@@ -195,8 +261,11 @@ ENTRY(startup_32)
14799 movl %eax, pa(max_pfn_mapped)
14800
14801 /* Do early initialization of the fixmap area */
14802- movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR,%eax
14803- movl %eax,pa(initial_pg_pmd+0x1000*KPMDS-8)
14804+#ifdef CONFIG_COMPAT_VDSO
14805+ movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR+_PAGE_USER,pa(initial_pg_pmd+0x1000*KPMDS-8)
14806+#else
14807+ movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR,pa(initial_pg_pmd+0x1000*KPMDS-8)
14808+#endif
14809 #else /* Not PAE */
14810
14811 page_pde_offset = (__PAGE_OFFSET >> 20);
14812@@ -226,8 +295,11 @@ page_pde_offset = (__PAGE_OFFSET >> 20);
14813 movl %eax, pa(max_pfn_mapped)
14814
14815 /* Do early initialization of the fixmap area */
14816- movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR,%eax
14817- movl %eax,pa(initial_page_table+0xffc)
14818+#ifdef CONFIG_COMPAT_VDSO
14819+ movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR+_PAGE_USER,pa(initial_page_table+0xffc)
14820+#else
14821+ movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR,pa(initial_page_table+0xffc)
14822+#endif
14823 #endif
14824
14825 #ifdef CONFIG_PARAVIRT
14826@@ -241,9 +313,7 @@ page_pde_offset = (__PAGE_OFFSET >> 20);
14827 cmpl $num_subarch_entries, %eax
14828 jae bad_subarch
14829
14830- movl pa(subarch_entries)(,%eax,4), %eax
14831- subl $__PAGE_OFFSET, %eax
14832- jmp *%eax
14833+ jmp *pa(subarch_entries)(,%eax,4)
14834
14835 bad_subarch:
14836 WEAK(lguest_entry)
14837@@ -255,10 +325,10 @@ WEAK(xen_entry)
14838 __INITDATA
14839
14840 subarch_entries:
14841- .long default_entry /* normal x86/PC */
14842- .long lguest_entry /* lguest hypervisor */
14843- .long xen_entry /* Xen hypervisor */
14844- .long default_entry /* Moorestown MID */
14845+ .long ta(default_entry) /* normal x86/PC */
14846+ .long ta(lguest_entry) /* lguest hypervisor */
14847+ .long ta(xen_entry) /* Xen hypervisor */
14848+ .long ta(default_entry) /* Moorestown MID */
14849 num_subarch_entries = (. - subarch_entries) / 4
14850 .previous
14851 #else
14852@@ -312,6 +382,7 @@ default_entry:
14853 orl %edx,%eax
14854 movl %eax,%cr4
14855
14856+#ifdef CONFIG_X86_PAE
14857 testb $X86_CR4_PAE, %al # check if PAE is enabled
14858 jz 6f
14859
14860@@ -340,6 +411,9 @@ default_entry:
14861 /* Make changes effective */
14862 wrmsr
14863
14864+ btsl $_PAGE_BIT_NX-32,pa(__supported_pte_mask+4)
14865+#endif
14866+
14867 6:
14868
14869 /*
14870@@ -443,7 +517,7 @@ is386: movl $2,%ecx # set MP
14871 1: movl $(__KERNEL_DS),%eax # reload all the segment registers
14872 movl %eax,%ss # after changing gdt.
14873
14874- movl $(__USER_DS),%eax # DS/ES contains default USER segment
14875+# movl $(__KERNEL_DS),%eax # DS/ES contains default KERNEL segment
14876 movl %eax,%ds
14877 movl %eax,%es
14878
14879@@ -457,15 +531,22 @@ is386: movl $2,%ecx # set MP
14880 */
14881 cmpb $0,ready
14882 jne 1f
14883- movl $gdt_page,%eax
14884+ movl $cpu_gdt_table,%eax
14885 movl $stack_canary,%ecx
14886+#ifdef CONFIG_SMP
14887+ addl $__per_cpu_load,%ecx
14888+#endif
14889 movw %cx, 8 * GDT_ENTRY_STACK_CANARY + 2(%eax)
14890 shrl $16, %ecx
14891 movb %cl, 8 * GDT_ENTRY_STACK_CANARY + 4(%eax)
14892 movb %ch, 8 * GDT_ENTRY_STACK_CANARY + 7(%eax)
14893 1:
14894-#endif
14895 movl $(__KERNEL_STACK_CANARY),%eax
14896+#elif defined(CONFIG_PAX_MEMORY_UDEREF)
14897+ movl $(__USER_DS),%eax
14898+#else
14899+ xorl %eax,%eax
14900+#endif
14901 movl %eax,%gs
14902
14903 xorl %eax,%eax # Clear LDT
14904@@ -558,22 +639,22 @@ early_page_fault:
14905 jmp early_fault
14906
14907 early_fault:
14908- cld
14909 #ifdef CONFIG_PRINTK
14910+ cmpl $1,%ss:early_recursion_flag
14911+ je hlt_loop
14912+ incl %ss:early_recursion_flag
14913+ cld
14914 pusha
14915 movl $(__KERNEL_DS),%eax
14916 movl %eax,%ds
14917 movl %eax,%es
14918- cmpl $2,early_recursion_flag
14919- je hlt_loop
14920- incl early_recursion_flag
14921 movl %cr2,%eax
14922 pushl %eax
14923 pushl %edx /* trapno */
14924 pushl $fault_msg
14925 call printk
14926+; call dump_stack
14927 #endif
14928- call dump_stack
14929 hlt_loop:
14930 hlt
14931 jmp hlt_loop
14932@@ -581,8 +662,11 @@ hlt_loop:
14933 /* This is the default interrupt "handler" :-) */
14934 ALIGN
14935 ignore_int:
14936- cld
14937 #ifdef CONFIG_PRINTK
14938+ cmpl $2,%ss:early_recursion_flag
14939+ je hlt_loop
14940+ incl %ss:early_recursion_flag
14941+ cld
14942 pushl %eax
14943 pushl %ecx
14944 pushl %edx
14945@@ -591,9 +675,6 @@ ignore_int:
14946 movl $(__KERNEL_DS),%eax
14947 movl %eax,%ds
14948 movl %eax,%es
14949- cmpl $2,early_recursion_flag
14950- je hlt_loop
14951- incl early_recursion_flag
14952 pushl 16(%esp)
14953 pushl 24(%esp)
14954 pushl 32(%esp)
14955@@ -622,29 +703,43 @@ ENTRY(initial_code)
14956 /*
14957 * BSS section
14958 */
14959-__PAGE_ALIGNED_BSS
14960- .align PAGE_SIZE
14961 #ifdef CONFIG_X86_PAE
14962+.section .initial_pg_pmd,"a",@progbits
14963 initial_pg_pmd:
14964 .fill 1024*KPMDS,4,0
14965 #else
14966+.section .initial_page_table,"a",@progbits
14967 ENTRY(initial_page_table)
14968 .fill 1024,4,0
14969 #endif
14970+.section .initial_pg_fixmap,"a",@progbits
14971 initial_pg_fixmap:
14972 .fill 1024,4,0
14973+.section .empty_zero_page,"a",@progbits
14974 ENTRY(empty_zero_page)
14975 .fill 4096,1,0
14976+.section .swapper_pg_dir,"a",@progbits
14977 ENTRY(swapper_pg_dir)
14978+#ifdef CONFIG_X86_PAE
14979+ .fill 4,8,0
14980+#else
14981 .fill 1024,4,0
14982+#endif
14983+
14984+/*
14985+ * The IDT has to be page-aligned to simplify the Pentium
14986+ * F0 0F bug workaround.. We have a special link segment
14987+ * for this.
14988+ */
14989+.section .idt,"a",@progbits
14990+ENTRY(idt_table)
14991+ .fill 256,8,0
14992
14993 /*
14994 * This starts the data section.
14995 */
14996 #ifdef CONFIG_X86_PAE
14997-__PAGE_ALIGNED_DATA
14998- /* Page-aligned for the benefit of paravirt? */
14999- .align PAGE_SIZE
15000+.section .initial_page_table,"a",@progbits
15001 ENTRY(initial_page_table)
15002 .long pa(initial_pg_pmd+PGD_IDENT_ATTR),0 /* low identity map */
15003 # if KPMDS == 3
15004@@ -663,18 +758,27 @@ ENTRY(initial_page_table)
15005 # error "Kernel PMDs should be 1, 2 or 3"
15006 # endif
15007 .align PAGE_SIZE /* needs to be page-sized too */
15008+
15009+#ifdef CONFIG_PAX_PER_CPU_PGD
15010+ENTRY(cpu_pgd)
15011+ .rept NR_CPUS
15012+ .fill 4,8,0
15013+ .endr
15014+#endif
15015+
15016 #endif
15017
15018 .data
15019 .balign 4
15020 ENTRY(stack_start)
15021- .long init_thread_union+THREAD_SIZE
15022+ .long init_thread_union+THREAD_SIZE-8
15023+
15024+ready: .byte 0
15025
15026+.section .rodata,"a",@progbits
15027 early_recursion_flag:
15028 .long 0
15029
15030-ready: .byte 0
15031-
15032 int_msg:
15033 .asciz "Unknown interrupt or fault at: %p %p %p\n"
15034
15035@@ -707,7 +811,7 @@ fault_msg:
15036 .word 0 # 32 bit align gdt_desc.address
15037 boot_gdt_descr:
15038 .word __BOOT_DS+7
15039- .long boot_gdt - __PAGE_OFFSET
15040+ .long pa(boot_gdt)
15041
15042 .word 0 # 32-bit align idt_desc.address
15043 idt_descr:
15044@@ -718,7 +822,7 @@ idt_descr:
15045 .word 0 # 32 bit align gdt_desc.address
15046 ENTRY(early_gdt_descr)
15047 .word GDT_ENTRIES*8-1
15048- .long gdt_page /* Overwritten for secondary CPUs */
15049+ .long cpu_gdt_table /* Overwritten for secondary CPUs */
15050
15051 /*
15052 * The boot_gdt must mirror the equivalent in setup.S and is
15053@@ -727,5 +831,65 @@ ENTRY(early_gdt_descr)
15054 .align L1_CACHE_BYTES
15055 ENTRY(boot_gdt)
15056 .fill GDT_ENTRY_BOOT_CS,8,0
15057- .quad 0x00cf9a000000ffff /* kernel 4GB code at 0x00000000 */
15058- .quad 0x00cf92000000ffff /* kernel 4GB data at 0x00000000 */
15059+ .quad 0x00cf9b000000ffff /* kernel 4GB code at 0x00000000 */
15060+ .quad 0x00cf93000000ffff /* kernel 4GB data at 0x00000000 */
15061+
15062+ .align PAGE_SIZE_asm
15063+ENTRY(cpu_gdt_table)
15064+ .rept NR_CPUS
15065+ .quad 0x0000000000000000 /* NULL descriptor */
15066+ .quad 0x0000000000000000 /* 0x0b reserved */
15067+ .quad 0x0000000000000000 /* 0x13 reserved */
15068+ .quad 0x0000000000000000 /* 0x1b reserved */
15069+
15070+#ifdef CONFIG_PAX_KERNEXEC
15071+ .quad 0x00cf9b000000ffff /* 0x20 alternate kernel 4GB code at 0x00000000 */
15072+#else
15073+ .quad 0x0000000000000000 /* 0x20 unused */
15074+#endif
15075+
15076+ .quad 0x0000000000000000 /* 0x28 unused */
15077+ .quad 0x0000000000000000 /* 0x33 TLS entry 1 */
15078+ .quad 0x0000000000000000 /* 0x3b TLS entry 2 */
15079+ .quad 0x0000000000000000 /* 0x43 TLS entry 3 */
15080+ .quad 0x0000000000000000 /* 0x4b reserved */
15081+ .quad 0x0000000000000000 /* 0x53 reserved */
15082+ .quad 0x0000000000000000 /* 0x5b reserved */
15083+
15084+ .quad 0x00cf9b000000ffff /* 0x60 kernel 4GB code at 0x00000000 */
15085+ .quad 0x00cf93000000ffff /* 0x68 kernel 4GB data at 0x00000000 */
15086+ .quad 0x00cffb000000ffff /* 0x73 user 4GB code at 0x00000000 */
15087+ .quad 0x00cff3000000ffff /* 0x7b user 4GB data at 0x00000000 */
15088+
15089+ .quad 0x0000000000000000 /* 0x80 TSS descriptor */
15090+ .quad 0x0000000000000000 /* 0x88 LDT descriptor */
15091+
15092+ /*
15093+ * Segments used for calling PnP BIOS have byte granularity.
15094+ * The code segments and data segments have fixed 64k limits,
15095+ * the transfer segment sizes are set at run time.
15096+ */
15097+ .quad 0x00409b000000ffff /* 0x90 32-bit code */
15098+ .quad 0x00009b000000ffff /* 0x98 16-bit code */
15099+ .quad 0x000093000000ffff /* 0xa0 16-bit data */
15100+ .quad 0x0000930000000000 /* 0xa8 16-bit data */
15101+ .quad 0x0000930000000000 /* 0xb0 16-bit data */
15102+
15103+ /*
15104+ * The APM segments have byte granularity and their bases
15105+ * are set at run time. All have 64k limits.
15106+ */
15107+ .quad 0x00409b000000ffff /* 0xb8 APM CS code */
15108+ .quad 0x00009b000000ffff /* 0xc0 APM CS 16 code (16 bit) */
15109+ .quad 0x004093000000ffff /* 0xc8 APM DS data */
15110+
15111+ .quad 0x00c0930000000000 /* 0xd0 - ESPFIX SS */
15112+ .quad 0x0040930000000000 /* 0xd8 - PERCPU */
15113+ .quad 0x0040910000000018 /* 0xe0 - STACK_CANARY */
15114+ .quad 0x0000000000000000 /* 0xe8 - PCIBIOS_CS */
15115+ .quad 0x0000000000000000 /* 0xf0 - PCIBIOS_DS */
15116+ .quad 0x0000000000000000 /* 0xf8 - GDT entry 31: double-fault TSS */
15117+
15118+ /* Be sure this is zeroed to avoid false validations in Xen */
15119+ .fill PAGE_SIZE_asm - GDT_SIZE,1,0
15120+ .endr
15121diff -urNp linux-2.6.39/arch/x86/kernel/head_64.S linux-2.6.39/arch/x86/kernel/head_64.S
15122--- linux-2.6.39/arch/x86/kernel/head_64.S 2011-05-19 00:06:34.000000000 -0400
15123+++ linux-2.6.39/arch/x86/kernel/head_64.S 2011-05-22 19:36:30.000000000 -0400
15124@@ -19,6 +19,7 @@
15125 #include <asm/cache.h>
15126 #include <asm/processor-flags.h>
15127 #include <asm/percpu.h>
15128+#include <asm/cpufeature.h>
15129
15130 #ifdef CONFIG_PARAVIRT
15131 #include <asm/asm-offsets.h>
15132@@ -38,6 +39,10 @@ L4_PAGE_OFFSET = pgd_index(__PAGE_OFFSET
15133 L3_PAGE_OFFSET = pud_index(__PAGE_OFFSET)
15134 L4_START_KERNEL = pgd_index(__START_KERNEL_map)
15135 L3_START_KERNEL = pud_index(__START_KERNEL_map)
15136+L4_VMALLOC_START = pgd_index(VMALLOC_START)
15137+L3_VMALLOC_START = pud_index(VMALLOC_START)
15138+L4_VMEMMAP_START = pgd_index(VMEMMAP_START)
15139+L3_VMEMMAP_START = pud_index(VMEMMAP_START)
15140
15141 .text
15142 __HEAD
15143@@ -85,35 +90,22 @@ startup_64:
15144 */
15145 addq %rbp, init_level4_pgt + 0(%rip)
15146 addq %rbp, init_level4_pgt + (L4_PAGE_OFFSET*8)(%rip)
15147+ addq %rbp, init_level4_pgt + (L4_VMALLOC_START*8)(%rip)
15148+ addq %rbp, init_level4_pgt + (L4_VMEMMAP_START*8)(%rip)
15149 addq %rbp, init_level4_pgt + (L4_START_KERNEL*8)(%rip)
15150
15151 addq %rbp, level3_ident_pgt + 0(%rip)
15152+#ifndef CONFIG_XEN
15153+ addq %rbp, level3_ident_pgt + 8(%rip)
15154+#endif
15155
15156- addq %rbp, level3_kernel_pgt + (510*8)(%rip)
15157- addq %rbp, level3_kernel_pgt + (511*8)(%rip)
15158+ addq %rbp, level3_vmemmap_pgt + (L3_VMEMMAP_START*8)(%rip)
15159
15160- addq %rbp, level2_fixmap_pgt + (506*8)(%rip)
15161+ addq %rbp, level3_kernel_pgt + (L3_START_KERNEL*8)(%rip)
15162+ addq %rbp, level3_kernel_pgt + (L3_START_KERNEL*8+8)(%rip)
15163
15164- /* Add an Identity mapping if I am above 1G */
15165- leaq _text(%rip), %rdi
15166- andq $PMD_PAGE_MASK, %rdi
15167-
15168- movq %rdi, %rax
15169- shrq $PUD_SHIFT, %rax
15170- andq $(PTRS_PER_PUD - 1), %rax
15171- jz ident_complete
15172-
15173- leaq (level2_spare_pgt - __START_KERNEL_map + _KERNPG_TABLE)(%rbp), %rdx
15174- leaq level3_ident_pgt(%rip), %rbx
15175- movq %rdx, 0(%rbx, %rax, 8)
15176-
15177- movq %rdi, %rax
15178- shrq $PMD_SHIFT, %rax
15179- andq $(PTRS_PER_PMD - 1), %rax
15180- leaq __PAGE_KERNEL_IDENT_LARGE_EXEC(%rdi), %rdx
15181- leaq level2_spare_pgt(%rip), %rbx
15182- movq %rdx, 0(%rbx, %rax, 8)
15183-ident_complete:
15184+ addq %rbp, level2_fixmap_pgt + (506*8)(%rip)
15185+ addq %rbp, level2_fixmap_pgt + (507*8)(%rip)
15186
15187 /*
15188 * Fixup the kernel text+data virtual addresses. Note that
15189@@ -160,8 +152,8 @@ ENTRY(secondary_startup_64)
15190 * after the boot processor executes this code.
15191 */
15192
15193- /* Enable PAE mode and PGE */
15194- movl $(X86_CR4_PAE | X86_CR4_PGE), %eax
15195+ /* Enable PAE mode and PSE/PGE */
15196+ movl $(X86_CR4_PSE | X86_CR4_PAE | X86_CR4_PGE), %eax
15197 movq %rax, %cr4
15198
15199 /* Setup early boot stage 4 level pagetables. */
15200@@ -183,9 +175,14 @@ ENTRY(secondary_startup_64)
15201 movl $MSR_EFER, %ecx
15202 rdmsr
15203 btsl $_EFER_SCE, %eax /* Enable System Call */
15204- btl $20,%edi /* No Execute supported? */
15205+ btl $(X86_FEATURE_NX & 31),%edi /* No Execute supported? */
15206 jnc 1f
15207 btsl $_EFER_NX, %eax
15208+ leaq init_level4_pgt(%rip), %rdi
15209+ btsq $_PAGE_BIT_NX, 8*L4_PAGE_OFFSET(%rdi)
15210+ btsq $_PAGE_BIT_NX, 8*L4_VMALLOC_START(%rdi)
15211+ btsq $_PAGE_BIT_NX, 8*L4_VMEMMAP_START(%rdi)
15212+ btsq $_PAGE_BIT_NX, __supported_pte_mask(%rip)
15213 1: wrmsr /* Make changes effective */
15214
15215 /* Setup cr0 */
15216@@ -269,7 +266,7 @@ ENTRY(secondary_startup_64)
15217 bad_address:
15218 jmp bad_address
15219
15220- .section ".init.text","ax"
15221+ __INIT
15222 #ifdef CONFIG_EARLY_PRINTK
15223 .globl early_idt_handlers
15224 early_idt_handlers:
15225@@ -314,18 +311,23 @@ ENTRY(early_idt_handler)
15226 #endif /* EARLY_PRINTK */
15227 1: hlt
15228 jmp 1b
15229+ .previous
15230
15231 #ifdef CONFIG_EARLY_PRINTK
15232+ __INITDATA
15233 early_recursion_flag:
15234 .long 0
15235+ .previous
15236
15237+ .section .rodata,"a",@progbits
15238 early_idt_msg:
15239 .asciz "PANIC: early exception %02lx rip %lx:%lx error %lx cr2 %lx\n"
15240 early_idt_ripmsg:
15241 .asciz "RIP %s\n"
15242-#endif /* CONFIG_EARLY_PRINTK */
15243 .previous
15244+#endif /* CONFIG_EARLY_PRINTK */
15245
15246+ .section .rodata,"a",@progbits
15247 #define NEXT_PAGE(name) \
15248 .balign PAGE_SIZE; \
15249 ENTRY(name)
15250@@ -338,7 +340,6 @@ ENTRY(name)
15251 i = i + 1 ; \
15252 .endr
15253
15254- .data
15255 /*
15256 * This default setting generates an ident mapping at address 0x100000
15257 * and a mapping for the kernel that precisely maps virtual address
15258@@ -349,13 +350,36 @@ NEXT_PAGE(init_level4_pgt)
15259 .quad level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
15260 .org init_level4_pgt + L4_PAGE_OFFSET*8, 0
15261 .quad level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
15262+ .org init_level4_pgt + L4_VMALLOC_START*8, 0
15263+ .quad level3_vmalloc_pgt - __START_KERNEL_map + _KERNPG_TABLE
15264+ .org init_level4_pgt + L4_VMEMMAP_START*8, 0
15265+ .quad level3_vmemmap_pgt - __START_KERNEL_map + _KERNPG_TABLE
15266 .org init_level4_pgt + L4_START_KERNEL*8, 0
15267 /* (2^48-(2*1024*1024*1024))/(2^39) = 511 */
15268 .quad level3_kernel_pgt - __START_KERNEL_map + _PAGE_TABLE
15269
15270+#ifdef CONFIG_PAX_PER_CPU_PGD
15271+NEXT_PAGE(cpu_pgd)
15272+ .rept NR_CPUS
15273+ .fill 512,8,0
15274+ .endr
15275+#endif
15276+
15277 NEXT_PAGE(level3_ident_pgt)
15278 .quad level2_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
15279+#ifdef CONFIG_XEN
15280 .fill 511,8,0
15281+#else
15282+ .quad level2_ident_pgt + PAGE_SIZE - __START_KERNEL_map + _KERNPG_TABLE
15283+ .fill 510,8,0
15284+#endif
15285+
15286+NEXT_PAGE(level3_vmalloc_pgt)
15287+ .fill 512,8,0
15288+
15289+NEXT_PAGE(level3_vmemmap_pgt)
15290+ .fill L3_VMEMMAP_START,8,0
15291+ .quad level2_vmemmap_pgt - __START_KERNEL_map + _KERNPG_TABLE
15292
15293 NEXT_PAGE(level3_kernel_pgt)
15294 .fill L3_START_KERNEL,8,0
15295@@ -363,20 +387,23 @@ NEXT_PAGE(level3_kernel_pgt)
15296 .quad level2_kernel_pgt - __START_KERNEL_map + _KERNPG_TABLE
15297 .quad level2_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE
15298
15299+NEXT_PAGE(level2_vmemmap_pgt)
15300+ .fill 512,8,0
15301+
15302 NEXT_PAGE(level2_fixmap_pgt)
15303- .fill 506,8,0
15304- .quad level1_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE
15305- /* 8MB reserved for vsyscalls + a 2MB hole = 4 + 1 entries */
15306- .fill 5,8,0
15307+ .fill 507,8,0
15308+ .quad level1_vsyscall_pgt - __START_KERNEL_map + _PAGE_TABLE
15309+ /* 6MB reserved for vsyscalls + a 2MB hole = 3 + 1 entries */
15310+ .fill 4,8,0
15311
15312-NEXT_PAGE(level1_fixmap_pgt)
15313+NEXT_PAGE(level1_vsyscall_pgt)
15314 .fill 512,8,0
15315
15316-NEXT_PAGE(level2_ident_pgt)
15317- /* Since I easily can, map the first 1G.
15318+ /* Since I easily can, map the first 2G.
15319 * Don't set NX because code runs from these pages.
15320 */
15321- PMDS(0, __PAGE_KERNEL_IDENT_LARGE_EXEC, PTRS_PER_PMD)
15322+NEXT_PAGE(level2_ident_pgt)
15323+ PMDS(0, __PAGE_KERNEL_IDENT_LARGE_EXEC, 2*PTRS_PER_PMD)
15324
15325 NEXT_PAGE(level2_kernel_pgt)
15326 /*
15327@@ -389,33 +416,55 @@ NEXT_PAGE(level2_kernel_pgt)
15328 * If you want to increase this then increase MODULES_VADDR
15329 * too.)
15330 */
15331- PMDS(0, __PAGE_KERNEL_LARGE_EXEC,
15332- KERNEL_IMAGE_SIZE/PMD_SIZE)
15333-
15334-NEXT_PAGE(level2_spare_pgt)
15335- .fill 512, 8, 0
15336+ PMDS(0, __PAGE_KERNEL_LARGE_EXEC, KERNEL_IMAGE_SIZE/PMD_SIZE)
15337
15338 #undef PMDS
15339 #undef NEXT_PAGE
15340
15341- .data
15342+ .align PAGE_SIZE
15343+ENTRY(cpu_gdt_table)
15344+ .rept NR_CPUS
15345+ .quad 0x0000000000000000 /* NULL descriptor */
15346+ .quad 0x00cf9b000000ffff /* __KERNEL32_CS */
15347+ .quad 0x00af9b000000ffff /* __KERNEL_CS */
15348+ .quad 0x00cf93000000ffff /* __KERNEL_DS */
15349+ .quad 0x00cffb000000ffff /* __USER32_CS */
15350+ .quad 0x00cff3000000ffff /* __USER_DS, __USER32_DS */
15351+ .quad 0x00affb000000ffff /* __USER_CS */
15352+
15353+#ifdef CONFIG_PAX_KERNEXEC
15354+ .quad 0x00af9b000000ffff /* __KERNEXEC_KERNEL_CS */
15355+#else
15356+ .quad 0x0 /* unused */
15357+#endif
15358+
15359+ .quad 0,0 /* TSS */
15360+ .quad 0,0 /* LDT */
15361+ .quad 0,0,0 /* three TLS descriptors */
15362+ .quad 0x0000f40000000000 /* node/CPU stored in limit */
15363+ /* asm/segment.h:GDT_ENTRIES must match this */
15364+
15365+ /* zero the remaining page */
15366+ .fill PAGE_SIZE / 8 - GDT_ENTRIES,8,0
15367+ .endr
15368+
15369 .align 16
15370 .globl early_gdt_descr
15371 early_gdt_descr:
15372 .word GDT_ENTRIES*8-1
15373 early_gdt_descr_base:
15374- .quad INIT_PER_CPU_VAR(gdt_page)
15375+ .quad cpu_gdt_table
15376
15377 ENTRY(phys_base)
15378 /* This must match the first entry in level2_kernel_pgt */
15379 .quad 0x0000000000000000
15380
15381 #include "../../x86/xen/xen-head.S"
15382-
15383- .section .bss, "aw", @nobits
15384+
15385+ .section .rodata,"a",@progbits
15386 .align L1_CACHE_BYTES
15387 ENTRY(idt_table)
15388- .skip IDT_ENTRIES * 16
15389+ .fill 512,8,0
15390
15391 __PAGE_ALIGNED_BSS
15392 .align PAGE_SIZE
15393diff -urNp linux-2.6.39/arch/x86/kernel/i386_ksyms_32.c linux-2.6.39/arch/x86/kernel/i386_ksyms_32.c
15394--- linux-2.6.39/arch/x86/kernel/i386_ksyms_32.c 2011-05-19 00:06:34.000000000 -0400
15395+++ linux-2.6.39/arch/x86/kernel/i386_ksyms_32.c 2011-05-22 19:36:30.000000000 -0400
15396@@ -20,8 +20,12 @@ extern void cmpxchg8b_emu(void);
15397 EXPORT_SYMBOL(cmpxchg8b_emu);
15398 #endif
15399
15400+EXPORT_SYMBOL_GPL(cpu_gdt_table);
15401+
15402 /* Networking helper routines. */
15403 EXPORT_SYMBOL(csum_partial_copy_generic);
15404+EXPORT_SYMBOL(csum_partial_copy_generic_to_user);
15405+EXPORT_SYMBOL(csum_partial_copy_generic_from_user);
15406
15407 EXPORT_SYMBOL(__get_user_1);
15408 EXPORT_SYMBOL(__get_user_2);
15409@@ -36,3 +40,7 @@ EXPORT_SYMBOL(strstr);
15410
15411 EXPORT_SYMBOL(csum_partial);
15412 EXPORT_SYMBOL(empty_zero_page);
15413+
15414+#ifdef CONFIG_PAX_KERNEXEC
15415+EXPORT_SYMBOL(__LOAD_PHYSICAL_ADDR);
15416+#endif
15417diff -urNp linux-2.6.39/arch/x86/kernel/i8259.c linux-2.6.39/arch/x86/kernel/i8259.c
15418--- linux-2.6.39/arch/x86/kernel/i8259.c 2011-05-19 00:06:34.000000000 -0400
15419+++ linux-2.6.39/arch/x86/kernel/i8259.c 2011-05-22 19:36:30.000000000 -0400
15420@@ -210,7 +210,7 @@ spurious_8259A_irq:
15421 "spurious 8259A interrupt: IRQ%d.\n", irq);
15422 spurious_irq_mask |= irqmask;
15423 }
15424- atomic_inc(&irq_err_count);
15425+ atomic_inc_unchecked(&irq_err_count);
15426 /*
15427 * Theoretically we do not have to handle this IRQ,
15428 * but in Linux this does not cause problems and is
15429diff -urNp linux-2.6.39/arch/x86/kernel/init_task.c linux-2.6.39/arch/x86/kernel/init_task.c
15430--- linux-2.6.39/arch/x86/kernel/init_task.c 2011-05-19 00:06:34.000000000 -0400
15431+++ linux-2.6.39/arch/x86/kernel/init_task.c 2011-05-22 19:36:30.000000000 -0400
15432@@ -20,8 +20,7 @@ static struct sighand_struct init_sighan
15433 * way process stacks are handled. This is done by having a special
15434 * "init_task" linker map entry..
15435 */
15436-union thread_union init_thread_union __init_task_data =
15437- { INIT_THREAD_INFO(init_task) };
15438+union thread_union init_thread_union __init_task_data;
15439
15440 /*
15441 * Initial task structure.
15442@@ -38,5 +37,5 @@ EXPORT_SYMBOL(init_task);
15443 * section. Since TSS's are completely CPU-local, we want them
15444 * on exact cacheline boundaries, to eliminate cacheline ping-pong.
15445 */
15446-DEFINE_PER_CPU_SHARED_ALIGNED(struct tss_struct, init_tss) = INIT_TSS;
15447-
15448+struct tss_struct init_tss[NR_CPUS] ____cacheline_internodealigned_in_smp = { [0 ... NR_CPUS-1] = INIT_TSS };
15449+EXPORT_SYMBOL(init_tss);
15450diff -urNp linux-2.6.39/arch/x86/kernel/ioport.c linux-2.6.39/arch/x86/kernel/ioport.c
15451--- linux-2.6.39/arch/x86/kernel/ioport.c 2011-05-19 00:06:34.000000000 -0400
15452+++ linux-2.6.39/arch/x86/kernel/ioport.c 2011-05-22 19:41:32.000000000 -0400
15453@@ -6,6 +6,7 @@
15454 #include <linux/sched.h>
15455 #include <linux/kernel.h>
15456 #include <linux/capability.h>
15457+#include <linux/security.h>
15458 #include <linux/errno.h>
15459 #include <linux/types.h>
15460 #include <linux/ioport.h>
15461@@ -28,6 +29,12 @@ asmlinkage long sys_ioperm(unsigned long
15462
15463 if ((from + num <= from) || (from + num > IO_BITMAP_BITS))
15464 return -EINVAL;
15465+#ifdef CONFIG_GRKERNSEC_IO
15466+ if (turn_on && grsec_disable_privio) {
15467+ gr_handle_ioperm();
15468+ return -EPERM;
15469+ }
15470+#endif
15471 if (turn_on && !capable(CAP_SYS_RAWIO))
15472 return -EPERM;
15473
15474@@ -54,7 +61,7 @@ asmlinkage long sys_ioperm(unsigned long
15475 * because the ->io_bitmap_max value must match the bitmap
15476 * contents:
15477 */
15478- tss = &per_cpu(init_tss, get_cpu());
15479+ tss = init_tss + get_cpu();
15480
15481 if (turn_on)
15482 bitmap_clear(t->io_bitmap_ptr, from, num);
15483@@ -102,6 +109,12 @@ long sys_iopl(unsigned int level, struct
15484 return -EINVAL;
15485 /* Trying to gain more privileges? */
15486 if (level > old) {
15487+#ifdef CONFIG_GRKERNSEC_IO
15488+ if (grsec_disable_privio) {
15489+ gr_handle_iopl();
15490+ return -EPERM;
15491+ }
15492+#endif
15493 if (!capable(CAP_SYS_RAWIO))
15494 return -EPERM;
15495 }
15496diff -urNp linux-2.6.39/arch/x86/kernel/irq_32.c linux-2.6.39/arch/x86/kernel/irq_32.c
15497--- linux-2.6.39/arch/x86/kernel/irq_32.c 2011-05-19 00:06:34.000000000 -0400
15498+++ linux-2.6.39/arch/x86/kernel/irq_32.c 2011-05-22 19:36:30.000000000 -0400
15499@@ -36,7 +36,7 @@ static int check_stack_overflow(void)
15500 __asm__ __volatile__("andl %%esp,%0" :
15501 "=r" (sp) : "0" (THREAD_SIZE - 1));
15502
15503- return sp < (sizeof(struct thread_info) + STACK_WARN);
15504+ return sp < STACK_WARN;
15505 }
15506
15507 static void print_stack_overflow(void)
15508@@ -54,8 +54,8 @@ static inline void print_stack_overflow(
15509 * per-CPU IRQ handling contexts (thread information and stack)
15510 */
15511 union irq_ctx {
15512- struct thread_info tinfo;
15513- u32 stack[THREAD_SIZE/sizeof(u32)];
15514+ unsigned long previous_esp;
15515+ u32 stack[THREAD_SIZE/sizeof(u32)];
15516 } __attribute__((aligned(THREAD_SIZE)));
15517
15518 static DEFINE_PER_CPU(union irq_ctx *, hardirq_ctx);
15519@@ -75,10 +75,9 @@ static void call_on_stack(void *func, vo
15520 static inline int
15521 execute_on_irq_stack(int overflow, struct irq_desc *desc, int irq)
15522 {
15523- union irq_ctx *curctx, *irqctx;
15524+ union irq_ctx *irqctx;
15525 u32 *isp, arg1, arg2;
15526
15527- curctx = (union irq_ctx *) current_thread_info();
15528 irqctx = __this_cpu_read(hardirq_ctx);
15529
15530 /*
15531@@ -87,21 +86,17 @@ execute_on_irq_stack(int overflow, struc
15532 * handler) we can't do that and just have to keep using the
15533 * current stack (which is the irq stack already after all)
15534 */
15535- if (unlikely(curctx == irqctx))
15536+ if (unlikely((void *)current_stack_pointer - (void *)irqctx < THREAD_SIZE))
15537 return 0;
15538
15539 /* build the stack frame on the IRQ stack */
15540- isp = (u32 *) ((char *)irqctx + sizeof(*irqctx));
15541- irqctx->tinfo.task = curctx->tinfo.task;
15542- irqctx->tinfo.previous_esp = current_stack_pointer;
15543+ isp = (u32 *) ((char *)irqctx + sizeof(*irqctx) - 8);
15544+ irqctx->previous_esp = current_stack_pointer;
15545+ add_preempt_count(HARDIRQ_OFFSET);
15546
15547- /*
15548- * Copy the softirq bits in preempt_count so that the
15549- * softirq checks work in the hardirq context.
15550- */
15551- irqctx->tinfo.preempt_count =
15552- (irqctx->tinfo.preempt_count & ~SOFTIRQ_MASK) |
15553- (curctx->tinfo.preempt_count & SOFTIRQ_MASK);
15554+#ifdef CONFIG_PAX_MEMORY_UDEREF
15555+ __set_fs(MAKE_MM_SEG(0));
15556+#endif
15557
15558 if (unlikely(overflow))
15559 call_on_stack(print_stack_overflow, isp);
15560@@ -113,6 +108,12 @@ execute_on_irq_stack(int overflow, struc
15561 : "0" (irq), "1" (desc), "2" (isp),
15562 "D" (desc->handle_irq)
15563 : "memory", "cc", "ecx");
15564+
15565+#ifdef CONFIG_PAX_MEMORY_UDEREF
15566+ __set_fs(current_thread_info()->addr_limit);
15567+#endif
15568+
15569+ sub_preempt_count(HARDIRQ_OFFSET);
15570 return 1;
15571 }
15572
15573@@ -121,29 +122,11 @@ execute_on_irq_stack(int overflow, struc
15574 */
15575 void __cpuinit irq_ctx_init(int cpu)
15576 {
15577- union irq_ctx *irqctx;
15578-
15579 if (per_cpu(hardirq_ctx, cpu))
15580 return;
15581
15582- irqctx = page_address(alloc_pages_node(cpu_to_node(cpu),
15583- THREAD_FLAGS,
15584- THREAD_ORDER));
15585- memset(&irqctx->tinfo, 0, sizeof(struct thread_info));
15586- irqctx->tinfo.cpu = cpu;
15587- irqctx->tinfo.preempt_count = HARDIRQ_OFFSET;
15588- irqctx->tinfo.addr_limit = MAKE_MM_SEG(0);
15589-
15590- per_cpu(hardirq_ctx, cpu) = irqctx;
15591-
15592- irqctx = page_address(alloc_pages_node(cpu_to_node(cpu),
15593- THREAD_FLAGS,
15594- THREAD_ORDER));
15595- memset(&irqctx->tinfo, 0, sizeof(struct thread_info));
15596- irqctx->tinfo.cpu = cpu;
15597- irqctx->tinfo.addr_limit = MAKE_MM_SEG(0);
15598-
15599- per_cpu(softirq_ctx, cpu) = irqctx;
15600+ per_cpu(hardirq_ctx, cpu) = page_address(alloc_pages_node(cpu_to_node(cpu), THREAD_FLAGS, THREAD_ORDER));
15601+ per_cpu(softirq_ctx, cpu) = page_address(alloc_pages_node(cpu_to_node(cpu), THREAD_FLAGS, THREAD_ORDER));
15602
15603 printk(KERN_DEBUG "CPU %u irqstacks, hard=%p soft=%p\n",
15604 cpu, per_cpu(hardirq_ctx, cpu), per_cpu(softirq_ctx, cpu));
15605@@ -152,7 +135,6 @@ void __cpuinit irq_ctx_init(int cpu)
15606 asmlinkage void do_softirq(void)
15607 {
15608 unsigned long flags;
15609- struct thread_info *curctx;
15610 union irq_ctx *irqctx;
15611 u32 *isp;
15612
15613@@ -162,15 +144,22 @@ asmlinkage void do_softirq(void)
15614 local_irq_save(flags);
15615
15616 if (local_softirq_pending()) {
15617- curctx = current_thread_info();
15618 irqctx = __this_cpu_read(softirq_ctx);
15619- irqctx->tinfo.task = curctx->task;
15620- irqctx->tinfo.previous_esp = current_stack_pointer;
15621+ irqctx->previous_esp = current_stack_pointer;
15622
15623 /* build the stack frame on the softirq stack */
15624- isp = (u32 *) ((char *)irqctx + sizeof(*irqctx));
15625+ isp = (u32 *) ((char *)irqctx + sizeof(*irqctx) - 8);
15626+
15627+#ifdef CONFIG_PAX_MEMORY_UDEREF
15628+ __set_fs(MAKE_MM_SEG(0));
15629+#endif
15630
15631 call_on_stack(__do_softirq, isp);
15632+
15633+#ifdef CONFIG_PAX_MEMORY_UDEREF
15634+ __set_fs(current_thread_info()->addr_limit);
15635+#endif
15636+
15637 /*
15638 * Shouldn't happen, we returned above if in_interrupt():
15639 */
15640diff -urNp linux-2.6.39/arch/x86/kernel/irq.c linux-2.6.39/arch/x86/kernel/irq.c
15641--- linux-2.6.39/arch/x86/kernel/irq.c 2011-05-19 00:06:34.000000000 -0400
15642+++ linux-2.6.39/arch/x86/kernel/irq.c 2011-05-22 19:36:30.000000000 -0400
15643@@ -17,7 +17,7 @@
15644 #include <asm/mce.h>
15645 #include <asm/hw_irq.h>
15646
15647-atomic_t irq_err_count;
15648+atomic_unchecked_t irq_err_count;
15649
15650 /* Function pointer for generic interrupt vector handling */
15651 void (*x86_platform_ipi_callback)(void) = NULL;
15652@@ -116,9 +116,9 @@ int arch_show_interrupts(struct seq_file
15653 seq_printf(p, "%10u ", per_cpu(mce_poll_count, j));
15654 seq_printf(p, " Machine check polls\n");
15655 #endif
15656- seq_printf(p, "%*s: %10u\n", prec, "ERR", atomic_read(&irq_err_count));
15657+ seq_printf(p, "%*s: %10u\n", prec, "ERR", atomic_read_unchecked(&irq_err_count));
15658 #if defined(CONFIG_X86_IO_APIC)
15659- seq_printf(p, "%*s: %10u\n", prec, "MIS", atomic_read(&irq_mis_count));
15660+ seq_printf(p, "%*s: %10u\n", prec, "MIS", atomic_read_unchecked(&irq_mis_count));
15661 #endif
15662 return 0;
15663 }
15664@@ -158,10 +158,10 @@ u64 arch_irq_stat_cpu(unsigned int cpu)
15665
15666 u64 arch_irq_stat(void)
15667 {
15668- u64 sum = atomic_read(&irq_err_count);
15669+ u64 sum = atomic_read_unchecked(&irq_err_count);
15670
15671 #ifdef CONFIG_X86_IO_APIC
15672- sum += atomic_read(&irq_mis_count);
15673+ sum += atomic_read_unchecked(&irq_mis_count);
15674 #endif
15675 return sum;
15676 }
15677diff -urNp linux-2.6.39/arch/x86/kernel/kgdb.c linux-2.6.39/arch/x86/kernel/kgdb.c
15678--- linux-2.6.39/arch/x86/kernel/kgdb.c 2011-05-19 00:06:34.000000000 -0400
15679+++ linux-2.6.39/arch/x86/kernel/kgdb.c 2011-05-22 19:36:30.000000000 -0400
15680@@ -124,11 +124,11 @@ char *dbg_get_reg(int regno, void *mem,
15681 #ifdef CONFIG_X86_32
15682 switch (regno) {
15683 case GDB_SS:
15684- if (!user_mode_vm(regs))
15685+ if (!user_mode(regs))
15686 *(unsigned long *)mem = __KERNEL_DS;
15687 break;
15688 case GDB_SP:
15689- if (!user_mode_vm(regs))
15690+ if (!user_mode(regs))
15691 *(unsigned long *)mem = kernel_stack_pointer(regs);
15692 break;
15693 case GDB_GS:
15694@@ -473,12 +473,12 @@ int kgdb_arch_handle_exception(int e_vec
15695 case 'k':
15696 /* clear the trace bit */
15697 linux_regs->flags &= ~X86_EFLAGS_TF;
15698- atomic_set(&kgdb_cpu_doing_single_step, -1);
15699+ atomic_set_unchecked(&kgdb_cpu_doing_single_step, -1);
15700
15701 /* set the trace bit if we're stepping */
15702 if (remcomInBuffer[0] == 's') {
15703 linux_regs->flags |= X86_EFLAGS_TF;
15704- atomic_set(&kgdb_cpu_doing_single_step,
15705+ atomic_set_unchecked(&kgdb_cpu_doing_single_step,
15706 raw_smp_processor_id());
15707 }
15708
15709@@ -534,7 +534,7 @@ static int __kgdb_notify(struct die_args
15710 return NOTIFY_DONE;
15711
15712 case DIE_DEBUG:
15713- if (atomic_read(&kgdb_cpu_doing_single_step) != -1) {
15714+ if (atomic_read_unchecked(&kgdb_cpu_doing_single_step) != -1) {
15715 if (user_mode(regs))
15716 return single_step_cont(regs, args);
15717 break;
15718@@ -710,7 +710,7 @@ void kgdb_arch_set_pc(struct pt_regs *re
15719 regs->ip = ip;
15720 }
15721
15722-struct kgdb_arch arch_kgdb_ops = {
15723+const struct kgdb_arch arch_kgdb_ops = {
15724 /* Breakpoint instruction: */
15725 .gdb_bpt_instr = { 0xcc },
15726 .flags = KGDB_HW_BREAKPOINT,
15727diff -urNp linux-2.6.39/arch/x86/kernel/kprobes.c linux-2.6.39/arch/x86/kernel/kprobes.c
15728--- linux-2.6.39/arch/x86/kernel/kprobes.c 2011-05-19 00:06:34.000000000 -0400
15729+++ linux-2.6.39/arch/x86/kernel/kprobes.c 2011-05-22 19:36:30.000000000 -0400
15730@@ -115,8 +115,11 @@ static void __kprobes __synthesize_relat
15731 } __attribute__((packed)) *insn;
15732
15733 insn = (struct __arch_relative_insn *)from;
15734+
15735+ pax_open_kernel();
15736 insn->raddr = (s32)((long)(to) - ((long)(from) + 5));
15737 insn->op = op;
15738+ pax_close_kernel();
15739 }
15740
15741 /* Insert a jump instruction at address 'from', which jumps to address 'to'.*/
15742@@ -153,7 +156,7 @@ static int __kprobes can_boost(kprobe_op
15743 kprobe_opcode_t opcode;
15744 kprobe_opcode_t *orig_opcodes = opcodes;
15745
15746- if (search_exception_tables((unsigned long)opcodes))
15747+ if (search_exception_tables(ktva_ktla((unsigned long)opcodes)))
15748 return 0; /* Page fault may occur on this address. */
15749
15750 retry:
15751@@ -314,7 +317,9 @@ static int __kprobes __copy_instruction(
15752 }
15753 }
15754 insn_get_length(&insn);
15755+ pax_open_kernel();
15756 memcpy(dest, insn.kaddr, insn.length);
15757+ pax_close_kernel();
15758
15759 #ifdef CONFIG_X86_64
15760 if (insn_rip_relative(&insn)) {
15761@@ -338,7 +343,9 @@ static int __kprobes __copy_instruction(
15762 (u8 *) dest;
15763 BUG_ON((s64) (s32) newdisp != newdisp); /* Sanity check. */
15764 disp = (u8 *) dest + insn_offset_displacement(&insn);
15765+ pax_open_kernel();
15766 *(s32 *) disp = (s32) newdisp;
15767+ pax_close_kernel();
15768 }
15769 #endif
15770 return insn.length;
15771@@ -352,12 +359,12 @@ static void __kprobes arch_copy_kprobe(s
15772 */
15773 __copy_instruction(p->ainsn.insn, p->addr, 0);
15774
15775- if (can_boost(p->addr))
15776+ if (can_boost(ktla_ktva(p->addr)))
15777 p->ainsn.boostable = 0;
15778 else
15779 p->ainsn.boostable = -1;
15780
15781- p->opcode = *p->addr;
15782+ p->opcode = *(ktla_ktva(p->addr));
15783 }
15784
15785 int __kprobes arch_prepare_kprobe(struct kprobe *p)
15786@@ -474,7 +481,7 @@ static void __kprobes setup_singlestep(s
15787 * nor set current_kprobe, because it doesn't use single
15788 * stepping.
15789 */
15790- regs->ip = (unsigned long)p->ainsn.insn;
15791+ regs->ip = ktva_ktla((unsigned long)p->ainsn.insn);
15792 preempt_enable_no_resched();
15793 return;
15794 }
15795@@ -493,7 +500,7 @@ static void __kprobes setup_singlestep(s
15796 if (p->opcode == BREAKPOINT_INSTRUCTION)
15797 regs->ip = (unsigned long)p->addr;
15798 else
15799- regs->ip = (unsigned long)p->ainsn.insn;
15800+ regs->ip = ktva_ktla((unsigned long)p->ainsn.insn);
15801 }
15802
15803 /*
15804@@ -572,7 +579,7 @@ static int __kprobes kprobe_handler(stru
15805 setup_singlestep(p, regs, kcb, 0);
15806 return 1;
15807 }
15808- } else if (*addr != BREAKPOINT_INSTRUCTION) {
15809+ } else if (*(kprobe_opcode_t *)ktla_ktva((unsigned long)addr) != BREAKPOINT_INSTRUCTION) {
15810 /*
15811 * The breakpoint instruction was removed right
15812 * after we hit it. Another cpu has removed
15813@@ -817,7 +824,7 @@ static void __kprobes resume_execution(s
15814 struct pt_regs *regs, struct kprobe_ctlblk *kcb)
15815 {
15816 unsigned long *tos = stack_addr(regs);
15817- unsigned long copy_ip = (unsigned long)p->ainsn.insn;
15818+ unsigned long copy_ip = ktva_ktla((unsigned long)p->ainsn.insn);
15819 unsigned long orig_ip = (unsigned long)p->addr;
15820 kprobe_opcode_t *insn = p->ainsn.insn;
15821
15822@@ -999,7 +1006,7 @@ int __kprobes kprobe_exceptions_notify(s
15823 struct die_args *args = data;
15824 int ret = NOTIFY_DONE;
15825
15826- if (args->regs && user_mode_vm(args->regs))
15827+ if (args->regs && user_mode(args->regs))
15828 return ret;
15829
15830 switch (val) {
15831@@ -1381,7 +1388,7 @@ int __kprobes arch_prepare_optimized_kpr
15832 * Verify if the address gap is in 2GB range, because this uses
15833 * a relative jump.
15834 */
15835- rel = (long)op->optinsn.insn - (long)op->kp.addr + RELATIVEJUMP_SIZE;
15836+ rel = (long)op->optinsn.insn - ktla_ktva((long)op->kp.addr) + RELATIVEJUMP_SIZE;
15837 if (abs(rel) > 0x7fffffff)
15838 return -ERANGE;
15839
15840@@ -1402,11 +1409,11 @@ int __kprobes arch_prepare_optimized_kpr
15841 synthesize_set_arg1(buf + TMPL_MOVE_IDX, (unsigned long)op);
15842
15843 /* Set probe function call */
15844- synthesize_relcall(buf + TMPL_CALL_IDX, optimized_callback);
15845+ synthesize_relcall(buf + TMPL_CALL_IDX, ktla_ktva(optimized_callback));
15846
15847 /* Set returning jmp instruction at the tail of out-of-line buffer */
15848 synthesize_reljump(buf + TMPL_END_IDX + op->optinsn.size,
15849- (u8 *)op->kp.addr + op->optinsn.size);
15850+ (u8 *)ktla_ktva(op->kp.addr) + op->optinsn.size);
15851
15852 flush_icache_range((unsigned long) buf,
15853 (unsigned long) buf + TMPL_END_IDX +
15854@@ -1428,7 +1435,7 @@ static void __kprobes setup_optimize_kpr
15855 ((long)op->kp.addr + RELATIVEJUMP_SIZE));
15856
15857 /* Backup instructions which will be replaced by jump address */
15858- memcpy(op->optinsn.copied_insn, op->kp.addr + INT3_SIZE,
15859+ memcpy(op->optinsn.copied_insn, ktla_ktva(op->kp.addr) + INT3_SIZE,
15860 RELATIVE_ADDR_SIZE);
15861
15862 insn_buf[0] = RELATIVEJUMP_OPCODE;
15863diff -urNp linux-2.6.39/arch/x86/kernel/ldt.c linux-2.6.39/arch/x86/kernel/ldt.c
15864--- linux-2.6.39/arch/x86/kernel/ldt.c 2011-05-19 00:06:34.000000000 -0400
15865+++ linux-2.6.39/arch/x86/kernel/ldt.c 2011-05-22 19:36:30.000000000 -0400
15866@@ -67,13 +67,13 @@ static int alloc_ldt(mm_context_t *pc, i
15867 if (reload) {
15868 #ifdef CONFIG_SMP
15869 preempt_disable();
15870- load_LDT(pc);
15871+ load_LDT_nolock(pc);
15872 if (!cpumask_equal(mm_cpumask(current->mm),
15873 cpumask_of(smp_processor_id())))
15874 smp_call_function(flush_ldt, current->mm, 1);
15875 preempt_enable();
15876 #else
15877- load_LDT(pc);
15878+ load_LDT_nolock(pc);
15879 #endif
15880 }
15881 if (oldsize) {
15882@@ -95,7 +95,7 @@ static inline int copy_ldt(mm_context_t
15883 return err;
15884
15885 for (i = 0; i < old->size; i++)
15886- write_ldt_entry(new->ldt, i, old->ldt + i * LDT_ENTRY_SIZE);
15887+ write_ldt_entry(new->ldt, i, old->ldt + i);
15888 return 0;
15889 }
15890
15891@@ -116,6 +116,24 @@ int init_new_context(struct task_struct
15892 retval = copy_ldt(&mm->context, &old_mm->context);
15893 mutex_unlock(&old_mm->context.lock);
15894 }
15895+
15896+ if (tsk == current) {
15897+ mm->context.vdso = 0;
15898+
15899+#ifdef CONFIG_X86_32
15900+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
15901+ mm->context.user_cs_base = 0UL;
15902+ mm->context.user_cs_limit = ~0UL;
15903+
15904+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
15905+ cpus_clear(mm->context.cpu_user_cs_mask);
15906+#endif
15907+
15908+#endif
15909+#endif
15910+
15911+ }
15912+
15913 return retval;
15914 }
15915
15916@@ -230,6 +248,13 @@ static int write_ldt(void __user *ptr, u
15917 }
15918 }
15919
15920+#ifdef CONFIG_PAX_SEGMEXEC
15921+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (ldt_info.contents & MODIFY_LDT_CONTENTS_CODE)) {
15922+ error = -EINVAL;
15923+ goto out_unlock;
15924+ }
15925+#endif
15926+
15927 fill_ldt(&ldt, &ldt_info);
15928 if (oldmode)
15929 ldt.avl = 0;
15930diff -urNp linux-2.6.39/arch/x86/kernel/machine_kexec_32.c linux-2.6.39/arch/x86/kernel/machine_kexec_32.c
15931--- linux-2.6.39/arch/x86/kernel/machine_kexec_32.c 2011-05-19 00:06:34.000000000 -0400
15932+++ linux-2.6.39/arch/x86/kernel/machine_kexec_32.c 2011-05-22 19:36:30.000000000 -0400
15933@@ -27,7 +27,7 @@
15934 #include <asm/cacheflush.h>
15935 #include <asm/debugreg.h>
15936
15937-static void set_idt(void *newidt, __u16 limit)
15938+static void set_idt(struct desc_struct *newidt, __u16 limit)
15939 {
15940 struct desc_ptr curidt;
15941
15942@@ -39,7 +39,7 @@ static void set_idt(void *newidt, __u16
15943 }
15944
15945
15946-static void set_gdt(void *newgdt, __u16 limit)
15947+static void set_gdt(struct desc_struct *newgdt, __u16 limit)
15948 {
15949 struct desc_ptr curgdt;
15950
15951@@ -217,7 +217,7 @@ void machine_kexec(struct kimage *image)
15952 }
15953
15954 control_page = page_address(image->control_code_page);
15955- memcpy(control_page, relocate_kernel, KEXEC_CONTROL_CODE_MAX_SIZE);
15956+ memcpy(control_page, (void *)ktla_ktva((unsigned long)relocate_kernel), KEXEC_CONTROL_CODE_MAX_SIZE);
15957
15958 relocate_kernel_ptr = control_page;
15959 page_list[PA_CONTROL_PAGE] = __pa(control_page);
15960diff -urNp linux-2.6.39/arch/x86/kernel/microcode_amd.c linux-2.6.39/arch/x86/kernel/microcode_amd.c
15961--- linux-2.6.39/arch/x86/kernel/microcode_amd.c 2011-05-19 00:06:34.000000000 -0400
15962+++ linux-2.6.39/arch/x86/kernel/microcode_amd.c 2011-05-22 19:36:30.000000000 -0400
15963@@ -339,7 +339,7 @@ static void microcode_fini_cpu_amd(int c
15964 uci->mc = NULL;
15965 }
15966
15967-static struct microcode_ops microcode_amd_ops = {
15968+static const struct microcode_ops microcode_amd_ops = {
15969 .request_microcode_user = request_microcode_user,
15970 .request_microcode_fw = request_microcode_amd,
15971 .collect_cpu_info = collect_cpu_info_amd,
15972@@ -347,7 +347,7 @@ static struct microcode_ops microcode_am
15973 .microcode_fini_cpu = microcode_fini_cpu_amd,
15974 };
15975
15976-struct microcode_ops * __init init_amd_microcode(void)
15977+const struct microcode_ops * __init init_amd_microcode(void)
15978 {
15979 return &microcode_amd_ops;
15980 }
15981diff -urNp linux-2.6.39/arch/x86/kernel/microcode_core.c linux-2.6.39/arch/x86/kernel/microcode_core.c
15982--- linux-2.6.39/arch/x86/kernel/microcode_core.c 2011-05-19 00:06:34.000000000 -0400
15983+++ linux-2.6.39/arch/x86/kernel/microcode_core.c 2011-05-22 19:36:30.000000000 -0400
15984@@ -93,7 +93,7 @@ MODULE_LICENSE("GPL");
15985
15986 #define MICROCODE_VERSION "2.00"
15987
15988-static struct microcode_ops *microcode_ops;
15989+static const struct microcode_ops *microcode_ops;
15990
15991 /*
15992 * Synchronization.
15993diff -urNp linux-2.6.39/arch/x86/kernel/microcode_intel.c linux-2.6.39/arch/x86/kernel/microcode_intel.c
15994--- linux-2.6.39/arch/x86/kernel/microcode_intel.c 2011-05-19 00:06:34.000000000 -0400
15995+++ linux-2.6.39/arch/x86/kernel/microcode_intel.c 2011-05-22 19:36:30.000000000 -0400
15996@@ -440,13 +440,13 @@ static enum ucode_state request_microcod
15997
15998 static int get_ucode_user(void *to, const void *from, size_t n)
15999 {
16000- return copy_from_user(to, from, n);
16001+ return copy_from_user(to, (__force const void __user *)from, n);
16002 }
16003
16004 static enum ucode_state
16005 request_microcode_user(int cpu, const void __user *buf, size_t size)
16006 {
16007- return generic_load_microcode(cpu, (void *)buf, size, &get_ucode_user);
16008+ return generic_load_microcode(cpu, (__force void *)buf, size, &get_ucode_user);
16009 }
16010
16011 static void microcode_fini_cpu(int cpu)
16012@@ -457,7 +457,7 @@ static void microcode_fini_cpu(int cpu)
16013 uci->mc = NULL;
16014 }
16015
16016-static struct microcode_ops microcode_intel_ops = {
16017+static const struct microcode_ops microcode_intel_ops = {
16018 .request_microcode_user = request_microcode_user,
16019 .request_microcode_fw = request_microcode_fw,
16020 .collect_cpu_info = collect_cpu_info,
16021@@ -465,7 +465,7 @@ static struct microcode_ops microcode_in
16022 .microcode_fini_cpu = microcode_fini_cpu,
16023 };
16024
16025-struct microcode_ops * __init init_intel_microcode(void)
16026+const struct microcode_ops * __init init_intel_microcode(void)
16027 {
16028 return &microcode_intel_ops;
16029 }
16030diff -urNp linux-2.6.39/arch/x86/kernel/module.c linux-2.6.39/arch/x86/kernel/module.c
16031--- linux-2.6.39/arch/x86/kernel/module.c 2011-05-19 00:06:34.000000000 -0400
16032+++ linux-2.6.39/arch/x86/kernel/module.c 2011-05-22 19:36:30.000000000 -0400
16033@@ -35,21 +35,66 @@
16034 #define DEBUGP(fmt...)
16035 #endif
16036
16037-void *module_alloc(unsigned long size)
16038+static inline void *__module_alloc(unsigned long size, pgprot_t prot)
16039 {
16040 if (PAGE_ALIGN(size) > MODULES_LEN)
16041 return NULL;
16042 return __vmalloc_node_range(size, 1, MODULES_VADDR, MODULES_END,
16043- GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL_EXEC,
16044+ GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO, prot,
16045 -1, __builtin_return_address(0));
16046 }
16047
16048+void *module_alloc(unsigned long size)
16049+{
16050+
16051+#ifdef CONFIG_PAX_KERNEXEC
16052+ return __module_alloc(size, PAGE_KERNEL);
16053+#else
16054+ return __module_alloc(size, PAGE_KERNEL_EXEC);
16055+#endif
16056+
16057+}
16058+
16059 /* Free memory returned from module_alloc */
16060 void module_free(struct module *mod, void *module_region)
16061 {
16062 vfree(module_region);
16063 }
16064
16065+#ifdef CONFIG_PAX_KERNEXEC
16066+#ifdef CONFIG_X86_32
16067+void *module_alloc_exec(unsigned long size)
16068+{
16069+ struct vm_struct *area;
16070+
16071+ if (size == 0)
16072+ return NULL;
16073+
16074+ area = __get_vm_area(size, VM_ALLOC, (unsigned long)&MODULES_EXEC_VADDR, (unsigned long)&MODULES_EXEC_END);
16075+ return area ? area->addr : NULL;
16076+}
16077+EXPORT_SYMBOL(module_alloc_exec);
16078+
16079+void module_free_exec(struct module *mod, void *module_region)
16080+{
16081+ vunmap(module_region);
16082+}
16083+EXPORT_SYMBOL(module_free_exec);
16084+#else
16085+void module_free_exec(struct module *mod, void *module_region)
16086+{
16087+ module_free(mod, module_region);
16088+}
16089+EXPORT_SYMBOL(module_free_exec);
16090+
16091+void *module_alloc_exec(unsigned long size)
16092+{
16093+ return __module_alloc(size, PAGE_KERNEL_RX);
16094+}
16095+EXPORT_SYMBOL(module_alloc_exec);
16096+#endif
16097+#endif
16098+
16099 /* We don't need anything special. */
16100 int module_frob_arch_sections(Elf_Ehdr *hdr,
16101 Elf_Shdr *sechdrs,
16102@@ -69,14 +114,16 @@ int apply_relocate(Elf32_Shdr *sechdrs,
16103 unsigned int i;
16104 Elf32_Rel *rel = (void *)sechdrs[relsec].sh_addr;
16105 Elf32_Sym *sym;
16106- uint32_t *location;
16107+ uint32_t *plocation, location;
16108
16109 DEBUGP("Applying relocate section %u to %u\n", relsec,
16110 sechdrs[relsec].sh_info);
16111 for (i = 0; i < sechdrs[relsec].sh_size / sizeof(*rel); i++) {
16112 /* This is where to make the change */
16113- location = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr
16114- + rel[i].r_offset;
16115+ plocation = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr + rel[i].r_offset;
16116+ location = (uint32_t)plocation;
16117+ if (sechdrs[sechdrs[relsec].sh_info].sh_flags & SHF_EXECINSTR)
16118+ plocation = ktla_ktva((void *)plocation);
16119 /* This is the symbol it is referring to. Note that all
16120 undefined symbols have been resolved. */
16121 sym = (Elf32_Sym *)sechdrs[symindex].sh_addr
16122@@ -85,11 +132,15 @@ int apply_relocate(Elf32_Shdr *sechdrs,
16123 switch (ELF32_R_TYPE(rel[i].r_info)) {
16124 case R_386_32:
16125 /* We add the value into the location given */
16126- *location += sym->st_value;
16127+ pax_open_kernel();
16128+ *plocation += sym->st_value;
16129+ pax_close_kernel();
16130 break;
16131 case R_386_PC32:
16132 /* Add the value, subtract its postition */
16133- *location += sym->st_value - (uint32_t)location;
16134+ pax_open_kernel();
16135+ *plocation += sym->st_value - location;
16136+ pax_close_kernel();
16137 break;
16138 default:
16139 printk(KERN_ERR "module %s: Unknown relocation: %u\n",
16140@@ -145,21 +196,30 @@ int apply_relocate_add(Elf64_Shdr *sechd
16141 case R_X86_64_NONE:
16142 break;
16143 case R_X86_64_64:
16144+ pax_open_kernel();
16145 *(u64 *)loc = val;
16146+ pax_close_kernel();
16147 break;
16148 case R_X86_64_32:
16149+ pax_open_kernel();
16150 *(u32 *)loc = val;
16151+ pax_close_kernel();
16152 if (val != *(u32 *)loc)
16153 goto overflow;
16154 break;
16155 case R_X86_64_32S:
16156+ pax_open_kernel();
16157 *(s32 *)loc = val;
16158+ pax_close_kernel();
16159 if ((s64)val != *(s32 *)loc)
16160 goto overflow;
16161 break;
16162 case R_X86_64_PC32:
16163 val -= (u64)loc;
16164+ pax_open_kernel();
16165 *(u32 *)loc = val;
16166+ pax_close_kernel();
16167+
16168 #if 0
16169 if ((s64)val != *(s32 *)loc)
16170 goto overflow;
16171diff -urNp linux-2.6.39/arch/x86/kernel/paravirt.c linux-2.6.39/arch/x86/kernel/paravirt.c
16172--- linux-2.6.39/arch/x86/kernel/paravirt.c 2011-05-19 00:06:34.000000000 -0400
16173+++ linux-2.6.39/arch/x86/kernel/paravirt.c 2011-05-22 19:36:30.000000000 -0400
16174@@ -122,7 +122,7 @@ unsigned paravirt_patch_jmp(void *insnbu
16175 * corresponding structure. */
16176 static void *get_call_destination(u8 type)
16177 {
16178- struct paravirt_patch_template tmpl = {
16179+ const struct paravirt_patch_template tmpl = {
16180 .pv_init_ops = pv_init_ops,
16181 .pv_time_ops = pv_time_ops,
16182 .pv_cpu_ops = pv_cpu_ops,
16183@@ -133,6 +133,9 @@ static void *get_call_destination(u8 typ
16184 .pv_lock_ops = pv_lock_ops,
16185 #endif
16186 };
16187+
16188+ pax_track_stack();
16189+
16190 return *((void **)&tmpl + type);
16191 }
16192
16193@@ -145,14 +148,14 @@ unsigned paravirt_patch_default(u8 type,
16194 if (opfunc == NULL)
16195 /* If there's no function, patch it with a ud2a (BUG) */
16196 ret = paravirt_patch_insns(insnbuf, len, ud2a, ud2a+sizeof(ud2a));
16197- else if (opfunc == _paravirt_nop)
16198+ else if (opfunc == (void *)_paravirt_nop)
16199 /* If the operation is a nop, then nop the callsite */
16200 ret = paravirt_patch_nop();
16201
16202 /* identity functions just return their single argument */
16203- else if (opfunc == _paravirt_ident_32)
16204+ else if (opfunc == (void *)_paravirt_ident_32)
16205 ret = paravirt_patch_ident_32(insnbuf, len);
16206- else if (opfunc == _paravirt_ident_64)
16207+ else if (opfunc == (void *)_paravirt_ident_64)
16208 ret = paravirt_patch_ident_64(insnbuf, len);
16209
16210 else if (type == PARAVIRT_PATCH(pv_cpu_ops.iret) ||
16211@@ -178,7 +181,7 @@ unsigned paravirt_patch_insns(void *insn
16212 if (insn_len > len || start == NULL)
16213 insn_len = len;
16214 else
16215- memcpy(insnbuf, start, insn_len);
16216+ memcpy(insnbuf, ktla_ktva(start), insn_len);
16217
16218 return insn_len;
16219 }
16220@@ -294,22 +297,22 @@ void arch_flush_lazy_mmu_mode(void)
16221 preempt_enable();
16222 }
16223
16224-struct pv_info pv_info = {
16225+struct pv_info pv_info __read_only = {
16226 .name = "bare hardware",
16227 .paravirt_enabled = 0,
16228 .kernel_rpl = 0,
16229 .shared_kernel_pmd = 1, /* Only used when CONFIG_X86_PAE is set */
16230 };
16231
16232-struct pv_init_ops pv_init_ops = {
16233+struct pv_init_ops pv_init_ops __read_only = {
16234 .patch = native_patch,
16235 };
16236
16237-struct pv_time_ops pv_time_ops = {
16238+struct pv_time_ops pv_time_ops __read_only = {
16239 .sched_clock = native_sched_clock,
16240 };
16241
16242-struct pv_irq_ops pv_irq_ops = {
16243+struct pv_irq_ops pv_irq_ops __read_only = {
16244 .save_fl = __PV_IS_CALLEE_SAVE(native_save_fl),
16245 .restore_fl = __PV_IS_CALLEE_SAVE(native_restore_fl),
16246 .irq_disable = __PV_IS_CALLEE_SAVE(native_irq_disable),
16247@@ -321,7 +324,7 @@ struct pv_irq_ops pv_irq_ops = {
16248 #endif
16249 };
16250
16251-struct pv_cpu_ops pv_cpu_ops = {
16252+struct pv_cpu_ops pv_cpu_ops __read_only = {
16253 .cpuid = native_cpuid,
16254 .get_debugreg = native_get_debugreg,
16255 .set_debugreg = native_set_debugreg,
16256@@ -382,7 +385,7 @@ struct pv_cpu_ops pv_cpu_ops = {
16257 .end_context_switch = paravirt_nop,
16258 };
16259
16260-struct pv_apic_ops pv_apic_ops = {
16261+struct pv_apic_ops pv_apic_ops __read_only = {
16262 #ifdef CONFIG_X86_LOCAL_APIC
16263 .startup_ipi_hook = paravirt_nop,
16264 #endif
16265@@ -396,7 +399,7 @@ struct pv_apic_ops pv_apic_ops = {
16266 #define PTE_IDENT __PV_IS_CALLEE_SAVE(_paravirt_ident_64)
16267 #endif
16268
16269-struct pv_mmu_ops pv_mmu_ops = {
16270+struct pv_mmu_ops pv_mmu_ops __read_only = {
16271
16272 .read_cr2 = native_read_cr2,
16273 .write_cr2 = native_write_cr2,
16274@@ -465,6 +468,12 @@ struct pv_mmu_ops pv_mmu_ops = {
16275 },
16276
16277 .set_fixmap = native_set_fixmap,
16278+
16279+#ifdef CONFIG_PAX_KERNEXEC
16280+ .pax_open_kernel = native_pax_open_kernel,
16281+ .pax_close_kernel = native_pax_close_kernel,
16282+#endif
16283+
16284 };
16285
16286 EXPORT_SYMBOL_GPL(pv_time_ops);
16287diff -urNp linux-2.6.39/arch/x86/kernel/paravirt-spinlocks.c linux-2.6.39/arch/x86/kernel/paravirt-spinlocks.c
16288--- linux-2.6.39/arch/x86/kernel/paravirt-spinlocks.c 2011-05-19 00:06:34.000000000 -0400
16289+++ linux-2.6.39/arch/x86/kernel/paravirt-spinlocks.c 2011-05-22 19:36:30.000000000 -0400
16290@@ -13,7 +13,7 @@ default_spin_lock_flags(arch_spinlock_t
16291 arch_spin_lock(lock);
16292 }
16293
16294-struct pv_lock_ops pv_lock_ops = {
16295+struct pv_lock_ops pv_lock_ops __read_only = {
16296 #ifdef CONFIG_SMP
16297 .spin_is_locked = __ticket_spin_is_locked,
16298 .spin_is_contended = __ticket_spin_is_contended,
16299diff -urNp linux-2.6.39/arch/x86/kernel/pci-calgary_64.c linux-2.6.39/arch/x86/kernel/pci-calgary_64.c
16300--- linux-2.6.39/arch/x86/kernel/pci-calgary_64.c 2011-05-19 00:06:34.000000000 -0400
16301+++ linux-2.6.39/arch/x86/kernel/pci-calgary_64.c 2011-05-22 19:36:30.000000000 -0400
16302@@ -179,13 +179,13 @@ static void calioc2_dump_error_regs(stru
16303 static void calgary_init_bitmap_from_tce_table(struct iommu_table *tbl);
16304 static void get_tce_space_from_tar(void);
16305
16306-static struct cal_chipset_ops calgary_chip_ops = {
16307+static const struct cal_chipset_ops calgary_chip_ops = {
16308 .handle_quirks = calgary_handle_quirks,
16309 .tce_cache_blast = calgary_tce_cache_blast,
16310 .dump_error_regs = calgary_dump_error_regs
16311 };
16312
16313-static struct cal_chipset_ops calioc2_chip_ops = {
16314+static const struct cal_chipset_ops calioc2_chip_ops = {
16315 .handle_quirks = calioc2_handle_quirks,
16316 .tce_cache_blast = calioc2_tce_cache_blast,
16317 .dump_error_regs = calioc2_dump_error_regs
16318@@ -476,7 +476,7 @@ static void calgary_free_coherent(struct
16319 free_pages((unsigned long)vaddr, get_order(size));
16320 }
16321
16322-static struct dma_map_ops calgary_dma_ops = {
16323+static const struct dma_map_ops calgary_dma_ops = {
16324 .alloc_coherent = calgary_alloc_coherent,
16325 .free_coherent = calgary_free_coherent,
16326 .map_sg = calgary_map_sg,
16327diff -urNp linux-2.6.39/arch/x86/kernel/pci-dma.c linux-2.6.39/arch/x86/kernel/pci-dma.c
16328--- linux-2.6.39/arch/x86/kernel/pci-dma.c 2011-05-19 00:06:34.000000000 -0400
16329+++ linux-2.6.39/arch/x86/kernel/pci-dma.c 2011-05-22 19:36:30.000000000 -0400
16330@@ -16,7 +16,7 @@
16331
16332 static int forbid_dac __read_mostly;
16333
16334-struct dma_map_ops *dma_ops = &nommu_dma_ops;
16335+const struct dma_map_ops *dma_ops = &nommu_dma_ops;
16336 EXPORT_SYMBOL(dma_ops);
16337
16338 static int iommu_sac_force __read_mostly;
16339@@ -250,7 +250,7 @@ early_param("iommu", iommu_setup);
16340
16341 int dma_supported(struct device *dev, u64 mask)
16342 {
16343- struct dma_map_ops *ops = get_dma_ops(dev);
16344+ const struct dma_map_ops *ops = get_dma_ops(dev);
16345
16346 #ifdef CONFIG_PCI
16347 if (mask > 0xffffffff && forbid_dac > 0) {
16348diff -urNp linux-2.6.39/arch/x86/kernel/pci-gart_64.c linux-2.6.39/arch/x86/kernel/pci-gart_64.c
16349--- linux-2.6.39/arch/x86/kernel/pci-gart_64.c 2011-05-19 00:06:34.000000000 -0400
16350+++ linux-2.6.39/arch/x86/kernel/pci-gart_64.c 2011-05-22 19:36:30.000000000 -0400
16351@@ -695,7 +695,7 @@ static __init int init_amd_gatt(struct a
16352 return -1;
16353 }
16354
16355-static struct dma_map_ops gart_dma_ops = {
16356+static const struct dma_map_ops gart_dma_ops = {
16357 .map_sg = gart_map_sg,
16358 .unmap_sg = gart_unmap_sg,
16359 .map_page = gart_map_page,
16360diff -urNp linux-2.6.39/arch/x86/kernel/pci-iommu_table.c linux-2.6.39/arch/x86/kernel/pci-iommu_table.c
16361--- linux-2.6.39/arch/x86/kernel/pci-iommu_table.c 2011-05-19 00:06:34.000000000 -0400
16362+++ linux-2.6.39/arch/x86/kernel/pci-iommu_table.c 2011-05-22 19:36:30.000000000 -0400
16363@@ -2,7 +2,7 @@
16364 #include <asm/iommu_table.h>
16365 #include <linux/string.h>
16366 #include <linux/kallsyms.h>
16367-
16368+#include <linux/sched.h>
16369
16370 #define DEBUG 1
16371
16372@@ -53,6 +53,8 @@ void __init check_iommu_entries(struct i
16373 char sym_p[KSYM_SYMBOL_LEN];
16374 char sym_q[KSYM_SYMBOL_LEN];
16375
16376+ pax_track_stack();
16377+
16378 /* Simple cyclic dependency checker. */
16379 for (p = start; p < finish; p++) {
16380 q = find_dependents_of(start, finish, p);
16381diff -urNp linux-2.6.39/arch/x86/kernel/pci-nommu.c linux-2.6.39/arch/x86/kernel/pci-nommu.c
16382--- linux-2.6.39/arch/x86/kernel/pci-nommu.c 2011-05-19 00:06:34.000000000 -0400
16383+++ linux-2.6.39/arch/x86/kernel/pci-nommu.c 2011-05-22 19:36:30.000000000 -0400
16384@@ -95,7 +95,7 @@ static void nommu_sync_sg_for_device(str
16385 flush_write_buffers();
16386 }
16387
16388-struct dma_map_ops nommu_dma_ops = {
16389+const struct dma_map_ops nommu_dma_ops = {
16390 .alloc_coherent = dma_generic_alloc_coherent,
16391 .free_coherent = nommu_free_coherent,
16392 .map_sg = nommu_map_sg,
16393diff -urNp linux-2.6.39/arch/x86/kernel/pci-swiotlb.c linux-2.6.39/arch/x86/kernel/pci-swiotlb.c
16394--- linux-2.6.39/arch/x86/kernel/pci-swiotlb.c 2011-05-19 00:06:34.000000000 -0400
16395+++ linux-2.6.39/arch/x86/kernel/pci-swiotlb.c 2011-05-22 19:36:30.000000000 -0400
16396@@ -26,7 +26,7 @@ static void *x86_swiotlb_alloc_coherent(
16397 return swiotlb_alloc_coherent(hwdev, size, dma_handle, flags);
16398 }
16399
16400-static struct dma_map_ops swiotlb_dma_ops = {
16401+static const struct dma_map_ops swiotlb_dma_ops = {
16402 .mapping_error = swiotlb_dma_mapping_error,
16403 .alloc_coherent = x86_swiotlb_alloc_coherent,
16404 .free_coherent = swiotlb_free_coherent,
16405diff -urNp linux-2.6.39/arch/x86/kernel/process_32.c linux-2.6.39/arch/x86/kernel/process_32.c
16406--- linux-2.6.39/arch/x86/kernel/process_32.c 2011-05-19 00:06:34.000000000 -0400
16407+++ linux-2.6.39/arch/x86/kernel/process_32.c 2011-05-22 19:36:30.000000000 -0400
16408@@ -65,6 +65,7 @@ asmlinkage void ret_from_fork(void) __as
16409 unsigned long thread_saved_pc(struct task_struct *tsk)
16410 {
16411 return ((unsigned long *)tsk->thread.sp)[3];
16412+//XXX return tsk->thread.eip;
16413 }
16414
16415 #ifndef CONFIG_SMP
16416@@ -126,15 +127,14 @@ void __show_regs(struct pt_regs *regs, i
16417 unsigned long sp;
16418 unsigned short ss, gs;
16419
16420- if (user_mode_vm(regs)) {
16421+ if (user_mode(regs)) {
16422 sp = regs->sp;
16423 ss = regs->ss & 0xffff;
16424- gs = get_user_gs(regs);
16425 } else {
16426 sp = kernel_stack_pointer(regs);
16427 savesegment(ss, ss);
16428- savesegment(gs, gs);
16429 }
16430+ gs = get_user_gs(regs);
16431
16432 show_regs_common();
16433
16434@@ -196,13 +196,14 @@ int copy_thread(unsigned long clone_flag
16435 struct task_struct *tsk;
16436 int err;
16437
16438- childregs = task_pt_regs(p);
16439+ childregs = task_stack_page(p) + THREAD_SIZE - sizeof(struct pt_regs) - 8;
16440 *childregs = *regs;
16441 childregs->ax = 0;
16442 childregs->sp = sp;
16443
16444 p->thread.sp = (unsigned long) childregs;
16445 p->thread.sp0 = (unsigned long) (childregs+1);
16446+ p->tinfo.lowest_stack = (unsigned long)task_stack_page(p);
16447
16448 p->thread.ip = (unsigned long) ret_from_fork;
16449
16450@@ -293,7 +294,7 @@ __switch_to(struct task_struct *prev_p,
16451 struct thread_struct *prev = &prev_p->thread,
16452 *next = &next_p->thread;
16453 int cpu = smp_processor_id();
16454- struct tss_struct *tss = &per_cpu(init_tss, cpu);
16455+ struct tss_struct *tss = init_tss + cpu;
16456 bool preload_fpu;
16457
16458 /* never put a printk in __switch_to... printk() calls wake_up*() indirectly */
16459@@ -328,6 +329,10 @@ __switch_to(struct task_struct *prev_p,
16460 */
16461 lazy_save_gs(prev->gs);
16462
16463+#ifdef CONFIG_PAX_MEMORY_UDEREF
16464+ __set_fs(task_thread_info(next_p)->addr_limit);
16465+#endif
16466+
16467 /*
16468 * Load the per-thread Thread-Local Storage descriptor.
16469 */
16470@@ -363,6 +368,9 @@ __switch_to(struct task_struct *prev_p,
16471 */
16472 arch_end_context_switch(next_p);
16473
16474+ percpu_write(current_task, next_p);
16475+ percpu_write(current_tinfo, &next_p->tinfo);
16476+
16477 if (preload_fpu)
16478 __math_state_restore();
16479
16480@@ -372,8 +380,6 @@ __switch_to(struct task_struct *prev_p,
16481 if (prev->gs | next->gs)
16482 lazy_load_gs(next->gs);
16483
16484- percpu_write(current_task, next_p);
16485-
16486 return prev_p;
16487 }
16488
16489@@ -403,4 +409,3 @@ unsigned long get_wchan(struct task_stru
16490 } while (count++ < 16);
16491 return 0;
16492 }
16493-
16494diff -urNp linux-2.6.39/arch/x86/kernel/process_64.c linux-2.6.39/arch/x86/kernel/process_64.c
16495--- linux-2.6.39/arch/x86/kernel/process_64.c 2011-05-19 00:06:34.000000000 -0400
16496+++ linux-2.6.39/arch/x86/kernel/process_64.c 2011-05-22 19:36:30.000000000 -0400
16497@@ -87,7 +87,7 @@ static void __exit_idle(void)
16498 void exit_idle(void)
16499 {
16500 /* idle loop has pid 0 */
16501- if (current->pid)
16502+ if (task_pid_nr(current))
16503 return;
16504 __exit_idle();
16505 }
16506@@ -260,8 +260,7 @@ int copy_thread(unsigned long clone_flag
16507 struct pt_regs *childregs;
16508 struct task_struct *me = current;
16509
16510- childregs = ((struct pt_regs *)
16511- (THREAD_SIZE + task_stack_page(p))) - 1;
16512+ childregs = task_stack_page(p) + THREAD_SIZE - sizeof(struct pt_regs) - 16;
16513 *childregs = *regs;
16514
16515 childregs->ax = 0;
16516@@ -273,6 +272,7 @@ int copy_thread(unsigned long clone_flag
16517 p->thread.sp = (unsigned long) childregs;
16518 p->thread.sp0 = (unsigned long) (childregs+1);
16519 p->thread.usersp = me->thread.usersp;
16520+ p->tinfo.lowest_stack = (unsigned long)task_stack_page(p);
16521
16522 set_tsk_thread_flag(p, TIF_FORK);
16523
16524@@ -376,7 +376,7 @@ __switch_to(struct task_struct *prev_p,
16525 struct thread_struct *prev = &prev_p->thread;
16526 struct thread_struct *next = &next_p->thread;
16527 int cpu = smp_processor_id();
16528- struct tss_struct *tss = &per_cpu(init_tss, cpu);
16529+ struct tss_struct *tss = init_tss + cpu;
16530 unsigned fsindex, gsindex;
16531 bool preload_fpu;
16532
16533@@ -472,10 +472,9 @@ __switch_to(struct task_struct *prev_p,
16534 prev->usersp = percpu_read(old_rsp);
16535 percpu_write(old_rsp, next->usersp);
16536 percpu_write(current_task, next_p);
16537+ percpu_write(current_tinfo, &next_p->tinfo);
16538
16539- percpu_write(kernel_stack,
16540- (unsigned long)task_stack_page(next_p) +
16541- THREAD_SIZE - KERNEL_STACK_OFFSET);
16542+ percpu_write(kernel_stack, next->sp0);
16543
16544 /*
16545 * Now maybe reload the debug registers and handle I/O bitmaps
16546@@ -537,12 +536,11 @@ unsigned long get_wchan(struct task_stru
16547 if (!p || p == current || p->state == TASK_RUNNING)
16548 return 0;
16549 stack = (unsigned long)task_stack_page(p);
16550- if (p->thread.sp < stack || p->thread.sp >= stack+THREAD_SIZE)
16551+ if (p->thread.sp < stack || p->thread.sp > stack+THREAD_SIZE-16-sizeof(u64))
16552 return 0;
16553 fp = *(u64 *)(p->thread.sp);
16554 do {
16555- if (fp < (unsigned long)stack ||
16556- fp >= (unsigned long)stack+THREAD_SIZE)
16557+ if (fp < stack || fp > stack+THREAD_SIZE-16-sizeof(u64))
16558 return 0;
16559 ip = *(u64 *)(fp+8);
16560 if (!in_sched_functions(ip))
16561diff -urNp linux-2.6.39/arch/x86/kernel/process.c linux-2.6.39/arch/x86/kernel/process.c
16562--- linux-2.6.39/arch/x86/kernel/process.c 2011-05-19 00:06:34.000000000 -0400
16563+++ linux-2.6.39/arch/x86/kernel/process.c 2011-05-22 19:36:30.000000000 -0400
16564@@ -48,16 +48,33 @@ void free_thread_xstate(struct task_stru
16565
16566 void free_thread_info(struct thread_info *ti)
16567 {
16568- free_thread_xstate(ti->task);
16569 free_pages((unsigned long)ti, get_order(THREAD_SIZE));
16570 }
16571
16572+static struct kmem_cache *task_struct_cachep;
16573+
16574 void arch_task_cache_init(void)
16575 {
16576- task_xstate_cachep =
16577- kmem_cache_create("task_xstate", xstate_size,
16578+ /* create a slab on which task_structs can be allocated */
16579+ task_struct_cachep =
16580+ kmem_cache_create("task_struct", sizeof(struct task_struct),
16581+ ARCH_MIN_TASKALIGN, SLAB_PANIC | SLAB_NOTRACK, NULL);
16582+
16583+ task_xstate_cachep =
16584+ kmem_cache_create("task_xstate", xstate_size,
16585 __alignof__(union thread_xstate),
16586- SLAB_PANIC | SLAB_NOTRACK, NULL);
16587+ SLAB_PANIC | SLAB_NOTRACK | SLAB_USERCOPY, NULL);
16588+}
16589+
16590+struct task_struct *alloc_task_struct_node(int node)
16591+{
16592+ return kmem_cache_alloc_node(task_struct_cachep, GFP_KERNEL, node);
16593+}
16594+
16595+void free_task_struct(struct task_struct *task)
16596+{
16597+ free_thread_xstate(task);
16598+ kmem_cache_free(task_struct_cachep, task);
16599 }
16600
16601 /*
16602@@ -70,7 +87,7 @@ void exit_thread(void)
16603 unsigned long *bp = t->io_bitmap_ptr;
16604
16605 if (bp) {
16606- struct tss_struct *tss = &per_cpu(init_tss, get_cpu());
16607+ struct tss_struct *tss = init_tss + get_cpu();
16608
16609 t->io_bitmap_ptr = NULL;
16610 clear_thread_flag(TIF_IO_BITMAP);
16611@@ -106,7 +123,7 @@ void show_regs_common(void)
16612
16613 printk(KERN_CONT "\n");
16614 printk(KERN_DEFAULT "Pid: %d, comm: %.20s %s %s %.*s",
16615- current->pid, current->comm, print_tainted(),
16616+ task_pid_nr(current), current->comm, print_tainted(),
16617 init_utsname()->release,
16618 (int)strcspn(init_utsname()->version, " "),
16619 init_utsname()->version);
16620@@ -120,6 +137,9 @@ void flush_thread(void)
16621 {
16622 struct task_struct *tsk = current;
16623
16624+#if defined(CONFIG_X86_32) && !defined(CONFIG_CC_STACKPROTECTOR) && !defined(CONFIG_PAX_MEMORY_UDEREF)
16625+ loadsegment(gs, 0);
16626+#endif
16627 flush_ptrace_hw_breakpoint(tsk);
16628 memset(tsk->thread.tls_array, 0, sizeof(tsk->thread.tls_array));
16629 /*
16630@@ -282,10 +302,10 @@ int kernel_thread(int (*fn)(void *), voi
16631 regs.di = (unsigned long) arg;
16632
16633 #ifdef CONFIG_X86_32
16634- regs.ds = __USER_DS;
16635- regs.es = __USER_DS;
16636+ regs.ds = __KERNEL_DS;
16637+ regs.es = __KERNEL_DS;
16638 regs.fs = __KERNEL_PERCPU;
16639- regs.gs = __KERNEL_STACK_CANARY;
16640+ savesegment(gs, regs.gs);
16641 #else
16642 regs.ss = __KERNEL_DS;
16643 #endif
16644@@ -401,7 +421,7 @@ void default_idle(void)
16645 EXPORT_SYMBOL(default_idle);
16646 #endif
16647
16648-void stop_this_cpu(void *dummy)
16649+__noreturn void stop_this_cpu(void *dummy)
16650 {
16651 local_irq_disable();
16652 /*
16653@@ -665,16 +685,34 @@ static int __init idle_setup(char *str)
16654 }
16655 early_param("idle", idle_setup);
16656
16657-unsigned long arch_align_stack(unsigned long sp)
16658+#ifdef CONFIG_PAX_RANDKSTACK
16659+asmlinkage void pax_randomize_kstack(void)
16660 {
16661- if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
16662- sp -= get_random_int() % 8192;
16663- return sp & ~0xf;
16664-}
16665+ struct thread_struct *thread = &current->thread;
16666+ unsigned long time;
16667
16668-unsigned long arch_randomize_brk(struct mm_struct *mm)
16669-{
16670- unsigned long range_end = mm->brk + 0x02000000;
16671- return randomize_range(mm->brk, range_end, 0) ? : mm->brk;
16672-}
16673+ if (!randomize_va_space)
16674+ return;
16675+
16676+ rdtscl(time);
16677+
16678+ /* P4 seems to return a 0 LSB, ignore it */
16679+#ifdef CONFIG_MPENTIUM4
16680+ time &= 0x3EUL;
16681+ time <<= 2;
16682+#elif defined(CONFIG_X86_64)
16683+ time &= 0xFUL;
16684+ time <<= 4;
16685+#else
16686+ time &= 0x1FUL;
16687+ time <<= 3;
16688+#endif
16689+
16690+ thread->sp0 ^= time;
16691+ load_sp0(init_tss + smp_processor_id(), thread);
16692
16693+#ifdef CONFIG_X86_64
16694+ percpu_write(kernel_stack, thread->sp0);
16695+#endif
16696+}
16697+#endif
16698diff -urNp linux-2.6.39/arch/x86/kernel/ptrace.c linux-2.6.39/arch/x86/kernel/ptrace.c
16699--- linux-2.6.39/arch/x86/kernel/ptrace.c 2011-05-19 00:06:34.000000000 -0400
16700+++ linux-2.6.39/arch/x86/kernel/ptrace.c 2011-05-22 19:36:30.000000000 -0400
16701@@ -821,7 +821,7 @@ long arch_ptrace(struct task_struct *chi
16702 unsigned long addr, unsigned long data)
16703 {
16704 int ret;
16705- unsigned long __user *datap = (unsigned long __user *)data;
16706+ unsigned long __user *datap = (__force unsigned long __user *)data;
16707
16708 switch (request) {
16709 /* read the word at location addr in the USER area. */
16710@@ -906,14 +906,14 @@ long arch_ptrace(struct task_struct *chi
16711 if ((int) addr < 0)
16712 return -EIO;
16713 ret = do_get_thread_area(child, addr,
16714- (struct user_desc __user *)data);
16715+ (__force struct user_desc __user *) data);
16716 break;
16717
16718 case PTRACE_SET_THREAD_AREA:
16719 if ((int) addr < 0)
16720 return -EIO;
16721 ret = do_set_thread_area(child, addr,
16722- (struct user_desc __user *)data, 0);
16723+ (__force struct user_desc __user *) data, 0);
16724 break;
16725 #endif
16726
16727@@ -1330,7 +1330,7 @@ static void fill_sigtrap_info(struct tas
16728 memset(info, 0, sizeof(*info));
16729 info->si_signo = SIGTRAP;
16730 info->si_code = si_code;
16731- info->si_addr = user_mode_vm(regs) ? (void __user *)regs->ip : NULL;
16732+ info->si_addr = user_mode(regs) ? (__force void __user *)regs->ip : NULL;
16733 }
16734
16735 void user_single_step_siginfo(struct task_struct *tsk,
16736@@ -1363,7 +1363,7 @@ void send_sigtrap(struct task_struct *ts
16737 * We must return the syscall number to actually look up in the table.
16738 * This can be -1L to skip running any syscall at all.
16739 */
16740-asmregparm long syscall_trace_enter(struct pt_regs *regs)
16741+long syscall_trace_enter(struct pt_regs *regs)
16742 {
16743 long ret = 0;
16744
16745@@ -1408,7 +1408,7 @@ asmregparm long syscall_trace_enter(stru
16746 return ret ?: regs->orig_ax;
16747 }
16748
16749-asmregparm void syscall_trace_leave(struct pt_regs *regs)
16750+void syscall_trace_leave(struct pt_regs *regs)
16751 {
16752 bool step;
16753
16754diff -urNp linux-2.6.39/arch/x86/kernel/pvclock.c linux-2.6.39/arch/x86/kernel/pvclock.c
16755--- linux-2.6.39/arch/x86/kernel/pvclock.c 2011-05-19 00:06:34.000000000 -0400
16756+++ linux-2.6.39/arch/x86/kernel/pvclock.c 2011-05-22 19:36:30.000000000 -0400
16757@@ -81,11 +81,11 @@ unsigned long pvclock_tsc_khz(struct pvc
16758 return pv_tsc_khz;
16759 }
16760
16761-static atomic64_t last_value = ATOMIC64_INIT(0);
16762+static atomic64_unchecked_t last_value = ATOMIC64_INIT(0);
16763
16764 void pvclock_resume(void)
16765 {
16766- atomic64_set(&last_value, 0);
16767+ atomic64_set_unchecked(&last_value, 0);
16768 }
16769
16770 cycle_t pvclock_clocksource_read(struct pvclock_vcpu_time_info *src)
16771@@ -121,11 +121,11 @@ cycle_t pvclock_clocksource_read(struct
16772 * updating at the same time, and one of them could be slightly behind,
16773 * making the assumption that last_value always go forward fail to hold.
16774 */
16775- last = atomic64_read(&last_value);
16776+ last = atomic64_read_unchecked(&last_value);
16777 do {
16778 if (ret < last)
16779 return last;
16780- last = atomic64_cmpxchg(&last_value, last, ret);
16781+ last = atomic64_cmpxchg_unchecked(&last_value, last, ret);
16782 } while (unlikely(last != ret));
16783
16784 return ret;
16785diff -urNp linux-2.6.39/arch/x86/kernel/reboot.c linux-2.6.39/arch/x86/kernel/reboot.c
16786--- linux-2.6.39/arch/x86/kernel/reboot.c 2011-05-19 00:06:34.000000000 -0400
16787+++ linux-2.6.39/arch/x86/kernel/reboot.c 2011-05-23 17:07:00.000000000 -0400
16788@@ -35,7 +35,7 @@ void (*pm_power_off)(void);
16789 EXPORT_SYMBOL(pm_power_off);
16790
16791 static const struct desc_ptr no_idt = {};
16792-static int reboot_mode;
16793+static unsigned short reboot_mode;
16794 enum reboot_type reboot_type = BOOT_KBD;
16795 int reboot_force;
16796
16797@@ -307,13 +307,17 @@ core_initcall(reboot_init);
16798 extern const unsigned char machine_real_restart_asm[];
16799 extern const u64 machine_real_restart_gdt[3];
16800
16801-void machine_real_restart(unsigned int type)
16802+__noreturn void machine_real_restart(unsigned int type)
16803 {
16804 void *restart_va;
16805 unsigned long restart_pa;
16806- void (*restart_lowmem)(unsigned int);
16807+ void (* __noreturn restart_lowmem)(unsigned int);
16808 u64 *lowmem_gdt;
16809
16810+#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF))
16811+ struct desc_struct *gdt;
16812+#endif
16813+
16814 local_irq_disable();
16815
16816 /* Write zero to CMOS register number 0x0f, which the BIOS POST
16817@@ -339,14 +343,14 @@ void machine_real_restart(unsigned int t
16818 boot)". This seems like a fairly standard thing that gets set by
16819 REBOOT.COM programs, and the previous reset routine did this
16820 too. */
16821- *((unsigned short *)0x472) = reboot_mode;
16822+ *(unsigned short *)(__va(0x472)) = reboot_mode;
16823
16824 /* Patch the GDT in the low memory trampoline */
16825 lowmem_gdt = TRAMPOLINE_SYM(machine_real_restart_gdt);
16826
16827 restart_va = TRAMPOLINE_SYM(machine_real_restart_asm);
16828 restart_pa = virt_to_phys(restart_va);
16829- restart_lowmem = (void (*)(unsigned int))restart_pa;
16830+ restart_lowmem = (void *)restart_pa;
16831
16832 /* GDT[0]: GDT self-pointer */
16833 lowmem_gdt[0] =
16834@@ -357,7 +361,33 @@ void machine_real_restart(unsigned int t
16835 GDT_ENTRY(0x009b, restart_pa, 0xffff);
16836
16837 /* Jump to the identity-mapped low memory code */
16838+
16839+#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF))
16840+ gdt = get_cpu_gdt_table(smp_processor_id());
16841+ pax_open_kernel();
16842+#ifdef CONFIG_PAX_MEMORY_UDEREF
16843+ gdt[GDT_ENTRY_KERNEL_DS].type = 3;
16844+ gdt[GDT_ENTRY_KERNEL_DS].limit = 0xf;
16845+ asm("mov %0, %%ds; mov %0, %%es; mov %0, %%ss" : : "r" (__KERNEL_DS) : "memory");
16846+#endif
16847+#ifdef CONFIG_PAX_KERNEXEC
16848+ gdt[GDT_ENTRY_KERNEL_CS].base0 = 0;
16849+ gdt[GDT_ENTRY_KERNEL_CS].base1 = 0;
16850+ gdt[GDT_ENTRY_KERNEL_CS].base2 = 0;
16851+ gdt[GDT_ENTRY_KERNEL_CS].limit0 = 0xffff;
16852+ gdt[GDT_ENTRY_KERNEL_CS].limit = 0xf;
16853+ gdt[GDT_ENTRY_KERNEL_CS].g = 1;
16854+#endif
16855+ pax_close_kernel();
16856+#endif
16857+
16858+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
16859+ asm volatile("push %0; push %1; lret\n" : : "i" (__KERNEL_CS), "rm" (restart_lowmem), "a" (type));
16860+ unreachable();
16861+#else
16862 restart_lowmem(type);
16863+#endif
16864+
16865 }
16866 #ifdef CONFIG_APM_MODULE
16867 EXPORT_SYMBOL(machine_real_restart);
16868@@ -478,7 +508,7 @@ void __attribute__((weak)) mach_reboot_f
16869 {
16870 }
16871
16872-static void native_machine_emergency_restart(void)
16873+__noreturn static void native_machine_emergency_restart(void)
16874 {
16875 int i;
16876
16877@@ -593,13 +623,13 @@ void native_machine_shutdown(void)
16878 #endif
16879 }
16880
16881-static void __machine_emergency_restart(int emergency)
16882+static __noreturn void __machine_emergency_restart(int emergency)
16883 {
16884 reboot_emergency = emergency;
16885 machine_ops.emergency_restart();
16886 }
16887
16888-static void native_machine_restart(char *__unused)
16889+static __noreturn void native_machine_restart(char *__unused)
16890 {
16891 printk("machine restart\n");
16892
16893@@ -608,7 +638,7 @@ static void native_machine_restart(char
16894 __machine_emergency_restart(0);
16895 }
16896
16897-static void native_machine_halt(void)
16898+static __noreturn void native_machine_halt(void)
16899 {
16900 /* stop other cpus and apics */
16901 machine_shutdown();
16902@@ -619,7 +649,7 @@ static void native_machine_halt(void)
16903 stop_this_cpu(NULL);
16904 }
16905
16906-static void native_machine_power_off(void)
16907+__noreturn static void native_machine_power_off(void)
16908 {
16909 if (pm_power_off) {
16910 if (!reboot_force)
16911@@ -628,6 +658,7 @@ static void native_machine_power_off(voi
16912 }
16913 /* a fallback in case there is no PM info available */
16914 tboot_shutdown(TB_SHUTDOWN_HALT);
16915+ unreachable();
16916 }
16917
16918 struct machine_ops machine_ops = {
16919diff -urNp linux-2.6.39/arch/x86/kernel/setup.c linux-2.6.39/arch/x86/kernel/setup.c
16920--- linux-2.6.39/arch/x86/kernel/setup.c 2011-05-19 00:06:34.000000000 -0400
16921+++ linux-2.6.39/arch/x86/kernel/setup.c 2011-05-22 19:36:30.000000000 -0400
16922@@ -650,7 +650,7 @@ static void __init trim_bios_range(void)
16923 * area (640->1Mb) as ram even though it is not.
16924 * take them out.
16925 */
16926- e820_remove_range(BIOS_BEGIN, BIOS_END - BIOS_BEGIN, E820_RAM, 1);
16927+ e820_remove_range(ISA_START_ADDRESS, ISA_END_ADDRESS - ISA_START_ADDRESS, E820_RAM, 1);
16928 sanitize_e820_map(e820.map, ARRAY_SIZE(e820.map), &e820.nr_map);
16929 }
16930
16931@@ -775,14 +775,14 @@ void __init setup_arch(char **cmdline_p)
16932
16933 if (!boot_params.hdr.root_flags)
16934 root_mountflags &= ~MS_RDONLY;
16935- init_mm.start_code = (unsigned long) _text;
16936- init_mm.end_code = (unsigned long) _etext;
16937+ init_mm.start_code = ktla_ktva((unsigned long) _text);
16938+ init_mm.end_code = ktla_ktva((unsigned long) _etext);
16939 init_mm.end_data = (unsigned long) _edata;
16940 init_mm.brk = _brk_end;
16941
16942- code_resource.start = virt_to_phys(_text);
16943- code_resource.end = virt_to_phys(_etext)-1;
16944- data_resource.start = virt_to_phys(_etext);
16945+ code_resource.start = virt_to_phys(ktla_ktva(_text));
16946+ code_resource.end = virt_to_phys(ktla_ktva(_etext))-1;
16947+ data_resource.start = virt_to_phys(_sdata);
16948 data_resource.end = virt_to_phys(_edata)-1;
16949 bss_resource.start = virt_to_phys(&__bss_start);
16950 bss_resource.end = virt_to_phys(&__bss_stop)-1;
16951diff -urNp linux-2.6.39/arch/x86/kernel/setup_percpu.c linux-2.6.39/arch/x86/kernel/setup_percpu.c
16952--- linux-2.6.39/arch/x86/kernel/setup_percpu.c 2011-05-19 00:06:34.000000000 -0400
16953+++ linux-2.6.39/arch/x86/kernel/setup_percpu.c 2011-05-22 19:36:30.000000000 -0400
16954@@ -21,19 +21,17 @@
16955 #include <asm/cpu.h>
16956 #include <asm/stackprotector.h>
16957
16958-DEFINE_PER_CPU(int, cpu_number);
16959+#ifdef CONFIG_SMP
16960+DEFINE_PER_CPU(unsigned int, cpu_number);
16961 EXPORT_PER_CPU_SYMBOL(cpu_number);
16962+#endif
16963
16964-#ifdef CONFIG_X86_64
16965 #define BOOT_PERCPU_OFFSET ((unsigned long)__per_cpu_load)
16966-#else
16967-#define BOOT_PERCPU_OFFSET 0
16968-#endif
16969
16970 DEFINE_PER_CPU(unsigned long, this_cpu_off) = BOOT_PERCPU_OFFSET;
16971 EXPORT_PER_CPU_SYMBOL(this_cpu_off);
16972
16973-unsigned long __per_cpu_offset[NR_CPUS] __read_mostly = {
16974+unsigned long __per_cpu_offset[NR_CPUS] __read_only = {
16975 [0 ... NR_CPUS-1] = BOOT_PERCPU_OFFSET,
16976 };
16977 EXPORT_SYMBOL(__per_cpu_offset);
16978@@ -155,10 +153,10 @@ static inline void setup_percpu_segment(
16979 {
16980 #ifdef CONFIG_X86_32
16981 struct desc_struct gdt;
16982+ unsigned long base = per_cpu_offset(cpu);
16983
16984- pack_descriptor(&gdt, per_cpu_offset(cpu), 0xFFFFF,
16985- 0x2 | DESCTYPE_S, 0x8);
16986- gdt.s = 1;
16987+ pack_descriptor(&gdt, base, (VMALLOC_END - base - 1) >> PAGE_SHIFT,
16988+ 0x83 | DESCTYPE_S, 0xC);
16989 write_gdt_entry(get_cpu_gdt_table(cpu),
16990 GDT_ENTRY_PERCPU, &gdt, DESCTYPE_S);
16991 #endif
16992@@ -207,6 +205,11 @@ void __init setup_per_cpu_areas(void)
16993 /* alrighty, percpu areas up and running */
16994 delta = (unsigned long)pcpu_base_addr - (unsigned long)__per_cpu_start;
16995 for_each_possible_cpu(cpu) {
16996+#ifdef CONFIG_CC_STACKPROTECTOR
16997+#ifdef CONFIG_x86_32
16998+ unsigned long canary = per_cpu(stack_canary, cpu);
16999+#endif
17000+#endif
17001 per_cpu_offset(cpu) = delta + pcpu_unit_offsets[cpu];
17002 per_cpu(this_cpu_off, cpu) = per_cpu_offset(cpu);
17003 per_cpu(cpu_number, cpu) = cpu;
17004@@ -247,6 +250,12 @@ void __init setup_per_cpu_areas(void)
17005 */
17006 set_cpu_numa_node(cpu, early_cpu_to_node(cpu));
17007 #endif
17008+#ifdef CONFIG_CC_STACKPROTECTOR
17009+#ifdef CONFIG_x86_32
17010+ if (cpu == boot_cpu_id)
17011+ per_cpu(stack_canary, cpu) = canary;
17012+#endif
17013+#endif
17014 /*
17015 * Up to this point, the boot CPU has been using .init.data
17016 * area. Reload any changed state for the boot CPU.
17017diff -urNp linux-2.6.39/arch/x86/kernel/signal.c linux-2.6.39/arch/x86/kernel/signal.c
17018--- linux-2.6.39/arch/x86/kernel/signal.c 2011-05-19 00:06:34.000000000 -0400
17019+++ linux-2.6.39/arch/x86/kernel/signal.c 2011-05-23 17:07:00.000000000 -0400
17020@@ -198,7 +198,7 @@ static unsigned long align_sigframe(unsi
17021 * Align the stack pointer according to the i386 ABI,
17022 * i.e. so that on function entry ((sp + 4) & 15) == 0.
17023 */
17024- sp = ((sp + 4) & -16ul) - 4;
17025+ sp = ((sp - 12) & -16ul) - 4;
17026 #else /* !CONFIG_X86_32 */
17027 sp = round_down(sp, 16) - 8;
17028 #endif
17029@@ -249,11 +249,11 @@ get_sigframe(struct k_sigaction *ka, str
17030 * Return an always-bogus address instead so we will die with SIGSEGV.
17031 */
17032 if (onsigstack && !likely(on_sig_stack(sp)))
17033- return (void __user *)-1L;
17034+ return (__force void __user *)-1L;
17035
17036 /* save i387 state */
17037 if (used_math() && save_i387_xstate(*fpstate) < 0)
17038- return (void __user *)-1L;
17039+ return (__force void __user *)-1L;
17040
17041 return (void __user *)sp;
17042 }
17043@@ -308,9 +308,9 @@ __setup_frame(int sig, struct k_sigactio
17044 }
17045
17046 if (current->mm->context.vdso)
17047- restorer = VDSO32_SYMBOL(current->mm->context.vdso, sigreturn);
17048+ restorer = (__force void __user *)VDSO32_SYMBOL(current->mm->context.vdso, sigreturn);
17049 else
17050- restorer = &frame->retcode;
17051+ restorer = (void __user *)&frame->retcode;
17052 if (ka->sa.sa_flags & SA_RESTORER)
17053 restorer = ka->sa.sa_restorer;
17054
17055@@ -324,7 +324,7 @@ __setup_frame(int sig, struct k_sigactio
17056 * reasons and because gdb uses it as a signature to notice
17057 * signal handler stack frames.
17058 */
17059- err |= __put_user(*((u64 *)&retcode), (u64 *)frame->retcode);
17060+ err |= __put_user(*((u64 *)&retcode), (u64 __user *)frame->retcode);
17061
17062 if (err)
17063 return -EFAULT;
17064@@ -378,7 +378,10 @@ static int __setup_rt_frame(int sig, str
17065 err |= __copy_to_user(&frame->uc.uc_sigmask, set, sizeof(*set));
17066
17067 /* Set up to return from userspace. */
17068- restorer = VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
17069+ if (current->mm->context.vdso)
17070+ restorer = (__force void __user *)VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
17071+ else
17072+ restorer = (void __user *)&frame->retcode;
17073 if (ka->sa.sa_flags & SA_RESTORER)
17074 restorer = ka->sa.sa_restorer;
17075 put_user_ex(restorer, &frame->pretcode);
17076@@ -390,7 +393,7 @@ static int __setup_rt_frame(int sig, str
17077 * reasons and because gdb uses it as a signature to notice
17078 * signal handler stack frames.
17079 */
17080- put_user_ex(*((u64 *)&rt_retcode), (u64 *)frame->retcode);
17081+ put_user_ex(*((u64 *)&rt_retcode), (u64 __user *)frame->retcode);
17082 } put_user_catch(err);
17083
17084 if (err)
17085@@ -773,6 +776,8 @@ static void do_signal(struct pt_regs *re
17086 int signr;
17087 sigset_t *oldset;
17088
17089+ pax_track_stack();
17090+
17091 /*
17092 * We want the common case to go fast, which is why we may in certain
17093 * cases get here from kernel mode. Just return without doing anything
17094@@ -780,7 +785,7 @@ static void do_signal(struct pt_regs *re
17095 * X86_32: vm86 regs switched out by assembly code before reaching
17096 * here, so testing against kernel CS suffices.
17097 */
17098- if (!user_mode(regs))
17099+ if (!user_mode_novm(regs))
17100 return;
17101
17102 if (current_thread_info()->status & TS_RESTORE_SIGMASK)
17103diff -urNp linux-2.6.39/arch/x86/kernel/smpboot.c linux-2.6.39/arch/x86/kernel/smpboot.c
17104--- linux-2.6.39/arch/x86/kernel/smpboot.c 2011-05-19 00:06:34.000000000 -0400
17105+++ linux-2.6.39/arch/x86/kernel/smpboot.c 2011-05-22 19:36:30.000000000 -0400
17106@@ -696,17 +696,20 @@ static int __cpuinit do_boot_cpu(int api
17107 set_idle_for_cpu(cpu, c_idle.idle);
17108 do_rest:
17109 per_cpu(current_task, cpu) = c_idle.idle;
17110+ per_cpu(current_tinfo, cpu) = &c_idle.idle->tinfo;
17111 #ifdef CONFIG_X86_32
17112 /* Stack for startup_32 can be just as for start_secondary onwards */
17113 irq_ctx_init(cpu);
17114 #else
17115 clear_tsk_thread_flag(c_idle.idle, TIF_FORK);
17116 initial_gs = per_cpu_offset(cpu);
17117- per_cpu(kernel_stack, cpu) =
17118- (unsigned long)task_stack_page(c_idle.idle) -
17119- KERNEL_STACK_OFFSET + THREAD_SIZE;
17120+ per_cpu(kernel_stack, cpu) = (unsigned long)task_stack_page(c_idle.idle) - 16 + THREAD_SIZE;
17121 #endif
17122+
17123+ pax_open_kernel();
17124 early_gdt_descr.address = (unsigned long)get_cpu_gdt_table(cpu);
17125+ pax_close_kernel();
17126+
17127 initial_code = (unsigned long)start_secondary;
17128 stack_start = c_idle.idle->thread.sp;
17129
17130@@ -848,6 +851,12 @@ int __cpuinit native_cpu_up(unsigned int
17131
17132 per_cpu(cpu_state, cpu) = CPU_UP_PREPARE;
17133
17134+#ifdef CONFIG_PAX_PER_CPU_PGD
17135+ clone_pgd_range(get_cpu_pgd(cpu) + KERNEL_PGD_BOUNDARY,
17136+ swapper_pg_dir + KERNEL_PGD_BOUNDARY,
17137+ KERNEL_PGD_PTRS);
17138+#endif
17139+
17140 err = do_boot_cpu(apicid, cpu);
17141 if (err) {
17142 pr_debug("do_boot_cpu failed %d\n", err);
17143diff -urNp linux-2.6.39/arch/x86/kernel/step.c linux-2.6.39/arch/x86/kernel/step.c
17144--- linux-2.6.39/arch/x86/kernel/step.c 2011-05-19 00:06:34.000000000 -0400
17145+++ linux-2.6.39/arch/x86/kernel/step.c 2011-05-22 19:36:30.000000000 -0400
17146@@ -27,10 +27,10 @@ unsigned long convert_ip_to_linear(struc
17147 struct desc_struct *desc;
17148 unsigned long base;
17149
17150- seg &= ~7UL;
17151+ seg >>= 3;
17152
17153 mutex_lock(&child->mm->context.lock);
17154- if (unlikely((seg >> 3) >= child->mm->context.size))
17155+ if (unlikely(seg >= child->mm->context.size))
17156 addr = -1L; /* bogus selector, access would fault */
17157 else {
17158 desc = child->mm->context.ldt + seg;
17159@@ -42,7 +42,8 @@ unsigned long convert_ip_to_linear(struc
17160 addr += base;
17161 }
17162 mutex_unlock(&child->mm->context.lock);
17163- }
17164+ } else if (seg == __KERNEL_CS || seg == __KERNEXEC_KERNEL_CS)
17165+ addr = ktla_ktva(addr);
17166
17167 return addr;
17168 }
17169@@ -53,6 +54,9 @@ static int is_setting_trap_flag(struct t
17170 unsigned char opcode[15];
17171 unsigned long addr = convert_ip_to_linear(child, regs);
17172
17173+ if (addr == -EINVAL)
17174+ return 0;
17175+
17176 copied = access_process_vm(child, addr, opcode, sizeof(opcode), 0);
17177 for (i = 0; i < copied; i++) {
17178 switch (opcode[i]) {
17179@@ -74,7 +78,7 @@ static int is_setting_trap_flag(struct t
17180
17181 #ifdef CONFIG_X86_64
17182 case 0x40 ... 0x4f:
17183- if (regs->cs != __USER_CS)
17184+ if ((regs->cs & 0xffff) != __USER_CS)
17185 /* 32-bit mode: register increment */
17186 return 0;
17187 /* 64-bit mode: REX prefix */
17188diff -urNp linux-2.6.39/arch/x86/kernel/syscall_table_32.S linux-2.6.39/arch/x86/kernel/syscall_table_32.S
17189--- linux-2.6.39/arch/x86/kernel/syscall_table_32.S 2011-05-19 00:06:34.000000000 -0400
17190+++ linux-2.6.39/arch/x86/kernel/syscall_table_32.S 2011-05-22 19:36:30.000000000 -0400
17191@@ -1,3 +1,4 @@
17192+.section .rodata,"a",@progbits
17193 ENTRY(sys_call_table)
17194 .long sys_restart_syscall /* 0 - old "setup()" system call, used for restarting */
17195 .long sys_exit
17196diff -urNp linux-2.6.39/arch/x86/kernel/sys_i386_32.c linux-2.6.39/arch/x86/kernel/sys_i386_32.c
17197--- linux-2.6.39/arch/x86/kernel/sys_i386_32.c 2011-05-19 00:06:34.000000000 -0400
17198+++ linux-2.6.39/arch/x86/kernel/sys_i386_32.c 2011-05-22 19:36:30.000000000 -0400
17199@@ -24,17 +24,224 @@
17200
17201 #include <asm/syscalls.h>
17202
17203-/*
17204- * Do a system call from kernel instead of calling sys_execve so we
17205- * end up with proper pt_regs.
17206- */
17207-int kernel_execve(const char *filename,
17208- const char *const argv[],
17209- const char *const envp[])
17210+int i386_mmap_check(unsigned long addr, unsigned long len, unsigned long flags)
17211 {
17212- long __res;
17213- asm volatile ("int $0x80"
17214- : "=a" (__res)
17215- : "0" (__NR_execve), "b" (filename), "c" (argv), "d" (envp) : "memory");
17216- return __res;
17217+ unsigned long pax_task_size = TASK_SIZE;
17218+
17219+#ifdef CONFIG_PAX_SEGMEXEC
17220+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
17221+ pax_task_size = SEGMEXEC_TASK_SIZE;
17222+#endif
17223+
17224+ if (len > pax_task_size || addr > pax_task_size - len)
17225+ return -EINVAL;
17226+
17227+ return 0;
17228+}
17229+
17230+unsigned long
17231+arch_get_unmapped_area(struct file *filp, unsigned long addr,
17232+ unsigned long len, unsigned long pgoff, unsigned long flags)
17233+{
17234+ struct mm_struct *mm = current->mm;
17235+ struct vm_area_struct *vma;
17236+ unsigned long start_addr, pax_task_size = TASK_SIZE;
17237+
17238+#ifdef CONFIG_PAX_SEGMEXEC
17239+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
17240+ pax_task_size = SEGMEXEC_TASK_SIZE;
17241+#endif
17242+
17243+ pax_task_size -= PAGE_SIZE;
17244+
17245+ if (len > pax_task_size)
17246+ return -ENOMEM;
17247+
17248+ if (flags & MAP_FIXED)
17249+ return addr;
17250+
17251+#ifdef CONFIG_PAX_RANDMMAP
17252+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
17253+#endif
17254+
17255+ if (addr) {
17256+ addr = PAGE_ALIGN(addr);
17257+ if (pax_task_size - len >= addr) {
17258+ vma = find_vma(mm, addr);
17259+ if (check_heap_stack_gap(vma, addr, len))
17260+ return addr;
17261+ }
17262+ }
17263+ if (len > mm->cached_hole_size) {
17264+ start_addr = addr = mm->free_area_cache;
17265+ } else {
17266+ start_addr = addr = mm->mmap_base;
17267+ mm->cached_hole_size = 0;
17268+ }
17269+
17270+#ifdef CONFIG_PAX_PAGEEXEC
17271+ if (!(__supported_pte_mask & _PAGE_NX) && (mm->pax_flags & MF_PAX_PAGEEXEC) && (flags & MAP_EXECUTABLE) && start_addr >= mm->mmap_base) {
17272+ start_addr = 0x00110000UL;
17273+
17274+#ifdef CONFIG_PAX_RANDMMAP
17275+ if (mm->pax_flags & MF_PAX_RANDMMAP)
17276+ start_addr += mm->delta_mmap & 0x03FFF000UL;
17277+#endif
17278+
17279+ if (mm->start_brk <= start_addr && start_addr < mm->mmap_base)
17280+ start_addr = addr = mm->mmap_base;
17281+ else
17282+ addr = start_addr;
17283+ }
17284+#endif
17285+
17286+full_search:
17287+ for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
17288+ /* At this point: (!vma || addr < vma->vm_end). */
17289+ if (pax_task_size - len < addr) {
17290+ /*
17291+ * Start a new search - just in case we missed
17292+ * some holes.
17293+ */
17294+ if (start_addr != mm->mmap_base) {
17295+ start_addr = addr = mm->mmap_base;
17296+ mm->cached_hole_size = 0;
17297+ goto full_search;
17298+ }
17299+ return -ENOMEM;
17300+ }
17301+ if (check_heap_stack_gap(vma, addr, len))
17302+ break;
17303+ if (addr + mm->cached_hole_size < vma->vm_start)
17304+ mm->cached_hole_size = vma->vm_start - addr;
17305+ addr = vma->vm_end;
17306+ if (mm->start_brk <= addr && addr < mm->mmap_base) {
17307+ start_addr = addr = mm->mmap_base;
17308+ mm->cached_hole_size = 0;
17309+ goto full_search;
17310+ }
17311+ }
17312+
17313+ /*
17314+ * Remember the place where we stopped the search:
17315+ */
17316+ mm->free_area_cache = addr + len;
17317+ return addr;
17318+}
17319+
17320+unsigned long
17321+arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
17322+ const unsigned long len, const unsigned long pgoff,
17323+ const unsigned long flags)
17324+{
17325+ struct vm_area_struct *vma;
17326+ struct mm_struct *mm = current->mm;
17327+ unsigned long base = mm->mmap_base, addr = addr0, pax_task_size = TASK_SIZE;
17328+
17329+#ifdef CONFIG_PAX_SEGMEXEC
17330+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
17331+ pax_task_size = SEGMEXEC_TASK_SIZE;
17332+#endif
17333+
17334+ pax_task_size -= PAGE_SIZE;
17335+
17336+ /* requested length too big for entire address space */
17337+ if (len > pax_task_size)
17338+ return -ENOMEM;
17339+
17340+ if (flags & MAP_FIXED)
17341+ return addr;
17342+
17343+#ifdef CONFIG_PAX_PAGEEXEC
17344+ if (!(__supported_pte_mask & _PAGE_NX) && (mm->pax_flags & MF_PAX_PAGEEXEC) && (flags & MAP_EXECUTABLE))
17345+ goto bottomup;
17346+#endif
17347+
17348+#ifdef CONFIG_PAX_RANDMMAP
17349+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
17350+#endif
17351+
17352+ /* requesting a specific address */
17353+ if (addr) {
17354+ addr = PAGE_ALIGN(addr);
17355+ if (pax_task_size - len >= addr) {
17356+ vma = find_vma(mm, addr);
17357+ if (check_heap_stack_gap(vma, addr, len))
17358+ return addr;
17359+ }
17360+ }
17361+
17362+ /* check if free_area_cache is useful for us */
17363+ if (len <= mm->cached_hole_size) {
17364+ mm->cached_hole_size = 0;
17365+ mm->free_area_cache = mm->mmap_base;
17366+ }
17367+
17368+ /* either no address requested or can't fit in requested address hole */
17369+ addr = mm->free_area_cache;
17370+
17371+ /* make sure it can fit in the remaining address space */
17372+ if (addr > len) {
17373+ vma = find_vma(mm, addr-len);
17374+ if (check_heap_stack_gap(vma, addr - len, len))
17375+ /* remember the address as a hint for next time */
17376+ return (mm->free_area_cache = addr-len);
17377+ }
17378+
17379+ if (mm->mmap_base < len)
17380+ goto bottomup;
17381+
17382+ addr = mm->mmap_base-len;
17383+
17384+ do {
17385+ /*
17386+ * Lookup failure means no vma is above this address,
17387+ * else if new region fits below vma->vm_start,
17388+ * return with success:
17389+ */
17390+ vma = find_vma(mm, addr);
17391+ if (check_heap_stack_gap(vma, addr, len))
17392+ /* remember the address as a hint for next time */
17393+ return (mm->free_area_cache = addr);
17394+
17395+ /* remember the largest hole we saw so far */
17396+ if (addr + mm->cached_hole_size < vma->vm_start)
17397+ mm->cached_hole_size = vma->vm_start - addr;
17398+
17399+ /* try just below the current vma->vm_start */
17400+ addr = skip_heap_stack_gap(vma, len);
17401+ } while (!IS_ERR_VALUE(addr));
17402+
17403+bottomup:
17404+ /*
17405+ * A failed mmap() very likely causes application failure,
17406+ * so fall back to the bottom-up function here. This scenario
17407+ * can happen with large stack limits and large mmap()
17408+ * allocations.
17409+ */
17410+
17411+#ifdef CONFIG_PAX_SEGMEXEC
17412+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
17413+ mm->mmap_base = SEGMEXEC_TASK_UNMAPPED_BASE;
17414+ else
17415+#endif
17416+
17417+ mm->mmap_base = TASK_UNMAPPED_BASE;
17418+
17419+#ifdef CONFIG_PAX_RANDMMAP
17420+ if (mm->pax_flags & MF_PAX_RANDMMAP)
17421+ mm->mmap_base += mm->delta_mmap;
17422+#endif
17423+
17424+ mm->free_area_cache = mm->mmap_base;
17425+ mm->cached_hole_size = ~0UL;
17426+ addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
17427+ /*
17428+ * Restore the topdown base:
17429+ */
17430+ mm->mmap_base = base;
17431+ mm->free_area_cache = base;
17432+ mm->cached_hole_size = ~0UL;
17433+
17434+ return addr;
17435 }
17436diff -urNp linux-2.6.39/arch/x86/kernel/sys_x86_64.c linux-2.6.39/arch/x86/kernel/sys_x86_64.c
17437--- linux-2.6.39/arch/x86/kernel/sys_x86_64.c 2011-05-19 00:06:34.000000000 -0400
17438+++ linux-2.6.39/arch/x86/kernel/sys_x86_64.c 2011-05-22 19:36:30.000000000 -0400
17439@@ -32,8 +32,8 @@ out:
17440 return error;
17441 }
17442
17443-static void find_start_end(unsigned long flags, unsigned long *begin,
17444- unsigned long *end)
17445+static void find_start_end(struct mm_struct *mm, unsigned long flags,
17446+ unsigned long *begin, unsigned long *end)
17447 {
17448 if (!test_thread_flag(TIF_IA32) && (flags & MAP_32BIT)) {
17449 unsigned long new_begin;
17450@@ -52,7 +52,7 @@ static void find_start_end(unsigned long
17451 *begin = new_begin;
17452 }
17453 } else {
17454- *begin = TASK_UNMAPPED_BASE;
17455+ *begin = mm->mmap_base;
17456 *end = TASK_SIZE;
17457 }
17458 }
17459@@ -69,16 +69,19 @@ arch_get_unmapped_area(struct file *filp
17460 if (flags & MAP_FIXED)
17461 return addr;
17462
17463- find_start_end(flags, &begin, &end);
17464+ find_start_end(mm, flags, &begin, &end);
17465
17466 if (len > end)
17467 return -ENOMEM;
17468
17469+#ifdef CONFIG_PAX_RANDMMAP
17470+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
17471+#endif
17472+
17473 if (addr) {
17474 addr = PAGE_ALIGN(addr);
17475 vma = find_vma(mm, addr);
17476- if (end - len >= addr &&
17477- (!vma || addr + len <= vma->vm_start))
17478+ if (end - len >= addr && check_heap_stack_gap(vma, addr, len))
17479 return addr;
17480 }
17481 if (((flags & MAP_32BIT) || test_thread_flag(TIF_IA32))
17482@@ -106,7 +109,7 @@ full_search:
17483 }
17484 return -ENOMEM;
17485 }
17486- if (!vma || addr + len <= vma->vm_start) {
17487+ if (check_heap_stack_gap(vma, addr, len)) {
17488 /*
17489 * Remember the place where we stopped the search:
17490 */
17491@@ -128,7 +131,7 @@ arch_get_unmapped_area_topdown(struct fi
17492 {
17493 struct vm_area_struct *vma;
17494 struct mm_struct *mm = current->mm;
17495- unsigned long addr = addr0;
17496+ unsigned long base = mm->mmap_base, addr = addr0;
17497
17498 /* requested length too big for entire address space */
17499 if (len > TASK_SIZE)
17500@@ -141,13 +144,18 @@ arch_get_unmapped_area_topdown(struct fi
17501 if (!test_thread_flag(TIF_IA32) && (flags & MAP_32BIT))
17502 goto bottomup;
17503
17504+#ifdef CONFIG_PAX_RANDMMAP
17505+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
17506+#endif
17507+
17508 /* requesting a specific address */
17509 if (addr) {
17510 addr = PAGE_ALIGN(addr);
17511- vma = find_vma(mm, addr);
17512- if (TASK_SIZE - len >= addr &&
17513- (!vma || addr + len <= vma->vm_start))
17514- return addr;
17515+ if (TASK_SIZE - len >= addr) {
17516+ vma = find_vma(mm, addr);
17517+ if (check_heap_stack_gap(vma, addr, len))
17518+ return addr;
17519+ }
17520 }
17521
17522 /* check if free_area_cache is useful for us */
17523@@ -162,7 +170,7 @@ arch_get_unmapped_area_topdown(struct fi
17524 /* make sure it can fit in the remaining address space */
17525 if (addr > len) {
17526 vma = find_vma(mm, addr-len);
17527- if (!vma || addr <= vma->vm_start)
17528+ if (check_heap_stack_gap(vma, addr - len, len))
17529 /* remember the address as a hint for next time */
17530 return mm->free_area_cache = addr-len;
17531 }
17532@@ -179,7 +187,7 @@ arch_get_unmapped_area_topdown(struct fi
17533 * return with success:
17534 */
17535 vma = find_vma(mm, addr);
17536- if (!vma || addr+len <= vma->vm_start)
17537+ if (check_heap_stack_gap(vma, addr, len))
17538 /* remember the address as a hint for next time */
17539 return mm->free_area_cache = addr;
17540
17541@@ -188,8 +196,8 @@ arch_get_unmapped_area_topdown(struct fi
17542 mm->cached_hole_size = vma->vm_start - addr;
17543
17544 /* try just below the current vma->vm_start */
17545- addr = vma->vm_start-len;
17546- } while (len < vma->vm_start);
17547+ addr = skip_heap_stack_gap(vma, len);
17548+ } while (!IS_ERR_VALUE(addr));
17549
17550 bottomup:
17551 /*
17552@@ -198,13 +206,21 @@ bottomup:
17553 * can happen with large stack limits and large mmap()
17554 * allocations.
17555 */
17556+ mm->mmap_base = TASK_UNMAPPED_BASE;
17557+
17558+#ifdef CONFIG_PAX_RANDMMAP
17559+ if (mm->pax_flags & MF_PAX_RANDMMAP)
17560+ mm->mmap_base += mm->delta_mmap;
17561+#endif
17562+
17563+ mm->free_area_cache = mm->mmap_base;
17564 mm->cached_hole_size = ~0UL;
17565- mm->free_area_cache = TASK_UNMAPPED_BASE;
17566 addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
17567 /*
17568 * Restore the topdown base:
17569 */
17570- mm->free_area_cache = mm->mmap_base;
17571+ mm->mmap_base = base;
17572+ mm->free_area_cache = base;
17573 mm->cached_hole_size = ~0UL;
17574
17575 return addr;
17576diff -urNp linux-2.6.39/arch/x86/kernel/tboot.c linux-2.6.39/arch/x86/kernel/tboot.c
17577--- linux-2.6.39/arch/x86/kernel/tboot.c 2011-05-19 00:06:34.000000000 -0400
17578+++ linux-2.6.39/arch/x86/kernel/tboot.c 2011-05-22 19:36:30.000000000 -0400
17579@@ -218,7 +218,7 @@ static int tboot_setup_sleep(void)
17580
17581 void tboot_shutdown(u32 shutdown_type)
17582 {
17583- void (*shutdown)(void);
17584+ void (* __noreturn shutdown)(void);
17585
17586 if (!tboot_enabled())
17587 return;
17588@@ -240,7 +240,7 @@ void tboot_shutdown(u32 shutdown_type)
17589
17590 switch_to_tboot_pt();
17591
17592- shutdown = (void(*)(void))(unsigned long)tboot->shutdown_entry;
17593+ shutdown = (void *)tboot->shutdown_entry;
17594 shutdown();
17595
17596 /* should not reach here */
17597@@ -297,7 +297,7 @@ void tboot_sleep(u8 sleep_state, u32 pm1
17598 tboot_shutdown(acpi_shutdown_map[sleep_state]);
17599 }
17600
17601-static atomic_t ap_wfs_count;
17602+static atomic_unchecked_t ap_wfs_count;
17603
17604 static int tboot_wait_for_aps(int num_aps)
17605 {
17606@@ -321,9 +321,9 @@ static int __cpuinit tboot_cpu_callback(
17607 {
17608 switch (action) {
17609 case CPU_DYING:
17610- atomic_inc(&ap_wfs_count);
17611+ atomic_inc_unchecked(&ap_wfs_count);
17612 if (num_online_cpus() == 1)
17613- if (tboot_wait_for_aps(atomic_read(&ap_wfs_count)))
17614+ if (tboot_wait_for_aps(atomic_read_unchecked(&ap_wfs_count)))
17615 return NOTIFY_BAD;
17616 break;
17617 }
17618@@ -342,7 +342,7 @@ static __init int tboot_late_init(void)
17619
17620 tboot_create_trampoline();
17621
17622- atomic_set(&ap_wfs_count, 0);
17623+ atomic_set_unchecked(&ap_wfs_count, 0);
17624 register_hotcpu_notifier(&tboot_cpu_notifier);
17625 return 0;
17626 }
17627diff -urNp linux-2.6.39/arch/x86/kernel/time.c linux-2.6.39/arch/x86/kernel/time.c
17628--- linux-2.6.39/arch/x86/kernel/time.c 2011-05-19 00:06:34.000000000 -0400
17629+++ linux-2.6.39/arch/x86/kernel/time.c 2011-05-22 19:36:30.000000000 -0400
17630@@ -22,17 +22,13 @@
17631 #include <asm/hpet.h>
17632 #include <asm/time.h>
17633
17634-#ifdef CONFIG_X86_64
17635-volatile unsigned long __jiffies __section_jiffies = INITIAL_JIFFIES;
17636-#endif
17637-
17638 unsigned long profile_pc(struct pt_regs *regs)
17639 {
17640 unsigned long pc = instruction_pointer(regs);
17641
17642- if (!user_mode_vm(regs) && in_lock_functions(pc)) {
17643+ if (!user_mode(regs) && in_lock_functions(pc)) {
17644 #ifdef CONFIG_FRAME_POINTER
17645- return *(unsigned long *)(regs->bp + sizeof(long));
17646+ return ktla_ktva(*(unsigned long *)(regs->bp + sizeof(long)));
17647 #else
17648 unsigned long *sp =
17649 (unsigned long *)kernel_stack_pointer(regs);
17650@@ -41,11 +37,17 @@ unsigned long profile_pc(struct pt_regs
17651 * or above a saved flags. Eflags has bits 22-31 zero,
17652 * kernel addresses don't.
17653 */
17654+
17655+#ifdef CONFIG_PAX_KERNEXEC
17656+ return ktla_ktva(sp[0]);
17657+#else
17658 if (sp[0] >> 22)
17659 return sp[0];
17660 if (sp[1] >> 22)
17661 return sp[1];
17662 #endif
17663+
17664+#endif
17665 }
17666 return pc;
17667 }
17668diff -urNp linux-2.6.39/arch/x86/kernel/tls.c linux-2.6.39/arch/x86/kernel/tls.c
17669--- linux-2.6.39/arch/x86/kernel/tls.c 2011-05-19 00:06:34.000000000 -0400
17670+++ linux-2.6.39/arch/x86/kernel/tls.c 2011-05-22 19:36:30.000000000 -0400
17671@@ -85,6 +85,11 @@ int do_set_thread_area(struct task_struc
17672 if (idx < GDT_ENTRY_TLS_MIN || idx > GDT_ENTRY_TLS_MAX)
17673 return -EINVAL;
17674
17675+#ifdef CONFIG_PAX_SEGMEXEC
17676+ if ((p->mm->pax_flags & MF_PAX_SEGMEXEC) && (info.contents & MODIFY_LDT_CONTENTS_CODE))
17677+ return -EINVAL;
17678+#endif
17679+
17680 set_tls_desc(p, idx, &info, 1);
17681
17682 return 0;
17683diff -urNp linux-2.6.39/arch/x86/kernel/trampoline_32.S linux-2.6.39/arch/x86/kernel/trampoline_32.S
17684--- linux-2.6.39/arch/x86/kernel/trampoline_32.S 2011-05-19 00:06:34.000000000 -0400
17685+++ linux-2.6.39/arch/x86/kernel/trampoline_32.S 2011-05-22 19:36:30.000000000 -0400
17686@@ -32,6 +32,12 @@
17687 #include <asm/segment.h>
17688 #include <asm/page_types.h>
17689
17690+#ifdef CONFIG_PAX_KERNEXEC
17691+#define ta(X) (X)
17692+#else
17693+#define ta(X) ((X) - __PAGE_OFFSET)
17694+#endif
17695+
17696 #ifdef CONFIG_SMP
17697
17698 .section ".x86_trampoline","a"
17699@@ -62,7 +68,7 @@ r_base = .
17700 inc %ax # protected mode (PE) bit
17701 lmsw %ax # into protected mode
17702 # flush prefetch and jump to startup_32_smp in arch/i386/kernel/head.S
17703- ljmpl $__BOOT_CS, $(startup_32_smp-__PAGE_OFFSET)
17704+ ljmpl $__BOOT_CS, $ta(startup_32_smp)
17705
17706 # These need to be in the same 64K segment as the above;
17707 # hence we don't use the boot_gdt_descr defined in head.S
17708diff -urNp linux-2.6.39/arch/x86/kernel/trampoline_64.S linux-2.6.39/arch/x86/kernel/trampoline_64.S
17709--- linux-2.6.39/arch/x86/kernel/trampoline_64.S 2011-05-19 00:06:34.000000000 -0400
17710+++ linux-2.6.39/arch/x86/kernel/trampoline_64.S 2011-05-22 19:36:30.000000000 -0400
17711@@ -90,7 +90,7 @@ startup_32:
17712 movl $__KERNEL_DS, %eax # Initialize the %ds segment register
17713 movl %eax, %ds
17714
17715- movl $X86_CR4_PAE, %eax
17716+ movl $(X86_CR4_PSE | X86_CR4_PAE | X86_CR4_PGE), %eax
17717 movl %eax, %cr4 # Enable PAE mode
17718
17719 # Setup trampoline 4 level pagetables
17720@@ -138,7 +138,7 @@ tidt:
17721 # so the kernel can live anywhere
17722 .balign 4
17723 tgdt:
17724- .short tgdt_end - tgdt # gdt limit
17725+ .short tgdt_end - tgdt - 1 # gdt limit
17726 .long tgdt - r_base
17727 .short 0
17728 .quad 0x00cf9b000000ffff # __KERNEL32_CS
17729diff -urNp linux-2.6.39/arch/x86/kernel/traps.c linux-2.6.39/arch/x86/kernel/traps.c
17730--- linux-2.6.39/arch/x86/kernel/traps.c 2011-05-19 00:06:34.000000000 -0400
17731+++ linux-2.6.39/arch/x86/kernel/traps.c 2011-05-22 19:36:30.000000000 -0400
17732@@ -70,12 +70,6 @@ asmlinkage int system_call(void);
17733
17734 /* Do we ignore FPU interrupts ? */
17735 char ignore_fpu_irq;
17736-
17737-/*
17738- * The IDT has to be page-aligned to simplify the Pentium
17739- * F0 0F bug workaround.
17740- */
17741-gate_desc idt_table[NR_VECTORS] __page_aligned_data = { { { { 0, 0 } } }, };
17742 #endif
17743
17744 DECLARE_BITMAP(used_vectors, NR_VECTORS);
17745@@ -117,13 +111,13 @@ static inline void preempt_conditional_c
17746 }
17747
17748 static void __kprobes
17749-do_trap(int trapnr, int signr, char *str, struct pt_regs *regs,
17750+do_trap(int trapnr, int signr, const char *str, struct pt_regs *regs,
17751 long error_code, siginfo_t *info)
17752 {
17753 struct task_struct *tsk = current;
17754
17755 #ifdef CONFIG_X86_32
17756- if (regs->flags & X86_VM_MASK) {
17757+ if (v8086_mode(regs)) {
17758 /*
17759 * traps 0, 1, 3, 4, and 5 should be forwarded to vm86.
17760 * On nmi (interrupt 2), do_trap should not be called.
17761@@ -134,7 +128,7 @@ do_trap(int trapnr, int signr, char *str
17762 }
17763 #endif
17764
17765- if (!user_mode(regs))
17766+ if (!user_mode_novm(regs))
17767 goto kernel_trap;
17768
17769 #ifdef CONFIG_X86_32
17770@@ -157,7 +151,7 @@ trap_signal:
17771 printk_ratelimit()) {
17772 printk(KERN_INFO
17773 "%s[%d] trap %s ip:%lx sp:%lx error:%lx",
17774- tsk->comm, tsk->pid, str,
17775+ tsk->comm, task_pid_nr(tsk), str,
17776 regs->ip, regs->sp, error_code);
17777 print_vma_addr(" in ", regs->ip);
17778 printk("\n");
17779@@ -174,8 +168,20 @@ kernel_trap:
17780 if (!fixup_exception(regs)) {
17781 tsk->thread.error_code = error_code;
17782 tsk->thread.trap_no = trapnr;
17783+
17784+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
17785+ if (trapnr == 12 && ((regs->cs & 0xFFFF) == __KERNEL_CS || (regs->cs & 0xFFFF) == __KERNEXEC_KERNEL_CS))
17786+ str = "PAX: suspicious stack segment fault";
17787+#endif
17788+
17789 die(str, regs, error_code);
17790 }
17791+
17792+#ifdef CONFIG_PAX_REFCOUNT
17793+ if (trapnr == 4)
17794+ pax_report_refcount_overflow(regs);
17795+#endif
17796+
17797 return;
17798
17799 #ifdef CONFIG_X86_32
17800@@ -264,14 +270,30 @@ do_general_protection(struct pt_regs *re
17801 conditional_sti(regs);
17802
17803 #ifdef CONFIG_X86_32
17804- if (regs->flags & X86_VM_MASK)
17805+ if (v8086_mode(regs))
17806 goto gp_in_vm86;
17807 #endif
17808
17809 tsk = current;
17810- if (!user_mode(regs))
17811+ if (!user_mode_novm(regs))
17812 goto gp_in_kernel;
17813
17814+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
17815+ if (!(__supported_pte_mask & _PAGE_NX) && tsk->mm && (tsk->mm->pax_flags & MF_PAX_PAGEEXEC)) {
17816+ struct mm_struct *mm = tsk->mm;
17817+ unsigned long limit;
17818+
17819+ down_write(&mm->mmap_sem);
17820+ limit = mm->context.user_cs_limit;
17821+ if (limit < TASK_SIZE) {
17822+ track_exec_limit(mm, limit, TASK_SIZE, VM_EXEC);
17823+ up_write(&mm->mmap_sem);
17824+ return;
17825+ }
17826+ up_write(&mm->mmap_sem);
17827+ }
17828+#endif
17829+
17830 tsk->thread.error_code = error_code;
17831 tsk->thread.trap_no = 13;
17832
17833@@ -304,6 +326,13 @@ gp_in_kernel:
17834 if (notify_die(DIE_GPF, "general protection fault", regs,
17835 error_code, 13, SIGSEGV) == NOTIFY_STOP)
17836 return;
17837+
17838+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
17839+ if ((regs->cs & 0xFFFF) == __KERNEL_CS || (regs->cs & 0xFFFF) == __KERNEXEC_KERNEL_CS)
17840+ die("PAX: suspicious general protection fault", regs, error_code);
17841+ else
17842+#endif
17843+
17844 die("general protection fault", regs, error_code);
17845 }
17846
17847@@ -569,7 +598,7 @@ dotraplinkage void __kprobes do_debug(st
17848 /* It's safe to allow irq's after DR6 has been saved */
17849 preempt_conditional_sti(regs);
17850
17851- if (regs->flags & X86_VM_MASK) {
17852+ if (v8086_mode(regs)) {
17853 handle_vm86_trap((struct kernel_vm86_regs *) regs,
17854 error_code, 1);
17855 preempt_conditional_cli(regs);
17856@@ -583,7 +612,7 @@ dotraplinkage void __kprobes do_debug(st
17857 * We already checked v86 mode above, so we can check for kernel mode
17858 * by just checking the CPL of CS.
17859 */
17860- if ((dr6 & DR_STEP) && !user_mode(regs)) {
17861+ if ((dr6 & DR_STEP) && !user_mode_novm(regs)) {
17862 tsk->thread.debugreg6 &= ~DR_STEP;
17863 set_tsk_thread_flag(tsk, TIF_SINGLESTEP);
17864 regs->flags &= ~X86_EFLAGS_TF;
17865@@ -612,7 +641,7 @@ void math_error(struct pt_regs *regs, in
17866 return;
17867 conditional_sti(regs);
17868
17869- if (!user_mode_vm(regs))
17870+ if (!user_mode(regs))
17871 {
17872 if (!fixup_exception(regs)) {
17873 task->thread.error_code = error_code;
17874@@ -723,7 +752,7 @@ asmlinkage void __attribute__((weak)) sm
17875 void __math_state_restore(void)
17876 {
17877 struct thread_info *thread = current_thread_info();
17878- struct task_struct *tsk = thread->task;
17879+ struct task_struct *tsk = current;
17880
17881 /*
17882 * Paranoid restore. send a SIGSEGV if we fail to restore the state.
17883@@ -750,8 +779,7 @@ void __math_state_restore(void)
17884 */
17885 asmlinkage void math_state_restore(void)
17886 {
17887- struct thread_info *thread = current_thread_info();
17888- struct task_struct *tsk = thread->task;
17889+ struct task_struct *tsk = current;
17890
17891 if (!tsk_used_math(tsk)) {
17892 local_irq_enable();
17893diff -urNp linux-2.6.39/arch/x86/kernel/vm86_32.c linux-2.6.39/arch/x86/kernel/vm86_32.c
17894--- linux-2.6.39/arch/x86/kernel/vm86_32.c 2011-05-19 00:06:34.000000000 -0400
17895+++ linux-2.6.39/arch/x86/kernel/vm86_32.c 2011-05-22 19:41:32.000000000 -0400
17896@@ -41,6 +41,7 @@
17897 #include <linux/ptrace.h>
17898 #include <linux/audit.h>
17899 #include <linux/stddef.h>
17900+#include <linux/grsecurity.h>
17901
17902 #include <asm/uaccess.h>
17903 #include <asm/io.h>
17904@@ -148,7 +149,7 @@ struct pt_regs *save_v86_state(struct ke
17905 do_exit(SIGSEGV);
17906 }
17907
17908- tss = &per_cpu(init_tss, get_cpu());
17909+ tss = init_tss + get_cpu();
17910 current->thread.sp0 = current->thread.saved_sp0;
17911 current->thread.sysenter_cs = __KERNEL_CS;
17912 load_sp0(tss, &current->thread);
17913@@ -208,6 +209,13 @@ int sys_vm86old(struct vm86_struct __use
17914 struct task_struct *tsk;
17915 int tmp, ret = -EPERM;
17916
17917+#ifdef CONFIG_GRKERNSEC_VM86
17918+ if (!capable(CAP_SYS_RAWIO)) {
17919+ gr_handle_vm86();
17920+ goto out;
17921+ }
17922+#endif
17923+
17924 tsk = current;
17925 if (tsk->thread.saved_sp0)
17926 goto out;
17927@@ -238,6 +246,14 @@ int sys_vm86(unsigned long cmd, unsigned
17928 int tmp, ret;
17929 struct vm86plus_struct __user *v86;
17930
17931+#ifdef CONFIG_GRKERNSEC_VM86
17932+ if (!capable(CAP_SYS_RAWIO)) {
17933+ gr_handle_vm86();
17934+ ret = -EPERM;
17935+ goto out;
17936+ }
17937+#endif
17938+
17939 tsk = current;
17940 switch (cmd) {
17941 case VM86_REQUEST_IRQ:
17942@@ -324,7 +340,7 @@ static void do_sys_vm86(struct kernel_vm
17943 tsk->thread.saved_fs = info->regs32->fs;
17944 tsk->thread.saved_gs = get_user_gs(info->regs32);
17945
17946- tss = &per_cpu(init_tss, get_cpu());
17947+ tss = init_tss + get_cpu();
17948 tsk->thread.sp0 = (unsigned long) &info->VM86_TSS_ESP0;
17949 if (cpu_has_sep)
17950 tsk->thread.sysenter_cs = 0;
17951@@ -529,7 +545,7 @@ static void do_int(struct kernel_vm86_re
17952 goto cannot_handle;
17953 if (i == 0x21 && is_revectored(AH(regs), &KVM86->int21_revectored))
17954 goto cannot_handle;
17955- intr_ptr = (unsigned long __user *) (i << 2);
17956+ intr_ptr = (__force unsigned long __user *) (i << 2);
17957 if (get_user(segoffs, intr_ptr))
17958 goto cannot_handle;
17959 if ((segoffs >> 16) == BIOSSEG)
17960diff -urNp linux-2.6.39/arch/x86/kernel/vmlinux.lds.S linux-2.6.39/arch/x86/kernel/vmlinux.lds.S
17961--- linux-2.6.39/arch/x86/kernel/vmlinux.lds.S 2011-05-19 00:06:34.000000000 -0400
17962+++ linux-2.6.39/arch/x86/kernel/vmlinux.lds.S 2011-05-22 19:36:30.000000000 -0400
17963@@ -26,6 +26,13 @@
17964 #include <asm/page_types.h>
17965 #include <asm/cache.h>
17966 #include <asm/boot.h>
17967+#include <asm/segment.h>
17968+
17969+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
17970+#define __KERNEL_TEXT_OFFSET (LOAD_OFFSET + ____LOAD_PHYSICAL_ADDR)
17971+#else
17972+#define __KERNEL_TEXT_OFFSET 0
17973+#endif
17974
17975 #undef i386 /* in case the preprocessor is a 32bit one */
17976
17977@@ -34,11 +41,9 @@ OUTPUT_FORMAT(CONFIG_OUTPUT_FORMAT, CONF
17978 #ifdef CONFIG_X86_32
17979 OUTPUT_ARCH(i386)
17980 ENTRY(phys_startup_32)
17981-jiffies = jiffies_64;
17982 #else
17983 OUTPUT_ARCH(i386:x86-64)
17984 ENTRY(phys_startup_64)
17985-jiffies_64 = jiffies;
17986 #endif
17987
17988 #if defined(CONFIG_X86_64) && defined(CONFIG_DEBUG_RODATA)
17989@@ -69,31 +74,46 @@ jiffies_64 = jiffies;
17990
17991 PHDRS {
17992 text PT_LOAD FLAGS(5); /* R_E */
17993+#ifdef CONFIG_X86_32
17994+ module PT_LOAD FLAGS(5); /* R_E */
17995+#endif
17996+#ifdef CONFIG_XEN
17997+ rodata PT_LOAD FLAGS(5); /* R_E */
17998+#else
17999+ rodata PT_LOAD FLAGS(4); /* R__ */
18000+#endif
18001 data PT_LOAD FLAGS(6); /* RW_ */
18002 #ifdef CONFIG_X86_64
18003 user PT_LOAD FLAGS(5); /* R_E */
18004+#endif
18005+ init.begin PT_LOAD FLAGS(6); /* RW_ */
18006 #ifdef CONFIG_SMP
18007 percpu PT_LOAD FLAGS(6); /* RW_ */
18008 #endif
18009+ text.init PT_LOAD FLAGS(5); /* R_E */
18010+ text.exit PT_LOAD FLAGS(5); /* R_E */
18011 init PT_LOAD FLAGS(7); /* RWE */
18012-#endif
18013 note PT_NOTE FLAGS(0); /* ___ */
18014 }
18015
18016 SECTIONS
18017 {
18018 #ifdef CONFIG_X86_32
18019- . = LOAD_OFFSET + LOAD_PHYSICAL_ADDR;
18020- phys_startup_32 = startup_32 - LOAD_OFFSET;
18021+ . = LOAD_OFFSET + ____LOAD_PHYSICAL_ADDR;
18022 #else
18023- . = __START_KERNEL;
18024- phys_startup_64 = startup_64 - LOAD_OFFSET;
18025+ . = __START_KERNEL;
18026 #endif
18027
18028 /* Text and read-only data */
18029- .text : AT(ADDR(.text) - LOAD_OFFSET) {
18030- _text = .;
18031+ .text (. - __KERNEL_TEXT_OFFSET): AT(ADDR(.text) - LOAD_OFFSET + __KERNEL_TEXT_OFFSET) {
18032 /* bootstrapping code */
18033+#ifdef CONFIG_X86_32
18034+ phys_startup_32 = startup_32 - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
18035+#else
18036+ phys_startup_64 = startup_64 - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
18037+#endif
18038+ __LOAD_PHYSICAL_ADDR = . - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
18039+ _text = .;
18040 HEAD_TEXT
18041 #ifdef CONFIG_X86_32
18042 . = ALIGN(PAGE_SIZE);
18043@@ -109,13 +129,47 @@ SECTIONS
18044 IRQENTRY_TEXT
18045 *(.fixup)
18046 *(.gnu.warning)
18047- /* End of text section */
18048- _etext = .;
18049 } :text = 0x9090
18050
18051- NOTES :text :note
18052+ . += __KERNEL_TEXT_OFFSET;
18053+
18054+#ifdef CONFIG_X86_32
18055+ . = ALIGN(PAGE_SIZE);
18056+ .module.text : AT(ADDR(.module.text) - LOAD_OFFSET) {
18057+
18058+#if defined(CONFIG_PAX_KERNEXEC) && defined(CONFIG_MODULES)
18059+ MODULES_EXEC_VADDR = .;
18060+ BYTE(0)
18061+ . += (CONFIG_PAX_KERNEXEC_MODULE_TEXT * 1024 * 1024);
18062+ . = ALIGN(HPAGE_SIZE);
18063+ MODULES_EXEC_END = . - 1;
18064+#endif
18065+
18066+ } :module
18067+#endif
18068+
18069+ .text.end : AT(ADDR(.text.end) - LOAD_OFFSET) {
18070+ /* End of text section */
18071+ _etext = . - __KERNEL_TEXT_OFFSET;
18072+ }
18073
18074- EXCEPTION_TABLE(16) :text = 0x9090
18075+#ifdef CONFIG_X86_32
18076+ . = ALIGN(PAGE_SIZE);
18077+ .rodata.page_aligned : AT(ADDR(.rodata.page_aligned) - LOAD_OFFSET) {
18078+ *(.idt)
18079+ . = ALIGN(PAGE_SIZE);
18080+ *(.empty_zero_page)
18081+ *(.initial_pg_fixmap)
18082+ *(.initial_pg_pmd)
18083+ *(.initial_page_table)
18084+ *(.swapper_pg_dir)
18085+ } :rodata
18086+#endif
18087+
18088+ . = ALIGN(PAGE_SIZE);
18089+ NOTES :rodata :note
18090+
18091+ EXCEPTION_TABLE(16) :rodata
18092
18093 #if defined(CONFIG_DEBUG_RODATA)
18094 /* .text should occupy whole number of pages */
18095@@ -127,16 +181,20 @@ SECTIONS
18096
18097 /* Data */
18098 .data : AT(ADDR(.data) - LOAD_OFFSET) {
18099+
18100+#ifdef CONFIG_PAX_KERNEXEC
18101+ . = ALIGN(HPAGE_SIZE);
18102+#else
18103+ . = ALIGN(PAGE_SIZE);
18104+#endif
18105+
18106 /* Start of data section */
18107 _sdata = .;
18108
18109 /* init_task */
18110 INIT_TASK_DATA(THREAD_SIZE)
18111
18112-#ifdef CONFIG_X86_32
18113- /* 32 bit has nosave before _edata */
18114 NOSAVE_DATA
18115-#endif
18116
18117 PAGE_ALIGNED_DATA(PAGE_SIZE)
18118
18119@@ -145,6 +203,8 @@ SECTIONS
18120 DATA_DATA
18121 CONSTRUCTORS
18122
18123+ jiffies = jiffies_64;
18124+
18125 /* rarely changed data like cpu maps */
18126 READ_MOSTLY_DATA(INTERNODE_CACHE_BYTES)
18127
18128@@ -199,12 +259,6 @@ SECTIONS
18129 }
18130 vgetcpu_mode = VVIRT(.vgetcpu_mode);
18131
18132- . = ALIGN(L1_CACHE_BYTES);
18133- .jiffies : AT(VLOAD(.jiffies)) {
18134- *(.jiffies)
18135- }
18136- jiffies = VVIRT(.jiffies);
18137-
18138 .vsyscall_3 ADDR(.vsyscall_0) + 3072: AT(VLOAD(.vsyscall_3)) {
18139 *(.vsyscall_3)
18140 }
18141@@ -220,12 +274,19 @@ SECTIONS
18142 #endif /* CONFIG_X86_64 */
18143
18144 /* Init code and data - will be freed after init */
18145- . = ALIGN(PAGE_SIZE);
18146 .init.begin : AT(ADDR(.init.begin) - LOAD_OFFSET) {
18147+ BYTE(0)
18148+
18149+#ifdef CONFIG_PAX_KERNEXEC
18150+ . = ALIGN(HPAGE_SIZE);
18151+#else
18152+ . = ALIGN(PAGE_SIZE);
18153+#endif
18154+
18155 __init_begin = .; /* paired with __init_end */
18156- }
18157+ } :init.begin
18158
18159-#if defined(CONFIG_X86_64) && defined(CONFIG_SMP)
18160+#ifdef CONFIG_SMP
18161 /*
18162 * percpu offsets are zero-based on SMP. PERCPU_VADDR() changes the
18163 * output PHDR, so the next output section - .init.text - should
18164@@ -234,12 +295,27 @@ SECTIONS
18165 PERCPU_VADDR(INTERNODE_CACHE_BYTES, 0, :percpu)
18166 #endif
18167
18168- INIT_TEXT_SECTION(PAGE_SIZE)
18169-#ifdef CONFIG_X86_64
18170- :init
18171-#endif
18172+ . = ALIGN(PAGE_SIZE);
18173+ init_begin = .;
18174+ .init.text (. - __KERNEL_TEXT_OFFSET): AT(init_begin - LOAD_OFFSET) {
18175+ VMLINUX_SYMBOL(_sinittext) = .;
18176+ INIT_TEXT
18177+ VMLINUX_SYMBOL(_einittext) = .;
18178+ . = ALIGN(PAGE_SIZE);
18179+ } :text.init
18180
18181- INIT_DATA_SECTION(16)
18182+ /*
18183+ * .exit.text is discard at runtime, not link time, to deal with
18184+ * references from .altinstructions and .eh_frame
18185+ */
18186+ .exit.text : AT(ADDR(.exit.text) - LOAD_OFFSET + __KERNEL_TEXT_OFFSET) {
18187+ EXIT_TEXT
18188+ . = ALIGN(16);
18189+ } :text.exit
18190+ . = init_begin + SIZEOF(.init.text) + SIZEOF(.exit.text);
18191+
18192+ . = ALIGN(PAGE_SIZE);
18193+ INIT_DATA_SECTION(16) :init
18194
18195 /*
18196 * Code and data for a variety of lowlevel trampolines, to be
18197@@ -306,19 +382,12 @@ SECTIONS
18198 }
18199
18200 . = ALIGN(8);
18201- /*
18202- * .exit.text is discard at runtime, not link time, to deal with
18203- * references from .altinstructions and .eh_frame
18204- */
18205- .exit.text : AT(ADDR(.exit.text) - LOAD_OFFSET) {
18206- EXIT_TEXT
18207- }
18208
18209 .exit.data : AT(ADDR(.exit.data) - LOAD_OFFSET) {
18210 EXIT_DATA
18211 }
18212
18213-#if !defined(CONFIG_X86_64) || !defined(CONFIG_SMP)
18214+#ifndef CONFIG_SMP
18215 PERCPU(INTERNODE_CACHE_BYTES, PAGE_SIZE)
18216 #endif
18217
18218@@ -337,16 +406,10 @@ SECTIONS
18219 .smp_locks : AT(ADDR(.smp_locks) - LOAD_OFFSET) {
18220 __smp_locks = .;
18221 *(.smp_locks)
18222- . = ALIGN(PAGE_SIZE);
18223 __smp_locks_end = .;
18224+ . = ALIGN(PAGE_SIZE);
18225 }
18226
18227-#ifdef CONFIG_X86_64
18228- .data_nosave : AT(ADDR(.data_nosave) - LOAD_OFFSET) {
18229- NOSAVE_DATA
18230- }
18231-#endif
18232-
18233 /* BSS */
18234 . = ALIGN(PAGE_SIZE);
18235 .bss : AT(ADDR(.bss) - LOAD_OFFSET) {
18236@@ -362,6 +425,7 @@ SECTIONS
18237 __brk_base = .;
18238 . += 64 * 1024; /* 64k alignment slop space */
18239 *(.brk_reservation) /* areas brk users have reserved */
18240+ . = ALIGN(HPAGE_SIZE);
18241 __brk_limit = .;
18242 }
18243
18244@@ -388,13 +452,12 @@ SECTIONS
18245 * for the boot processor.
18246 */
18247 #define INIT_PER_CPU(x) init_per_cpu__##x = x + __per_cpu_load
18248-INIT_PER_CPU(gdt_page);
18249 INIT_PER_CPU(irq_stack_union);
18250
18251 /*
18252 * Build-time check on the image size:
18253 */
18254-. = ASSERT((_end - _text <= KERNEL_IMAGE_SIZE),
18255+. = ASSERT((_end - _text - __KERNEL_TEXT_OFFSET <= KERNEL_IMAGE_SIZE),
18256 "kernel image bigger than KERNEL_IMAGE_SIZE");
18257
18258 #ifdef CONFIG_SMP
18259diff -urNp linux-2.6.39/arch/x86/kernel/vsyscall_64.c linux-2.6.39/arch/x86/kernel/vsyscall_64.c
18260--- linux-2.6.39/arch/x86/kernel/vsyscall_64.c 2011-05-19 00:06:34.000000000 -0400
18261+++ linux-2.6.39/arch/x86/kernel/vsyscall_64.c 2011-05-22 19:36:30.000000000 -0400
18262@@ -80,6 +80,7 @@ void update_vsyscall(struct timespec *wa
18263
18264 write_seqlock_irqsave(&vsyscall_gtod_data.lock, flags);
18265 /* copy vsyscall data */
18266+ strlcpy(vsyscall_gtod_data.clock.name, clock->name, sizeof vsyscall_gtod_data.clock.name);
18267 vsyscall_gtod_data.clock.vread = clock->vread;
18268 vsyscall_gtod_data.clock.cycle_last = clock->cycle_last;
18269 vsyscall_gtod_data.clock.mask = clock->mask;
18270@@ -208,7 +209,7 @@ vgetcpu(unsigned *cpu, unsigned *node, s
18271 We do this here because otherwise user space would do it on
18272 its own in a likely inferior way (no access to jiffies).
18273 If you don't like it pass NULL. */
18274- if (tcache && tcache->blob[0] == (j = __jiffies)) {
18275+ if (tcache && tcache->blob[0] == (j = jiffies)) {
18276 p = tcache->blob[1];
18277 } else if (__vgetcpu_mode == VGETCPU_RDTSCP) {
18278 /* Load per CPU data from RDTSCP */
18279diff -urNp linux-2.6.39/arch/x86/kernel/x8664_ksyms_64.c linux-2.6.39/arch/x86/kernel/x8664_ksyms_64.c
18280--- linux-2.6.39/arch/x86/kernel/x8664_ksyms_64.c 2011-05-19 00:06:34.000000000 -0400
18281+++ linux-2.6.39/arch/x86/kernel/x8664_ksyms_64.c 2011-05-22 19:36:30.000000000 -0400
18282@@ -29,8 +29,6 @@ EXPORT_SYMBOL(__put_user_8);
18283 EXPORT_SYMBOL(copy_user_generic_string);
18284 EXPORT_SYMBOL(copy_user_generic_unrolled);
18285 EXPORT_SYMBOL(__copy_user_nocache);
18286-EXPORT_SYMBOL(_copy_from_user);
18287-EXPORT_SYMBOL(_copy_to_user);
18288
18289 EXPORT_SYMBOL(copy_page);
18290 EXPORT_SYMBOL(clear_page);
18291diff -urNp linux-2.6.39/arch/x86/kernel/xsave.c linux-2.6.39/arch/x86/kernel/xsave.c
18292--- linux-2.6.39/arch/x86/kernel/xsave.c 2011-05-19 00:06:34.000000000 -0400
18293+++ linux-2.6.39/arch/x86/kernel/xsave.c 2011-05-22 19:36:30.000000000 -0400
18294@@ -130,7 +130,7 @@ int check_for_xstate(struct i387_fxsave_
18295 fx_sw_user->xstate_size > fx_sw_user->extended_size)
18296 return -EINVAL;
18297
18298- err = __get_user(magic2, (__u32 *) (((void *)fpstate) +
18299+ err = __get_user(magic2, (__u32 __user *) (((void __user *)fpstate) +
18300 fx_sw_user->extended_size -
18301 FP_XSTATE_MAGIC2_SIZE));
18302 if (err)
18303@@ -267,7 +267,7 @@ fx_only:
18304 * the other extended state.
18305 */
18306 xrstor_state(init_xstate_buf, pcntxt_mask & ~XSTATE_FPSSE);
18307- return fxrstor_checking((__force struct i387_fxsave_struct *)buf);
18308+ return fxrstor_checking((struct i387_fxsave_struct __user *)buf);
18309 }
18310
18311 /*
18312@@ -299,7 +299,7 @@ int restore_i387_xstate(void __user *buf
18313 if (use_xsave())
18314 err = restore_user_xstate(buf);
18315 else
18316- err = fxrstor_checking((__force struct i387_fxsave_struct *)
18317+ err = fxrstor_checking((struct i387_fxsave_struct __user *)
18318 buf);
18319 if (unlikely(err)) {
18320 /*
18321diff -urNp linux-2.6.39/arch/x86/kvm/emulate.c linux-2.6.39/arch/x86/kvm/emulate.c
18322--- linux-2.6.39/arch/x86/kvm/emulate.c 2011-05-19 00:06:34.000000000 -0400
18323+++ linux-2.6.39/arch/x86/kvm/emulate.c 2011-05-22 19:36:30.000000000 -0400
18324@@ -89,7 +89,7 @@
18325 #define Src2ImmByte (2<<29)
18326 #define Src2One (3<<29)
18327 #define Src2Imm (4<<29)
18328-#define Src2Mask (7<<29)
18329+#define Src2Mask (7U<<29)
18330
18331 #define X2(x...) x, x
18332 #define X3(x...) X2(x), x
18333@@ -190,6 +190,7 @@ struct group_dual {
18334
18335 #define ____emulate_2op(_op, _src, _dst, _eflags, _x, _y, _suffix, _dsttype) \
18336 do { \
18337+ unsigned long _tmp; \
18338 __asm__ __volatile__ ( \
18339 _PRE_EFLAGS("0", "4", "2") \
18340 _op _suffix " %"_x"3,%1; " \
18341@@ -203,8 +204,6 @@ struct group_dual {
18342 /* Raw emulation: instruction has two explicit operands. */
18343 #define __emulate_2op_nobyte(_op,_src,_dst,_eflags,_wx,_wy,_lx,_ly,_qx,_qy) \
18344 do { \
18345- unsigned long _tmp; \
18346- \
18347 switch ((_dst).bytes) { \
18348 case 2: \
18349 ____emulate_2op(_op,_src,_dst,_eflags,_wx,_wy,"w",u16);\
18350@@ -220,7 +219,6 @@ struct group_dual {
18351
18352 #define __emulate_2op(_op,_src,_dst,_eflags,_bx,_by,_wx,_wy,_lx,_ly,_qx,_qy) \
18353 do { \
18354- unsigned long _tmp; \
18355 switch ((_dst).bytes) { \
18356 case 1: \
18357 ____emulate_2op(_op,_src,_dst,_eflags,_bx,_by,"b",u8); \
18358diff -urNp linux-2.6.39/arch/x86/kvm/lapic.c linux-2.6.39/arch/x86/kvm/lapic.c
18359--- linux-2.6.39/arch/x86/kvm/lapic.c 2011-05-19 00:06:34.000000000 -0400
18360+++ linux-2.6.39/arch/x86/kvm/lapic.c 2011-05-22 19:36:30.000000000 -0400
18361@@ -53,7 +53,7 @@
18362 #define APIC_BUS_CYCLE_NS 1
18363
18364 /* #define apic_debug(fmt,arg...) printk(KERN_WARNING fmt,##arg) */
18365-#define apic_debug(fmt, arg...)
18366+#define apic_debug(fmt, arg...) do {} while (0)
18367
18368 #define APIC_LVT_NUM 6
18369 /* 14 is the version for Xeon and Pentium 8.4.8*/
18370diff -urNp linux-2.6.39/arch/x86/kvm/mmu.c linux-2.6.39/arch/x86/kvm/mmu.c
18371--- linux-2.6.39/arch/x86/kvm/mmu.c 2011-05-19 00:06:34.000000000 -0400
18372+++ linux-2.6.39/arch/x86/kvm/mmu.c 2011-05-22 19:36:30.000000000 -0400
18373@@ -3240,7 +3240,7 @@ void kvm_mmu_pte_write(struct kvm_vcpu *
18374
18375 pgprintk("%s: gpa %llx bytes %d\n", __func__, gpa, bytes);
18376
18377- invlpg_counter = atomic_read(&vcpu->kvm->arch.invlpg_counter);
18378+ invlpg_counter = atomic_read_unchecked(&vcpu->kvm->arch.invlpg_counter);
18379
18380 /*
18381 * Assume that the pte write on a page table of the same type
18382@@ -3275,7 +3275,7 @@ void kvm_mmu_pte_write(struct kvm_vcpu *
18383 smp_rmb();
18384
18385 spin_lock(&vcpu->kvm->mmu_lock);
18386- if (atomic_read(&vcpu->kvm->arch.invlpg_counter) != invlpg_counter)
18387+ if (atomic_read_unchecked(&vcpu->kvm->arch.invlpg_counter) != invlpg_counter)
18388 gentry = 0;
18389 kvm_mmu_free_some_pages(vcpu);
18390 ++vcpu->kvm->stat.mmu_pte_write;
18391diff -urNp linux-2.6.39/arch/x86/kvm/paging_tmpl.h linux-2.6.39/arch/x86/kvm/paging_tmpl.h
18392--- linux-2.6.39/arch/x86/kvm/paging_tmpl.h 2011-05-19 00:06:34.000000000 -0400
18393+++ linux-2.6.39/arch/x86/kvm/paging_tmpl.h 2011-05-22 19:36:30.000000000 -0400
18394@@ -552,6 +552,8 @@ static int FNAME(page_fault)(struct kvm_
18395 unsigned long mmu_seq;
18396 bool map_writable;
18397
18398+ pax_track_stack();
18399+
18400 pgprintk("%s: addr %lx err %x\n", __func__, addr, error_code);
18401
18402 r = mmu_topup_memory_caches(vcpu);
18403@@ -672,7 +674,7 @@ static void FNAME(invlpg)(struct kvm_vcp
18404 if (need_flush)
18405 kvm_flush_remote_tlbs(vcpu->kvm);
18406
18407- atomic_inc(&vcpu->kvm->arch.invlpg_counter);
18408+ atomic_inc_unchecked(&vcpu->kvm->arch.invlpg_counter);
18409
18410 spin_unlock(&vcpu->kvm->mmu_lock);
18411
18412diff -urNp linux-2.6.39/arch/x86/kvm/svm.c linux-2.6.39/arch/x86/kvm/svm.c
18413--- linux-2.6.39/arch/x86/kvm/svm.c 2011-05-19 00:06:34.000000000 -0400
18414+++ linux-2.6.39/arch/x86/kvm/svm.c 2011-05-22 19:36:30.000000000 -0400
18415@@ -3278,7 +3278,11 @@ static void reload_tss(struct kvm_vcpu *
18416 int cpu = raw_smp_processor_id();
18417
18418 struct svm_cpu_data *sd = per_cpu(svm_data, cpu);
18419+
18420+ pax_open_kernel();
18421 sd->tss_desc->type = 9; /* available 32/64-bit TSS */
18422+ pax_close_kernel();
18423+
18424 load_TR_desc();
18425 }
18426
18427@@ -3656,6 +3660,10 @@ static void svm_vcpu_run(struct kvm_vcpu
18428 #endif
18429 #endif
18430
18431+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
18432+ __set_fs(current_thread_info()->addr_limit);
18433+#endif
18434+
18435 reload_tss(vcpu);
18436
18437 local_irq_disable();
18438@@ -3871,7 +3879,7 @@ static void svm_fpu_deactivate(struct kv
18439 update_cr0_intercept(svm);
18440 }
18441
18442-static struct kvm_x86_ops svm_x86_ops = {
18443+static const struct kvm_x86_ops svm_x86_ops = {
18444 .cpu_has_kvm_support = has_svm,
18445 .disabled_by_bios = is_disabled,
18446 .hardware_setup = svm_hardware_setup,
18447diff -urNp linux-2.6.39/arch/x86/kvm/vmx.c linux-2.6.39/arch/x86/kvm/vmx.c
18448--- linux-2.6.39/arch/x86/kvm/vmx.c 2011-05-19 00:06:34.000000000 -0400
18449+++ linux-2.6.39/arch/x86/kvm/vmx.c 2011-05-22 19:36:30.000000000 -0400
18450@@ -725,7 +725,11 @@ static void reload_tss(void)
18451 struct desc_struct *descs;
18452
18453 descs = (void *)gdt->address;
18454+
18455+ pax_open_kernel();
18456 descs[GDT_ENTRY_TSS].type = 9; /* available TSS */
18457+ pax_close_kernel();
18458+
18459 load_TR_desc();
18460 }
18461
18462@@ -1648,8 +1652,11 @@ static __init int hardware_setup(void)
18463 if (!cpu_has_vmx_flexpriority())
18464 flexpriority_enabled = 0;
18465
18466- if (!cpu_has_vmx_tpr_shadow())
18467- kvm_x86_ops->update_cr8_intercept = NULL;
18468+ if (!cpu_has_vmx_tpr_shadow()) {
18469+ pax_open_kernel();
18470+ *(void **)&kvm_x86_ops->update_cr8_intercept = NULL;
18471+ pax_close_kernel();
18472+ }
18473
18474 if (enable_ept && !cpu_has_vmx_ept_2m_page())
18475 kvm_disable_largepages();
18476@@ -2693,7 +2700,7 @@ static int vmx_vcpu_setup(struct vcpu_vm
18477 vmcs_writel(HOST_IDTR_BASE, dt.address); /* 22.2.4 */
18478
18479 asm("mov $.Lkvm_vmx_return, %0" : "=r"(kvm_vmx_return));
18480- vmcs_writel(HOST_RIP, kvm_vmx_return); /* 22.2.5 */
18481+ vmcs_writel(HOST_RIP, ktla_ktva(kvm_vmx_return)); /* 22.2.5 */
18482 vmcs_write32(VM_EXIT_MSR_STORE_COUNT, 0);
18483 vmcs_write32(VM_EXIT_MSR_LOAD_COUNT, 0);
18484 vmcs_write64(VM_EXIT_MSR_LOAD_ADDR, __pa(vmx->msr_autoload.host));
18485@@ -4068,6 +4075,12 @@ static void __noclone vmx_vcpu_run(struc
18486 "jmp .Lkvm_vmx_return \n\t"
18487 ".Llaunched: " __ex(ASM_VMX_VMRESUME) "\n\t"
18488 ".Lkvm_vmx_return: "
18489+
18490+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
18491+ "ljmp %[cs],$.Lkvm_vmx_return2\n\t"
18492+ ".Lkvm_vmx_return2: "
18493+#endif
18494+
18495 /* Save guest registers, load host registers, keep flags */
18496 "mov %0, %c[wordsize](%%"R"sp) \n\t"
18497 "pop %0 \n\t"
18498@@ -4116,6 +4129,11 @@ static void __noclone vmx_vcpu_run(struc
18499 #endif
18500 [cr2]"i"(offsetof(struct vcpu_vmx, vcpu.arch.cr2)),
18501 [wordsize]"i"(sizeof(ulong))
18502+
18503+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
18504+ ,[cs]"i"(__KERNEL_CS)
18505+#endif
18506+
18507 : "cc", "memory"
18508 , R"ax", R"bx", R"di", R"si"
18509 #ifdef CONFIG_X86_64
18510@@ -4130,7 +4148,16 @@ static void __noclone vmx_vcpu_run(struc
18511
18512 vmx->idt_vectoring_info = vmcs_read32(IDT_VECTORING_INFO_FIELD);
18513
18514- asm("mov %0, %%ds; mov %0, %%es" : : "r"(__USER_DS));
18515+ asm("mov %0, %%ds; mov %0, %%es; mov %0, %%ss" : : "r"(__KERNEL_DS));
18516+
18517+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
18518+ loadsegment(fs, __KERNEL_PERCPU);
18519+#endif
18520+
18521+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
18522+ __set_fs(current_thread_info()->addr_limit);
18523+#endif
18524+
18525 vmx->launched = 1;
18526
18527 vmx->exit_reason = vmcs_read32(VM_EXIT_REASON);
18528@@ -4368,7 +4395,7 @@ static void vmx_set_supported_cpuid(u32
18529 {
18530 }
18531
18532-static struct kvm_x86_ops vmx_x86_ops = {
18533+static const struct kvm_x86_ops vmx_x86_ops = {
18534 .cpu_has_kvm_support = cpu_has_kvm_support,
18535 .disabled_by_bios = vmx_disabled_by_bios,
18536 .hardware_setup = hardware_setup,
18537diff -urNp linux-2.6.39/arch/x86/kvm/x86.c linux-2.6.39/arch/x86/kvm/x86.c
18538--- linux-2.6.39/arch/x86/kvm/x86.c 2011-05-19 00:06:34.000000000 -0400
18539+++ linux-2.6.39/arch/x86/kvm/x86.c 2011-05-22 19:36:30.000000000 -0400
18540@@ -94,7 +94,7 @@ static void update_cr8_intercept(struct
18541 static int kvm_dev_ioctl_get_supported_cpuid(struct kvm_cpuid2 *cpuid,
18542 struct kvm_cpuid_entry2 __user *entries);
18543
18544-struct kvm_x86_ops *kvm_x86_ops;
18545+const struct kvm_x86_ops *kvm_x86_ops;
18546 EXPORT_SYMBOL_GPL(kvm_x86_ops);
18547
18548 int ignore_msrs = 0;
18549@@ -2050,6 +2050,8 @@ long kvm_arch_dev_ioctl(struct file *fil
18550 if (n < msr_list.nmsrs)
18551 goto out;
18552 r = -EFAULT;
18553+ if (num_msrs_to_save > ARRAY_SIZE(msrs_to_save))
18554+ goto out;
18555 if (copy_to_user(user_msr_list->indices, &msrs_to_save,
18556 num_msrs_to_save * sizeof(u32)))
18557 goto out;
18558@@ -2217,15 +2219,20 @@ static int kvm_vcpu_ioctl_set_cpuid2(str
18559 struct kvm_cpuid2 *cpuid,
18560 struct kvm_cpuid_entry2 __user *entries)
18561 {
18562- int r;
18563+ int r, i;
18564
18565 r = -E2BIG;
18566 if (cpuid->nent > KVM_MAX_CPUID_ENTRIES)
18567 goto out;
18568 r = -EFAULT;
18569- if (copy_from_user(&vcpu->arch.cpuid_entries, entries,
18570- cpuid->nent * sizeof(struct kvm_cpuid_entry2)))
18571+ if (!access_ok(VERIFY_READ, entries, cpuid->nent * sizeof(struct kvm_cpuid_entry2)))
18572 goto out;
18573+ for (i = 0; i < cpuid->nent; ++i) {
18574+ struct kvm_cpuid_entry2 cpuid_entry;
18575+ if (__copy_from_user(&cpuid_entry, entries + i, sizeof(cpuid_entry)))
18576+ goto out;
18577+ vcpu->arch.cpuid_entries[i] = cpuid_entry;
18578+ }
18579 vcpu->arch.cpuid_nent = cpuid->nent;
18580 kvm_apic_set_version(vcpu);
18581 kvm_x86_ops->cpuid_update(vcpu);
18582@@ -2240,15 +2247,19 @@ static int kvm_vcpu_ioctl_get_cpuid2(str
18583 struct kvm_cpuid2 *cpuid,
18584 struct kvm_cpuid_entry2 __user *entries)
18585 {
18586- int r;
18587+ int r, i;
18588
18589 r = -E2BIG;
18590 if (cpuid->nent < vcpu->arch.cpuid_nent)
18591 goto out;
18592 r = -EFAULT;
18593- if (copy_to_user(entries, &vcpu->arch.cpuid_entries,
18594- vcpu->arch.cpuid_nent * sizeof(struct kvm_cpuid_entry2)))
18595+ if (!access_ok(VERIFY_WRITE, entries, vcpu->arch.cpuid_nent * sizeof(struct kvm_cpuid_entry2)))
18596 goto out;
18597+ for (i = 0; i < vcpu->arch.cpuid_nent; ++i) {
18598+ struct kvm_cpuid_entry2 cpuid_entry = vcpu->arch.cpuid_entries[i];
18599+ if (__copy_to_user(entries + i, &cpuid_entry, sizeof(cpuid_entry)))
18600+ goto out;
18601+ }
18602 return 0;
18603
18604 out:
18605@@ -2526,7 +2537,7 @@ static int kvm_vcpu_ioctl_set_lapic(stru
18606 static int kvm_vcpu_ioctl_interrupt(struct kvm_vcpu *vcpu,
18607 struct kvm_interrupt *irq)
18608 {
18609- if (irq->irq < 0 || irq->irq >= 256)
18610+ if (irq->irq >= 256)
18611 return -EINVAL;
18612 if (irqchip_in_kernel(vcpu->kvm))
18613 return -ENXIO;
18614@@ -4672,7 +4683,7 @@ static unsigned long kvm_get_guest_ip(vo
18615 return ip;
18616 }
18617
18618-static struct perf_guest_info_callbacks kvm_guest_cbs = {
18619+static const struct perf_guest_info_callbacks kvm_guest_cbs = {
18620 .is_in_guest = kvm_is_in_guest,
18621 .is_user_mode = kvm_is_user_mode,
18622 .get_guest_ip = kvm_get_guest_ip,
18623@@ -4690,10 +4701,10 @@ void kvm_after_handle_nmi(struct kvm_vcp
18624 }
18625 EXPORT_SYMBOL_GPL(kvm_after_handle_nmi);
18626
18627-int kvm_arch_init(void *opaque)
18628+int kvm_arch_init(const void *opaque)
18629 {
18630 int r;
18631- struct kvm_x86_ops *ops = (struct kvm_x86_ops *)opaque;
18632+ const struct kvm_x86_ops *ops = (const struct kvm_x86_ops *)opaque;
18633
18634 if (kvm_x86_ops) {
18635 printk(KERN_ERR "kvm: already loaded the other module\n");
18636diff -urNp linux-2.6.39/arch/x86/lib/atomic64_32.c linux-2.6.39/arch/x86/lib/atomic64_32.c
18637--- linux-2.6.39/arch/x86/lib/atomic64_32.c 2011-05-19 00:06:34.000000000 -0400
18638+++ linux-2.6.39/arch/x86/lib/atomic64_32.c 2011-05-22 19:36:30.000000000 -0400
18639@@ -8,18 +8,30 @@
18640
18641 long long atomic64_read_cx8(long long, const atomic64_t *v);
18642 EXPORT_SYMBOL(atomic64_read_cx8);
18643+long long atomic64_read_unchecked_cx8(long long, const atomic64_unchecked_t *v);
18644+EXPORT_SYMBOL(atomic64_read_unchecked_cx8);
18645 long long atomic64_set_cx8(long long, const atomic64_t *v);
18646 EXPORT_SYMBOL(atomic64_set_cx8);
18647+long long atomic64_set_unchecked_cx8(long long, const atomic64_unchecked_t *v);
18648+EXPORT_SYMBOL(atomic64_set_unchecked_cx8);
18649 long long atomic64_xchg_cx8(long long, unsigned high);
18650 EXPORT_SYMBOL(atomic64_xchg_cx8);
18651 long long atomic64_add_return_cx8(long long a, atomic64_t *v);
18652 EXPORT_SYMBOL(atomic64_add_return_cx8);
18653+long long atomic64_add_return_unchecked_cx8(long long a, atomic64_unchecked_t *v);
18654+EXPORT_SYMBOL(atomic64_add_return_unchecked_cx8);
18655 long long atomic64_sub_return_cx8(long long a, atomic64_t *v);
18656 EXPORT_SYMBOL(atomic64_sub_return_cx8);
18657+long long atomic64_sub_return_unchecked_cx8(long long a, atomic64_unchecked_t *v);
18658+EXPORT_SYMBOL(atomic64_sub_return_unchecked_cx8);
18659 long long atomic64_inc_return_cx8(long long a, atomic64_t *v);
18660 EXPORT_SYMBOL(atomic64_inc_return_cx8);
18661+long long atomic64_inc_return_unchecked_cx8(long long a, atomic64_unchecked_t *v);
18662+EXPORT_SYMBOL(atomic64_inc_return_unchecked_cx8);
18663 long long atomic64_dec_return_cx8(long long a, atomic64_t *v);
18664 EXPORT_SYMBOL(atomic64_dec_return_cx8);
18665+long long atomic64_dec_return_unchecked_cx8(long long a, atomic64_unchecked_t *v);
18666+EXPORT_SYMBOL(atomic64_dec_return_unchecked_cx8);
18667 long long atomic64_dec_if_positive_cx8(atomic64_t *v);
18668 EXPORT_SYMBOL(atomic64_dec_if_positive_cx8);
18669 int atomic64_inc_not_zero_cx8(atomic64_t *v);
18670@@ -30,26 +42,46 @@ EXPORT_SYMBOL(atomic64_add_unless_cx8);
18671 #ifndef CONFIG_X86_CMPXCHG64
18672 long long atomic64_read_386(long long, const atomic64_t *v);
18673 EXPORT_SYMBOL(atomic64_read_386);
18674+long long atomic64_read_unchecked_386(long long, const atomic64_unchecked_t *v);
18675+EXPORT_SYMBOL(atomic64_read_unchecked_386);
18676 long long atomic64_set_386(long long, const atomic64_t *v);
18677 EXPORT_SYMBOL(atomic64_set_386);
18678+long long atomic64_set_unchecked_386(long long, const atomic64_unchecked_t *v);
18679+EXPORT_SYMBOL(atomic64_set_unchecked_386);
18680 long long atomic64_xchg_386(long long, unsigned high);
18681 EXPORT_SYMBOL(atomic64_xchg_386);
18682 long long atomic64_add_return_386(long long a, atomic64_t *v);
18683 EXPORT_SYMBOL(atomic64_add_return_386);
18684+long long atomic64_add_return_unchecked_386(long long a, atomic64_unchecked_t *v);
18685+EXPORT_SYMBOL(atomic64_add_return_unchecked_386);
18686 long long atomic64_sub_return_386(long long a, atomic64_t *v);
18687 EXPORT_SYMBOL(atomic64_sub_return_386);
18688+long long atomic64_sub_return_unchecked_386(long long a, atomic64_unchecked_t *v);
18689+EXPORT_SYMBOL(atomic64_sub_return_unchecked_386);
18690 long long atomic64_inc_return_386(long long a, atomic64_t *v);
18691 EXPORT_SYMBOL(atomic64_inc_return_386);
18692+long long atomic64_inc_return_unchecked_386(long long a, atomic64_unchecked_t *v);
18693+EXPORT_SYMBOL(atomic64_inc_return_unchecked_386);
18694 long long atomic64_dec_return_386(long long a, atomic64_t *v);
18695 EXPORT_SYMBOL(atomic64_dec_return_386);
18696+long long atomic64_dec_return_unchecked_386(long long a, atomic64_unchecked_t *v);
18697+EXPORT_SYMBOL(atomic64_dec_return_unchecked_386);
18698 long long atomic64_add_386(long long a, atomic64_t *v);
18699 EXPORT_SYMBOL(atomic64_add_386);
18700+long long atomic64_add_unchecked_386(long long a, atomic64_unchecked_t *v);
18701+EXPORT_SYMBOL(atomic64_add_unchecked_386);
18702 long long atomic64_sub_386(long long a, atomic64_t *v);
18703 EXPORT_SYMBOL(atomic64_sub_386);
18704+long long atomic64_sub_unchecked_386(long long a, atomic64_unchecked_t *v);
18705+EXPORT_SYMBOL(atomic64_sub_unchecked_386);
18706 long long atomic64_inc_386(long long a, atomic64_t *v);
18707 EXPORT_SYMBOL(atomic64_inc_386);
18708+long long atomic64_inc_unchecked_386(long long a, atomic64_unchecked_t *v);
18709+EXPORT_SYMBOL(atomic64_inc_unchecked_386);
18710 long long atomic64_dec_386(long long a, atomic64_t *v);
18711 EXPORT_SYMBOL(atomic64_dec_386);
18712+long long atomic64_dec_unchecked_386(long long a, atomic64_unchecked_t *v);
18713+EXPORT_SYMBOL(atomic64_dec_unchecked_386);
18714 long long atomic64_dec_if_positive_386(atomic64_t *v);
18715 EXPORT_SYMBOL(atomic64_dec_if_positive_386);
18716 int atomic64_inc_not_zero_386(atomic64_t *v);
18717diff -urNp linux-2.6.39/arch/x86/lib/atomic64_386_32.S linux-2.6.39/arch/x86/lib/atomic64_386_32.S
18718--- linux-2.6.39/arch/x86/lib/atomic64_386_32.S 2011-05-19 00:06:34.000000000 -0400
18719+++ linux-2.6.39/arch/x86/lib/atomic64_386_32.S 2011-05-22 19:36:30.000000000 -0400
18720@@ -48,6 +48,10 @@ BEGIN(read)
18721 movl (v), %eax
18722 movl 4(v), %edx
18723 RET_ENDP
18724+BEGIN(read_unchecked)
18725+ movl (v), %eax
18726+ movl 4(v), %edx
18727+RET_ENDP
18728 #undef v
18729
18730 #define v %esi
18731@@ -55,6 +59,10 @@ BEGIN(set)
18732 movl %ebx, (v)
18733 movl %ecx, 4(v)
18734 RET_ENDP
18735+BEGIN(set_unchecked)
18736+ movl %ebx, (v)
18737+ movl %ecx, 4(v)
18738+RET_ENDP
18739 #undef v
18740
18741 #define v %esi
18742@@ -70,6 +78,20 @@ RET_ENDP
18743 BEGIN(add)
18744 addl %eax, (v)
18745 adcl %edx, 4(v)
18746+
18747+#ifdef CONFIG_PAX_REFCOUNT
18748+ jno 0f
18749+ subl %eax, (v)
18750+ sbbl %edx, 4(v)
18751+ int $4
18752+0:
18753+ _ASM_EXTABLE(0b, 0b)
18754+#endif
18755+
18756+RET_ENDP
18757+BEGIN(add_unchecked)
18758+ addl %eax, (v)
18759+ adcl %edx, 4(v)
18760 RET_ENDP
18761 #undef v
18762
18763@@ -77,6 +99,24 @@ RET_ENDP
18764 BEGIN(add_return)
18765 addl (v), %eax
18766 adcl 4(v), %edx
18767+
18768+#ifdef CONFIG_PAX_REFCOUNT
18769+ into
18770+1234:
18771+ _ASM_EXTABLE(1234b, 2f)
18772+#endif
18773+
18774+ movl %eax, (v)
18775+ movl %edx, 4(v)
18776+
18777+#ifdef CONFIG_PAX_REFCOUNT
18778+2:
18779+#endif
18780+
18781+RET_ENDP
18782+BEGIN(add_return_unchecked)
18783+ addl (v), %eax
18784+ adcl 4(v), %edx
18785 movl %eax, (v)
18786 movl %edx, 4(v)
18787 RET_ENDP
18788@@ -86,6 +126,20 @@ RET_ENDP
18789 BEGIN(sub)
18790 subl %eax, (v)
18791 sbbl %edx, 4(v)
18792+
18793+#ifdef CONFIG_PAX_REFCOUNT
18794+ jno 0f
18795+ addl %eax, (v)
18796+ adcl %edx, 4(v)
18797+ int $4
18798+0:
18799+ _ASM_EXTABLE(0b, 0b)
18800+#endif
18801+
18802+RET_ENDP
18803+BEGIN(sub_unchecked)
18804+ subl %eax, (v)
18805+ sbbl %edx, 4(v)
18806 RET_ENDP
18807 #undef v
18808
18809@@ -96,6 +150,27 @@ BEGIN(sub_return)
18810 sbbl $0, %edx
18811 addl (v), %eax
18812 adcl 4(v), %edx
18813+
18814+#ifdef CONFIG_PAX_REFCOUNT
18815+ into
18816+1234:
18817+ _ASM_EXTABLE(1234b, 2f)
18818+#endif
18819+
18820+ movl %eax, (v)
18821+ movl %edx, 4(v)
18822+
18823+#ifdef CONFIG_PAX_REFCOUNT
18824+2:
18825+#endif
18826+
18827+RET_ENDP
18828+BEGIN(sub_return_unchecked)
18829+ negl %edx
18830+ negl %eax
18831+ sbbl $0, %edx
18832+ addl (v), %eax
18833+ adcl 4(v), %edx
18834 movl %eax, (v)
18835 movl %edx, 4(v)
18836 RET_ENDP
18837@@ -105,6 +180,20 @@ RET_ENDP
18838 BEGIN(inc)
18839 addl $1, (v)
18840 adcl $0, 4(v)
18841+
18842+#ifdef CONFIG_PAX_REFCOUNT
18843+ jno 0f
18844+ subl $1, (v)
18845+ sbbl $0, 4(v)
18846+ int $4
18847+0:
18848+ _ASM_EXTABLE(0b, 0b)
18849+#endif
18850+
18851+RET_ENDP
18852+BEGIN(inc_unchecked)
18853+ addl $1, (v)
18854+ adcl $0, 4(v)
18855 RET_ENDP
18856 #undef v
18857
18858@@ -114,6 +203,26 @@ BEGIN(inc_return)
18859 movl 4(v), %edx
18860 addl $1, %eax
18861 adcl $0, %edx
18862+
18863+#ifdef CONFIG_PAX_REFCOUNT
18864+ into
18865+1234:
18866+ _ASM_EXTABLE(1234b, 2f)
18867+#endif
18868+
18869+ movl %eax, (v)
18870+ movl %edx, 4(v)
18871+
18872+#ifdef CONFIG_PAX_REFCOUNT
18873+2:
18874+#endif
18875+
18876+RET_ENDP
18877+BEGIN(inc_return_unchecked)
18878+ movl (v), %eax
18879+ movl 4(v), %edx
18880+ addl $1, %eax
18881+ adcl $0, %edx
18882 movl %eax, (v)
18883 movl %edx, 4(v)
18884 RET_ENDP
18885@@ -123,6 +232,20 @@ RET_ENDP
18886 BEGIN(dec)
18887 subl $1, (v)
18888 sbbl $0, 4(v)
18889+
18890+#ifdef CONFIG_PAX_REFCOUNT
18891+ jno 0f
18892+ addl $1, (v)
18893+ adcl $0, 4(v)
18894+ int $4
18895+0:
18896+ _ASM_EXTABLE(0b, 0b)
18897+#endif
18898+
18899+RET_ENDP
18900+BEGIN(dec_unchecked)
18901+ subl $1, (v)
18902+ sbbl $0, 4(v)
18903 RET_ENDP
18904 #undef v
18905
18906@@ -132,6 +255,26 @@ BEGIN(dec_return)
18907 movl 4(v), %edx
18908 subl $1, %eax
18909 sbbl $0, %edx
18910+
18911+#ifdef CONFIG_PAX_REFCOUNT
18912+ into
18913+1234:
18914+ _ASM_EXTABLE(1234b, 2f)
18915+#endif
18916+
18917+ movl %eax, (v)
18918+ movl %edx, 4(v)
18919+
18920+#ifdef CONFIG_PAX_REFCOUNT
18921+2:
18922+#endif
18923+
18924+RET_ENDP
18925+BEGIN(dec_return_unchecked)
18926+ movl (v), %eax
18927+ movl 4(v), %edx
18928+ subl $1, %eax
18929+ sbbl $0, %edx
18930 movl %eax, (v)
18931 movl %edx, 4(v)
18932 RET_ENDP
18933@@ -143,6 +286,13 @@ BEGIN(add_unless)
18934 adcl %edx, %edi
18935 addl (v), %eax
18936 adcl 4(v), %edx
18937+
18938+#ifdef CONFIG_PAX_REFCOUNT
18939+ into
18940+1234:
18941+ _ASM_EXTABLE(1234b, 2f)
18942+#endif
18943+
18944 cmpl %eax, %esi
18945 je 3f
18946 1:
18947@@ -168,6 +318,13 @@ BEGIN(inc_not_zero)
18948 1:
18949 addl $1, %eax
18950 adcl $0, %edx
18951+
18952+#ifdef CONFIG_PAX_REFCOUNT
18953+ into
18954+1234:
18955+ _ASM_EXTABLE(1234b, 2f)
18956+#endif
18957+
18958 movl %eax, (v)
18959 movl %edx, 4(v)
18960 movl $1, %eax
18961@@ -186,6 +343,13 @@ BEGIN(dec_if_positive)
18962 movl 4(v), %edx
18963 subl $1, %eax
18964 sbbl $0, %edx
18965+
18966+#ifdef CONFIG_PAX_REFCOUNT
18967+ into
18968+1234:
18969+ _ASM_EXTABLE(1234b, 1f)
18970+#endif
18971+
18972 js 1f
18973 movl %eax, (v)
18974 movl %edx, 4(v)
18975diff -urNp linux-2.6.39/arch/x86/lib/atomic64_cx8_32.S linux-2.6.39/arch/x86/lib/atomic64_cx8_32.S
18976--- linux-2.6.39/arch/x86/lib/atomic64_cx8_32.S 2011-05-19 00:06:34.000000000 -0400
18977+++ linux-2.6.39/arch/x86/lib/atomic64_cx8_32.S 2011-05-22 19:36:30.000000000 -0400
18978@@ -39,6 +39,14 @@ ENTRY(atomic64_read_cx8)
18979 CFI_ENDPROC
18980 ENDPROC(atomic64_read_cx8)
18981
18982+ENTRY(atomic64_read_unchecked_cx8)
18983+ CFI_STARTPROC
18984+
18985+ read64 %ecx
18986+ ret
18987+ CFI_ENDPROC
18988+ENDPROC(atomic64_read_unchecked_cx8)
18989+
18990 ENTRY(atomic64_set_cx8)
18991 CFI_STARTPROC
18992
18993@@ -52,6 +60,19 @@ ENTRY(atomic64_set_cx8)
18994 CFI_ENDPROC
18995 ENDPROC(atomic64_set_cx8)
18996
18997+ENTRY(atomic64_set_unchecked_cx8)
18998+ CFI_STARTPROC
18999+
19000+1:
19001+/* we don't need LOCK_PREFIX since aligned 64-bit writes
19002+ * are atomic on 586 and newer */
19003+ cmpxchg8b (%esi)
19004+ jne 1b
19005+
19006+ ret
19007+ CFI_ENDPROC
19008+ENDPROC(atomic64_set_unchecked_cx8)
19009+
19010 ENTRY(atomic64_xchg_cx8)
19011 CFI_STARTPROC
19012
19013@@ -66,8 +87,8 @@ ENTRY(atomic64_xchg_cx8)
19014 CFI_ENDPROC
19015 ENDPROC(atomic64_xchg_cx8)
19016
19017-.macro addsub_return func ins insc
19018-ENTRY(atomic64_\func\()_return_cx8)
19019+.macro addsub_return func ins insc unchecked=""
19020+ENTRY(atomic64_\func\()_return\unchecked\()_cx8)
19021 CFI_STARTPROC
19022 SAVE ebp
19023 SAVE ebx
19024@@ -84,27 +105,43 @@ ENTRY(atomic64_\func\()_return_cx8)
19025 movl %edx, %ecx
19026 \ins\()l %esi, %ebx
19027 \insc\()l %edi, %ecx
19028+
19029+.ifb \unchecked
19030+#ifdef CONFIG_PAX_REFCOUNT
19031+ into
19032+2:
19033+ _ASM_EXTABLE(2b, 3f)
19034+#endif
19035+.endif
19036+
19037 LOCK_PREFIX
19038 cmpxchg8b (%ebp)
19039 jne 1b
19040-
19041-10:
19042 movl %ebx, %eax
19043 movl %ecx, %edx
19044+
19045+.ifb \unchecked
19046+#ifdef CONFIG_PAX_REFCOUNT
19047+3:
19048+#endif
19049+.endif
19050+
19051 RESTORE edi
19052 RESTORE esi
19053 RESTORE ebx
19054 RESTORE ebp
19055 ret
19056 CFI_ENDPROC
19057-ENDPROC(atomic64_\func\()_return_cx8)
19058+ENDPROC(atomic64_\func\()_return\unchecked\()_cx8)
19059 .endm
19060
19061 addsub_return add add adc
19062 addsub_return sub sub sbb
19063+addsub_return add add adc _unchecked
19064+addsub_return sub sub sbb _unchecked
19065
19066-.macro incdec_return func ins insc
19067-ENTRY(atomic64_\func\()_return_cx8)
19068+.macro incdec_return func ins insc unchecked
19069+ENTRY(atomic64_\func\()_return\unchecked\()_cx8)
19070 CFI_STARTPROC
19071 SAVE ebx
19072
19073@@ -114,21 +151,38 @@ ENTRY(atomic64_\func\()_return_cx8)
19074 movl %edx, %ecx
19075 \ins\()l $1, %ebx
19076 \insc\()l $0, %ecx
19077+
19078+.ifb \unchecked
19079+#ifdef CONFIG_PAX_REFCOUNT
19080+ into
19081+2:
19082+ _ASM_EXTABLE(2b, 3f)
19083+#endif
19084+.endif
19085+
19086 LOCK_PREFIX
19087 cmpxchg8b (%esi)
19088 jne 1b
19089
19090-10:
19091 movl %ebx, %eax
19092 movl %ecx, %edx
19093+
19094+.ifb \unchecked
19095+#ifdef CONFIG_PAX_REFCOUNT
19096+3:
19097+#endif
19098+.endif
19099+
19100 RESTORE ebx
19101 ret
19102 CFI_ENDPROC
19103-ENDPROC(atomic64_\func\()_return_cx8)
19104+ENDPROC(atomic64_\func\()_return\unchecked\()_cx8)
19105 .endm
19106
19107 incdec_return inc add adc
19108 incdec_return dec sub sbb
19109+incdec_return inc add adc _unchecked
19110+incdec_return dec sub sbb _unchecked
19111
19112 ENTRY(atomic64_dec_if_positive_cx8)
19113 CFI_STARTPROC
19114@@ -140,6 +194,13 @@ ENTRY(atomic64_dec_if_positive_cx8)
19115 movl %edx, %ecx
19116 subl $1, %ebx
19117 sbb $0, %ecx
19118+
19119+#ifdef CONFIG_PAX_REFCOUNT
19120+ into
19121+1234:
19122+ _ASM_EXTABLE(1234b, 2f)
19123+#endif
19124+
19125 js 2f
19126 LOCK_PREFIX
19127 cmpxchg8b (%esi)
19128@@ -174,6 +235,13 @@ ENTRY(atomic64_add_unless_cx8)
19129 movl %edx, %ecx
19130 addl %esi, %ebx
19131 adcl %edi, %ecx
19132+
19133+#ifdef CONFIG_PAX_REFCOUNT
19134+ into
19135+1234:
19136+ _ASM_EXTABLE(1234b, 3f)
19137+#endif
19138+
19139 LOCK_PREFIX
19140 cmpxchg8b (%ebp)
19141 jne 1b
19142@@ -206,6 +274,13 @@ ENTRY(atomic64_inc_not_zero_cx8)
19143 movl %edx, %ecx
19144 addl $1, %ebx
19145 adcl $0, %ecx
19146+
19147+#ifdef CONFIG_PAX_REFCOUNT
19148+ into
19149+1234:
19150+ _ASM_EXTABLE(1234b, 3f)
19151+#endif
19152+
19153 LOCK_PREFIX
19154 cmpxchg8b (%esi)
19155 jne 1b
19156diff -urNp linux-2.6.39/arch/x86/lib/checksum_32.S linux-2.6.39/arch/x86/lib/checksum_32.S
19157--- linux-2.6.39/arch/x86/lib/checksum_32.S 2011-05-19 00:06:34.000000000 -0400
19158+++ linux-2.6.39/arch/x86/lib/checksum_32.S 2011-05-22 19:36:30.000000000 -0400
19159@@ -28,7 +28,8 @@
19160 #include <linux/linkage.h>
19161 #include <asm/dwarf2.h>
19162 #include <asm/errno.h>
19163-
19164+#include <asm/segment.h>
19165+
19166 /*
19167 * computes a partial checksum, e.g. for TCP/UDP fragments
19168 */
19169@@ -296,9 +297,24 @@ unsigned int csum_partial_copy_generic (
19170
19171 #define ARGBASE 16
19172 #define FP 12
19173-
19174-ENTRY(csum_partial_copy_generic)
19175+
19176+ENTRY(csum_partial_copy_generic_to_user)
19177 CFI_STARTPROC
19178+
19179+#ifdef CONFIG_PAX_MEMORY_UDEREF
19180+ pushl_cfi %gs
19181+ popl_cfi %es
19182+ jmp csum_partial_copy_generic
19183+#endif
19184+
19185+ENTRY(csum_partial_copy_generic_from_user)
19186+
19187+#ifdef CONFIG_PAX_MEMORY_UDEREF
19188+ pushl_cfi %gs
19189+ popl_cfi %ds
19190+#endif
19191+
19192+ENTRY(csum_partial_copy_generic)
19193 subl $4,%esp
19194 CFI_ADJUST_CFA_OFFSET 4
19195 pushl_cfi %edi
19196@@ -320,7 +336,7 @@ ENTRY(csum_partial_copy_generic)
19197 jmp 4f
19198 SRC(1: movw (%esi), %bx )
19199 addl $2, %esi
19200-DST( movw %bx, (%edi) )
19201+DST( movw %bx, %es:(%edi) )
19202 addl $2, %edi
19203 addw %bx, %ax
19204 adcl $0, %eax
19205@@ -332,30 +348,30 @@ DST( movw %bx, (%edi) )
19206 SRC(1: movl (%esi), %ebx )
19207 SRC( movl 4(%esi), %edx )
19208 adcl %ebx, %eax
19209-DST( movl %ebx, (%edi) )
19210+DST( movl %ebx, %es:(%edi) )
19211 adcl %edx, %eax
19212-DST( movl %edx, 4(%edi) )
19213+DST( movl %edx, %es:4(%edi) )
19214
19215 SRC( movl 8(%esi), %ebx )
19216 SRC( movl 12(%esi), %edx )
19217 adcl %ebx, %eax
19218-DST( movl %ebx, 8(%edi) )
19219+DST( movl %ebx, %es:8(%edi) )
19220 adcl %edx, %eax
19221-DST( movl %edx, 12(%edi) )
19222+DST( movl %edx, %es:12(%edi) )
19223
19224 SRC( movl 16(%esi), %ebx )
19225 SRC( movl 20(%esi), %edx )
19226 adcl %ebx, %eax
19227-DST( movl %ebx, 16(%edi) )
19228+DST( movl %ebx, %es:16(%edi) )
19229 adcl %edx, %eax
19230-DST( movl %edx, 20(%edi) )
19231+DST( movl %edx, %es:20(%edi) )
19232
19233 SRC( movl 24(%esi), %ebx )
19234 SRC( movl 28(%esi), %edx )
19235 adcl %ebx, %eax
19236-DST( movl %ebx, 24(%edi) )
19237+DST( movl %ebx, %es:24(%edi) )
19238 adcl %edx, %eax
19239-DST( movl %edx, 28(%edi) )
19240+DST( movl %edx, %es:28(%edi) )
19241
19242 lea 32(%esi), %esi
19243 lea 32(%edi), %edi
19244@@ -369,7 +385,7 @@ DST( movl %edx, 28(%edi) )
19245 shrl $2, %edx # This clears CF
19246 SRC(3: movl (%esi), %ebx )
19247 adcl %ebx, %eax
19248-DST( movl %ebx, (%edi) )
19249+DST( movl %ebx, %es:(%edi) )
19250 lea 4(%esi), %esi
19251 lea 4(%edi), %edi
19252 dec %edx
19253@@ -381,12 +397,12 @@ DST( movl %ebx, (%edi) )
19254 jb 5f
19255 SRC( movw (%esi), %cx )
19256 leal 2(%esi), %esi
19257-DST( movw %cx, (%edi) )
19258+DST( movw %cx, %es:(%edi) )
19259 leal 2(%edi), %edi
19260 je 6f
19261 shll $16,%ecx
19262 SRC(5: movb (%esi), %cl )
19263-DST( movb %cl, (%edi) )
19264+DST( movb %cl, %es:(%edi) )
19265 6: addl %ecx, %eax
19266 adcl $0, %eax
19267 7:
19268@@ -397,7 +413,7 @@ DST( movb %cl, (%edi) )
19269
19270 6001:
19271 movl ARGBASE+20(%esp), %ebx # src_err_ptr
19272- movl $-EFAULT, (%ebx)
19273+ movl $-EFAULT, %ss:(%ebx)
19274
19275 # zero the complete destination - computing the rest
19276 # is too much work
19277@@ -410,11 +426,15 @@ DST( movb %cl, (%edi) )
19278
19279 6002:
19280 movl ARGBASE+24(%esp), %ebx # dst_err_ptr
19281- movl $-EFAULT,(%ebx)
19282+ movl $-EFAULT,%ss:(%ebx)
19283 jmp 5000b
19284
19285 .previous
19286
19287+ pushl_cfi %ss
19288+ popl_cfi %ds
19289+ pushl_cfi %ss
19290+ popl_cfi %es
19291 popl_cfi %ebx
19292 CFI_RESTORE ebx
19293 popl_cfi %esi
19294@@ -424,26 +444,43 @@ DST( movb %cl, (%edi) )
19295 popl_cfi %ecx # equivalent to addl $4,%esp
19296 ret
19297 CFI_ENDPROC
19298-ENDPROC(csum_partial_copy_generic)
19299+ENDPROC(csum_partial_copy_generic_to_user)
19300
19301 #else
19302
19303 /* Version for PentiumII/PPro */
19304
19305 #define ROUND1(x) \
19306+ nop; nop; nop; \
19307 SRC(movl x(%esi), %ebx ) ; \
19308 addl %ebx, %eax ; \
19309- DST(movl %ebx, x(%edi) ) ;
19310+ DST(movl %ebx, %es:x(%edi)) ;
19311
19312 #define ROUND(x) \
19313+ nop; nop; nop; \
19314 SRC(movl x(%esi), %ebx ) ; \
19315 adcl %ebx, %eax ; \
19316- DST(movl %ebx, x(%edi) ) ;
19317+ DST(movl %ebx, %es:x(%edi)) ;
19318
19319 #define ARGBASE 12
19320-
19321-ENTRY(csum_partial_copy_generic)
19322+
19323+ENTRY(csum_partial_copy_generic_to_user)
19324 CFI_STARTPROC
19325+
19326+#ifdef CONFIG_PAX_MEMORY_UDEREF
19327+ pushl_cfi %gs
19328+ popl_cfi %es
19329+ jmp csum_partial_copy_generic
19330+#endif
19331+
19332+ENTRY(csum_partial_copy_generic_from_user)
19333+
19334+#ifdef CONFIG_PAX_MEMORY_UDEREF
19335+ pushl_cfi %gs
19336+ popl_cfi %ds
19337+#endif
19338+
19339+ENTRY(csum_partial_copy_generic)
19340 pushl_cfi %ebx
19341 CFI_REL_OFFSET ebx, 0
19342 pushl_cfi %edi
19343@@ -464,7 +501,7 @@ ENTRY(csum_partial_copy_generic)
19344 subl %ebx, %edi
19345 lea -1(%esi),%edx
19346 andl $-32,%edx
19347- lea 3f(%ebx,%ebx), %ebx
19348+ lea 3f(%ebx,%ebx,2), %ebx
19349 testl %esi, %esi
19350 jmp *%ebx
19351 1: addl $64,%esi
19352@@ -485,19 +522,19 @@ ENTRY(csum_partial_copy_generic)
19353 jb 5f
19354 SRC( movw (%esi), %dx )
19355 leal 2(%esi), %esi
19356-DST( movw %dx, (%edi) )
19357+DST( movw %dx, %es:(%edi) )
19358 leal 2(%edi), %edi
19359 je 6f
19360 shll $16,%edx
19361 5:
19362 SRC( movb (%esi), %dl )
19363-DST( movb %dl, (%edi) )
19364+DST( movb %dl, %es:(%edi) )
19365 6: addl %edx, %eax
19366 adcl $0, %eax
19367 7:
19368 .section .fixup, "ax"
19369 6001: movl ARGBASE+20(%esp), %ebx # src_err_ptr
19370- movl $-EFAULT, (%ebx)
19371+ movl $-EFAULT, %ss:(%ebx)
19372 # zero the complete destination (computing the rest is too much work)
19373 movl ARGBASE+8(%esp),%edi # dst
19374 movl ARGBASE+12(%esp),%ecx # len
19375@@ -505,10 +542,17 @@ DST( movb %dl, (%edi) )
19376 rep; stosb
19377 jmp 7b
19378 6002: movl ARGBASE+24(%esp), %ebx # dst_err_ptr
19379- movl $-EFAULT, (%ebx)
19380+ movl $-EFAULT, %ss:(%ebx)
19381 jmp 7b
19382 .previous
19383
19384+#ifdef CONFIG_PAX_MEMORY_UDEREF
19385+ pushl_cfi %ss
19386+ popl_cfi %ds
19387+ pushl_cfi %ss
19388+ popl_cfi %es
19389+#endif
19390+
19391 popl_cfi %esi
19392 CFI_RESTORE esi
19393 popl_cfi %edi
19394@@ -517,7 +561,7 @@ DST( movb %dl, (%edi) )
19395 CFI_RESTORE ebx
19396 ret
19397 CFI_ENDPROC
19398-ENDPROC(csum_partial_copy_generic)
19399+ENDPROC(csum_partial_copy_generic_to_user)
19400
19401 #undef ROUND
19402 #undef ROUND1
19403diff -urNp linux-2.6.39/arch/x86/lib/clear_page_64.S linux-2.6.39/arch/x86/lib/clear_page_64.S
19404--- linux-2.6.39/arch/x86/lib/clear_page_64.S 2011-05-19 00:06:34.000000000 -0400
19405+++ linux-2.6.39/arch/x86/lib/clear_page_64.S 2011-05-22 19:36:30.000000000 -0400
19406@@ -43,7 +43,7 @@ ENDPROC(clear_page)
19407
19408 #include <asm/cpufeature.h>
19409
19410- .section .altinstr_replacement,"ax"
19411+ .section .altinstr_replacement,"a"
19412 1: .byte 0xeb /* jmp <disp8> */
19413 .byte (clear_page_c - clear_page) - (2f - 1b) /* offset */
19414 2:
19415diff -urNp linux-2.6.39/arch/x86/lib/copy_page_64.S linux-2.6.39/arch/x86/lib/copy_page_64.S
19416--- linux-2.6.39/arch/x86/lib/copy_page_64.S 2011-05-19 00:06:34.000000000 -0400
19417+++ linux-2.6.39/arch/x86/lib/copy_page_64.S 2011-05-22 19:36:30.000000000 -0400
19418@@ -104,7 +104,7 @@ ENDPROC(copy_page)
19419
19420 #include <asm/cpufeature.h>
19421
19422- .section .altinstr_replacement,"ax"
19423+ .section .altinstr_replacement,"a"
19424 1: .byte 0xeb /* jmp <disp8> */
19425 .byte (copy_page_c - copy_page) - (2f - 1b) /* offset */
19426 2:
19427diff -urNp linux-2.6.39/arch/x86/lib/copy_user_64.S linux-2.6.39/arch/x86/lib/copy_user_64.S
19428--- linux-2.6.39/arch/x86/lib/copy_user_64.S 2011-05-19 00:06:34.000000000 -0400
19429+++ linux-2.6.39/arch/x86/lib/copy_user_64.S 2011-05-22 19:36:30.000000000 -0400
19430@@ -15,13 +15,14 @@
19431 #include <asm/asm-offsets.h>
19432 #include <asm/thread_info.h>
19433 #include <asm/cpufeature.h>
19434+#include <asm/pgtable.h>
19435
19436 .macro ALTERNATIVE_JUMP feature,orig,alt
19437 0:
19438 .byte 0xe9 /* 32bit jump */
19439 .long \orig-1f /* by default jump to orig */
19440 1:
19441- .section .altinstr_replacement,"ax"
19442+ .section .altinstr_replacement,"a"
19443 2: .byte 0xe9 /* near jump with 32bit immediate */
19444 .long \alt-1b /* offset */ /* or alternatively to alt */
19445 .previous
19446@@ -64,37 +65,13 @@
19447 #endif
19448 .endm
19449
19450-/* Standard copy_to_user with segment limit checking */
19451-ENTRY(_copy_to_user)
19452- CFI_STARTPROC
19453- GET_THREAD_INFO(%rax)
19454- movq %rdi,%rcx
19455- addq %rdx,%rcx
19456- jc bad_to_user
19457- cmpq TI_addr_limit(%rax),%rcx
19458- jae bad_to_user
19459- ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string
19460- CFI_ENDPROC
19461-ENDPROC(_copy_to_user)
19462-
19463-/* Standard copy_from_user with segment limit checking */
19464-ENTRY(_copy_from_user)
19465- CFI_STARTPROC
19466- GET_THREAD_INFO(%rax)
19467- movq %rsi,%rcx
19468- addq %rdx,%rcx
19469- jc bad_from_user
19470- cmpq TI_addr_limit(%rax),%rcx
19471- jae bad_from_user
19472- ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string
19473- CFI_ENDPROC
19474-ENDPROC(_copy_from_user)
19475-
19476 .section .fixup,"ax"
19477 /* must zero dest */
19478 ENTRY(bad_from_user)
19479 bad_from_user:
19480 CFI_STARTPROC
19481+ testl %edx,%edx
19482+ js bad_to_user
19483 movl %edx,%ecx
19484 xorl %eax,%eax
19485 rep
19486diff -urNp linux-2.6.39/arch/x86/lib/copy_user_nocache_64.S linux-2.6.39/arch/x86/lib/copy_user_nocache_64.S
19487--- linux-2.6.39/arch/x86/lib/copy_user_nocache_64.S 2011-05-19 00:06:34.000000000 -0400
19488+++ linux-2.6.39/arch/x86/lib/copy_user_nocache_64.S 2011-05-22 19:36:30.000000000 -0400
19489@@ -14,6 +14,7 @@
19490 #include <asm/current.h>
19491 #include <asm/asm-offsets.h>
19492 #include <asm/thread_info.h>
19493+#include <asm/pgtable.h>
19494
19495 .macro ALIGN_DESTINATION
19496 #ifdef FIX_ALIGNMENT
19497@@ -50,6 +51,15 @@
19498 */
19499 ENTRY(__copy_user_nocache)
19500 CFI_STARTPROC
19501+
19502+#ifdef CONFIG_PAX_MEMORY_UDEREF
19503+ mov $PAX_USER_SHADOW_BASE,%rcx
19504+ cmp %rcx,%rsi
19505+ jae 1f
19506+ add %rcx,%rsi
19507+1:
19508+#endif
19509+
19510 cmpl $8,%edx
19511 jb 20f /* less then 8 bytes, go to byte copy loop */
19512 ALIGN_DESTINATION
19513diff -urNp linux-2.6.39/arch/x86/lib/csum-wrappers_64.c linux-2.6.39/arch/x86/lib/csum-wrappers_64.c
19514--- linux-2.6.39/arch/x86/lib/csum-wrappers_64.c 2011-05-19 00:06:34.000000000 -0400
19515+++ linux-2.6.39/arch/x86/lib/csum-wrappers_64.c 2011-05-22 19:36:30.000000000 -0400
19516@@ -52,6 +52,12 @@ csum_partial_copy_from_user(const void _
19517 len -= 2;
19518 }
19519 }
19520+
19521+#ifdef CONFIG_PAX_MEMORY_UDEREF
19522+ if ((unsigned long)src < PAX_USER_SHADOW_BASE)
19523+ src += PAX_USER_SHADOW_BASE;
19524+#endif
19525+
19526 isum = csum_partial_copy_generic((__force const void *)src,
19527 dst, len, isum, errp, NULL);
19528 if (unlikely(*errp))
19529@@ -105,6 +111,12 @@ csum_partial_copy_to_user(const void *sr
19530 }
19531
19532 *errp = 0;
19533+
19534+#ifdef CONFIG_PAX_MEMORY_UDEREF
19535+ if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
19536+ dst += PAX_USER_SHADOW_BASE;
19537+#endif
19538+
19539 return csum_partial_copy_generic(src, (void __force *)dst,
19540 len, isum, NULL, errp);
19541 }
19542diff -urNp linux-2.6.39/arch/x86/lib/getuser.S linux-2.6.39/arch/x86/lib/getuser.S
19543--- linux-2.6.39/arch/x86/lib/getuser.S 2011-05-19 00:06:34.000000000 -0400
19544+++ linux-2.6.39/arch/x86/lib/getuser.S 2011-05-22 19:36:30.000000000 -0400
19545@@ -33,14 +33,35 @@
19546 #include <asm/asm-offsets.h>
19547 #include <asm/thread_info.h>
19548 #include <asm/asm.h>
19549+#include <asm/segment.h>
19550+#include <asm/pgtable.h>
19551+
19552+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
19553+#define __copyuser_seg gs;
19554+#else
19555+#define __copyuser_seg
19556+#endif
19557
19558 .text
19559 ENTRY(__get_user_1)
19560 CFI_STARTPROC
19561+
19562+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
19563 GET_THREAD_INFO(%_ASM_DX)
19564 cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
19565 jae bad_get_user
19566-1: movzb (%_ASM_AX),%edx
19567+
19568+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
19569+ mov $PAX_USER_SHADOW_BASE,%_ASM_DX
19570+ cmp %_ASM_DX,%_ASM_AX
19571+ jae 1234f
19572+ add %_ASM_DX,%_ASM_AX
19573+1234:
19574+#endif
19575+
19576+#endif
19577+
19578+1: __copyuser_seg movzb (%_ASM_AX),%edx
19579 xor %eax,%eax
19580 ret
19581 CFI_ENDPROC
19582@@ -49,11 +70,24 @@ ENDPROC(__get_user_1)
19583 ENTRY(__get_user_2)
19584 CFI_STARTPROC
19585 add $1,%_ASM_AX
19586+
19587+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
19588 jc bad_get_user
19589 GET_THREAD_INFO(%_ASM_DX)
19590 cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
19591 jae bad_get_user
19592-2: movzwl -1(%_ASM_AX),%edx
19593+
19594+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
19595+ mov $PAX_USER_SHADOW_BASE,%_ASM_DX
19596+ cmp %_ASM_DX,%_ASM_AX
19597+ jae 1234f
19598+ add %_ASM_DX,%_ASM_AX
19599+1234:
19600+#endif
19601+
19602+#endif
19603+
19604+2: __copyuser_seg movzwl -1(%_ASM_AX),%edx
19605 xor %eax,%eax
19606 ret
19607 CFI_ENDPROC
19608@@ -62,11 +96,24 @@ ENDPROC(__get_user_2)
19609 ENTRY(__get_user_4)
19610 CFI_STARTPROC
19611 add $3,%_ASM_AX
19612+
19613+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
19614 jc bad_get_user
19615 GET_THREAD_INFO(%_ASM_DX)
19616 cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
19617 jae bad_get_user
19618-3: mov -3(%_ASM_AX),%edx
19619+
19620+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
19621+ mov $PAX_USER_SHADOW_BASE,%_ASM_DX
19622+ cmp %_ASM_DX,%_ASM_AX
19623+ jae 1234f
19624+ add %_ASM_DX,%_ASM_AX
19625+1234:
19626+#endif
19627+
19628+#endif
19629+
19630+3: __copyuser_seg mov -3(%_ASM_AX),%edx
19631 xor %eax,%eax
19632 ret
19633 CFI_ENDPROC
19634@@ -80,6 +127,15 @@ ENTRY(__get_user_8)
19635 GET_THREAD_INFO(%_ASM_DX)
19636 cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
19637 jae bad_get_user
19638+
19639+#ifdef CONFIG_PAX_MEMORY_UDEREF
19640+ mov $PAX_USER_SHADOW_BASE,%_ASM_DX
19641+ cmp %_ASM_DX,%_ASM_AX
19642+ jae 1234f
19643+ add %_ASM_DX,%_ASM_AX
19644+1234:
19645+#endif
19646+
19647 4: movq -7(%_ASM_AX),%_ASM_DX
19648 xor %eax,%eax
19649 ret
19650diff -urNp linux-2.6.39/arch/x86/lib/insn.c linux-2.6.39/arch/x86/lib/insn.c
19651--- linux-2.6.39/arch/x86/lib/insn.c 2011-05-19 00:06:34.000000000 -0400
19652+++ linux-2.6.39/arch/x86/lib/insn.c 2011-05-22 19:36:30.000000000 -0400
19653@@ -21,6 +21,11 @@
19654 #include <linux/string.h>
19655 #include <asm/inat.h>
19656 #include <asm/insn.h>
19657+#ifdef __KERNEL__
19658+#include <asm/pgtable_types.h>
19659+#else
19660+#define ktla_ktva(addr) addr
19661+#endif
19662
19663 #define get_next(t, insn) \
19664 ({t r; r = *(t*)insn->next_byte; insn->next_byte += sizeof(t); r; })
19665@@ -40,8 +45,8 @@
19666 void insn_init(struct insn *insn, const void *kaddr, int x86_64)
19667 {
19668 memset(insn, 0, sizeof(*insn));
19669- insn->kaddr = kaddr;
19670- insn->next_byte = kaddr;
19671+ insn->kaddr = ktla_ktva(kaddr);
19672+ insn->next_byte = ktla_ktva(kaddr);
19673 insn->x86_64 = x86_64 ? 1 : 0;
19674 insn->opnd_bytes = 4;
19675 if (x86_64)
19676diff -urNp linux-2.6.39/arch/x86/lib/mmx_32.c linux-2.6.39/arch/x86/lib/mmx_32.c
19677--- linux-2.6.39/arch/x86/lib/mmx_32.c 2011-05-19 00:06:34.000000000 -0400
19678+++ linux-2.6.39/arch/x86/lib/mmx_32.c 2011-05-22 19:36:30.000000000 -0400
19679@@ -29,6 +29,7 @@ void *_mmx_memcpy(void *to, const void *
19680 {
19681 void *p;
19682 int i;
19683+ unsigned long cr0;
19684
19685 if (unlikely(in_interrupt()))
19686 return __memcpy(to, from, len);
19687@@ -39,44 +40,72 @@ void *_mmx_memcpy(void *to, const void *
19688 kernel_fpu_begin();
19689
19690 __asm__ __volatile__ (
19691- "1: prefetch (%0)\n" /* This set is 28 bytes */
19692- " prefetch 64(%0)\n"
19693- " prefetch 128(%0)\n"
19694- " prefetch 192(%0)\n"
19695- " prefetch 256(%0)\n"
19696+ "1: prefetch (%1)\n" /* This set is 28 bytes */
19697+ " prefetch 64(%1)\n"
19698+ " prefetch 128(%1)\n"
19699+ " prefetch 192(%1)\n"
19700+ " prefetch 256(%1)\n"
19701 "2: \n"
19702 ".section .fixup, \"ax\"\n"
19703- "3: movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
19704+ "3: \n"
19705+
19706+#ifdef CONFIG_PAX_KERNEXEC
19707+ " movl %%cr0, %0\n"
19708+ " movl %0, %%eax\n"
19709+ " andl $0xFFFEFFFF, %%eax\n"
19710+ " movl %%eax, %%cr0\n"
19711+#endif
19712+
19713+ " movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
19714+
19715+#ifdef CONFIG_PAX_KERNEXEC
19716+ " movl %0, %%cr0\n"
19717+#endif
19718+
19719 " jmp 2b\n"
19720 ".previous\n"
19721 _ASM_EXTABLE(1b, 3b)
19722- : : "r" (from));
19723+ : "=&r" (cr0) : "r" (from) : "ax");
19724
19725 for ( ; i > 5; i--) {
19726 __asm__ __volatile__ (
19727- "1: prefetch 320(%0)\n"
19728- "2: movq (%0), %%mm0\n"
19729- " movq 8(%0), %%mm1\n"
19730- " movq 16(%0), %%mm2\n"
19731- " movq 24(%0), %%mm3\n"
19732- " movq %%mm0, (%1)\n"
19733- " movq %%mm1, 8(%1)\n"
19734- " movq %%mm2, 16(%1)\n"
19735- " movq %%mm3, 24(%1)\n"
19736- " movq 32(%0), %%mm0\n"
19737- " movq 40(%0), %%mm1\n"
19738- " movq 48(%0), %%mm2\n"
19739- " movq 56(%0), %%mm3\n"
19740- " movq %%mm0, 32(%1)\n"
19741- " movq %%mm1, 40(%1)\n"
19742- " movq %%mm2, 48(%1)\n"
19743- " movq %%mm3, 56(%1)\n"
19744+ "1: prefetch 320(%1)\n"
19745+ "2: movq (%1), %%mm0\n"
19746+ " movq 8(%1), %%mm1\n"
19747+ " movq 16(%1), %%mm2\n"
19748+ " movq 24(%1), %%mm3\n"
19749+ " movq %%mm0, (%2)\n"
19750+ " movq %%mm1, 8(%2)\n"
19751+ " movq %%mm2, 16(%2)\n"
19752+ " movq %%mm3, 24(%2)\n"
19753+ " movq 32(%1), %%mm0\n"
19754+ " movq 40(%1), %%mm1\n"
19755+ " movq 48(%1), %%mm2\n"
19756+ " movq 56(%1), %%mm3\n"
19757+ " movq %%mm0, 32(%2)\n"
19758+ " movq %%mm1, 40(%2)\n"
19759+ " movq %%mm2, 48(%2)\n"
19760+ " movq %%mm3, 56(%2)\n"
19761 ".section .fixup, \"ax\"\n"
19762- "3: movw $0x05EB, 1b\n" /* jmp on 5 bytes */
19763+ "3:\n"
19764+
19765+#ifdef CONFIG_PAX_KERNEXEC
19766+ " movl %%cr0, %0\n"
19767+ " movl %0, %%eax\n"
19768+ " andl $0xFFFEFFFF, %%eax\n"
19769+ " movl %%eax, %%cr0\n"
19770+#endif
19771+
19772+ " movw $0x05EB, 1b\n" /* jmp on 5 bytes */
19773+
19774+#ifdef CONFIG_PAX_KERNEXEC
19775+ " movl %0, %%cr0\n"
19776+#endif
19777+
19778 " jmp 2b\n"
19779 ".previous\n"
19780 _ASM_EXTABLE(1b, 3b)
19781- : : "r" (from), "r" (to) : "memory");
19782+ : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
19783
19784 from += 64;
19785 to += 64;
19786@@ -158,6 +187,7 @@ static void fast_clear_page(void *page)
19787 static void fast_copy_page(void *to, void *from)
19788 {
19789 int i;
19790+ unsigned long cr0;
19791
19792 kernel_fpu_begin();
19793
19794@@ -166,42 +196,70 @@ static void fast_copy_page(void *to, voi
19795 * but that is for later. -AV
19796 */
19797 __asm__ __volatile__(
19798- "1: prefetch (%0)\n"
19799- " prefetch 64(%0)\n"
19800- " prefetch 128(%0)\n"
19801- " prefetch 192(%0)\n"
19802- " prefetch 256(%0)\n"
19803+ "1: prefetch (%1)\n"
19804+ " prefetch 64(%1)\n"
19805+ " prefetch 128(%1)\n"
19806+ " prefetch 192(%1)\n"
19807+ " prefetch 256(%1)\n"
19808 "2: \n"
19809 ".section .fixup, \"ax\"\n"
19810- "3: movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
19811+ "3: \n"
19812+
19813+#ifdef CONFIG_PAX_KERNEXEC
19814+ " movl %%cr0, %0\n"
19815+ " movl %0, %%eax\n"
19816+ " andl $0xFFFEFFFF, %%eax\n"
19817+ " movl %%eax, %%cr0\n"
19818+#endif
19819+
19820+ " movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
19821+
19822+#ifdef CONFIG_PAX_KERNEXEC
19823+ " movl %0, %%cr0\n"
19824+#endif
19825+
19826 " jmp 2b\n"
19827 ".previous\n"
19828- _ASM_EXTABLE(1b, 3b) : : "r" (from));
19829+ _ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from) : "ax");
19830
19831 for (i = 0; i < (4096-320)/64; i++) {
19832 __asm__ __volatile__ (
19833- "1: prefetch 320(%0)\n"
19834- "2: movq (%0), %%mm0\n"
19835- " movntq %%mm0, (%1)\n"
19836- " movq 8(%0), %%mm1\n"
19837- " movntq %%mm1, 8(%1)\n"
19838- " movq 16(%0), %%mm2\n"
19839- " movntq %%mm2, 16(%1)\n"
19840- " movq 24(%0), %%mm3\n"
19841- " movntq %%mm3, 24(%1)\n"
19842- " movq 32(%0), %%mm4\n"
19843- " movntq %%mm4, 32(%1)\n"
19844- " movq 40(%0), %%mm5\n"
19845- " movntq %%mm5, 40(%1)\n"
19846- " movq 48(%0), %%mm6\n"
19847- " movntq %%mm6, 48(%1)\n"
19848- " movq 56(%0), %%mm7\n"
19849- " movntq %%mm7, 56(%1)\n"
19850+ "1: prefetch 320(%1)\n"
19851+ "2: movq (%1), %%mm0\n"
19852+ " movntq %%mm0, (%2)\n"
19853+ " movq 8(%1), %%mm1\n"
19854+ " movntq %%mm1, 8(%2)\n"
19855+ " movq 16(%1), %%mm2\n"
19856+ " movntq %%mm2, 16(%2)\n"
19857+ " movq 24(%1), %%mm3\n"
19858+ " movntq %%mm3, 24(%2)\n"
19859+ " movq 32(%1), %%mm4\n"
19860+ " movntq %%mm4, 32(%2)\n"
19861+ " movq 40(%1), %%mm5\n"
19862+ " movntq %%mm5, 40(%2)\n"
19863+ " movq 48(%1), %%mm6\n"
19864+ " movntq %%mm6, 48(%2)\n"
19865+ " movq 56(%1), %%mm7\n"
19866+ " movntq %%mm7, 56(%2)\n"
19867 ".section .fixup, \"ax\"\n"
19868- "3: movw $0x05EB, 1b\n" /* jmp on 5 bytes */
19869+ "3:\n"
19870+
19871+#ifdef CONFIG_PAX_KERNEXEC
19872+ " movl %%cr0, %0\n"
19873+ " movl %0, %%eax\n"
19874+ " andl $0xFFFEFFFF, %%eax\n"
19875+ " movl %%eax, %%cr0\n"
19876+#endif
19877+
19878+ " movw $0x05EB, 1b\n" /* jmp on 5 bytes */
19879+
19880+#ifdef CONFIG_PAX_KERNEXEC
19881+ " movl %0, %%cr0\n"
19882+#endif
19883+
19884 " jmp 2b\n"
19885 ".previous\n"
19886- _ASM_EXTABLE(1b, 3b) : : "r" (from), "r" (to) : "memory");
19887+ _ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
19888
19889 from += 64;
19890 to += 64;
19891@@ -280,47 +338,76 @@ static void fast_clear_page(void *page)
19892 static void fast_copy_page(void *to, void *from)
19893 {
19894 int i;
19895+ unsigned long cr0;
19896
19897 kernel_fpu_begin();
19898
19899 __asm__ __volatile__ (
19900- "1: prefetch (%0)\n"
19901- " prefetch 64(%0)\n"
19902- " prefetch 128(%0)\n"
19903- " prefetch 192(%0)\n"
19904- " prefetch 256(%0)\n"
19905+ "1: prefetch (%1)\n"
19906+ " prefetch 64(%1)\n"
19907+ " prefetch 128(%1)\n"
19908+ " prefetch 192(%1)\n"
19909+ " prefetch 256(%1)\n"
19910 "2: \n"
19911 ".section .fixup, \"ax\"\n"
19912- "3: movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
19913+ "3: \n"
19914+
19915+#ifdef CONFIG_PAX_KERNEXEC
19916+ " movl %%cr0, %0\n"
19917+ " movl %0, %%eax\n"
19918+ " andl $0xFFFEFFFF, %%eax\n"
19919+ " movl %%eax, %%cr0\n"
19920+#endif
19921+
19922+ " movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
19923+
19924+#ifdef CONFIG_PAX_KERNEXEC
19925+ " movl %0, %%cr0\n"
19926+#endif
19927+
19928 " jmp 2b\n"
19929 ".previous\n"
19930- _ASM_EXTABLE(1b, 3b) : : "r" (from));
19931+ _ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from) : "ax");
19932
19933 for (i = 0; i < 4096/64; i++) {
19934 __asm__ __volatile__ (
19935- "1: prefetch 320(%0)\n"
19936- "2: movq (%0), %%mm0\n"
19937- " movq 8(%0), %%mm1\n"
19938- " movq 16(%0), %%mm2\n"
19939- " movq 24(%0), %%mm3\n"
19940- " movq %%mm0, (%1)\n"
19941- " movq %%mm1, 8(%1)\n"
19942- " movq %%mm2, 16(%1)\n"
19943- " movq %%mm3, 24(%1)\n"
19944- " movq 32(%0), %%mm0\n"
19945- " movq 40(%0), %%mm1\n"
19946- " movq 48(%0), %%mm2\n"
19947- " movq 56(%0), %%mm3\n"
19948- " movq %%mm0, 32(%1)\n"
19949- " movq %%mm1, 40(%1)\n"
19950- " movq %%mm2, 48(%1)\n"
19951- " movq %%mm3, 56(%1)\n"
19952+ "1: prefetch 320(%1)\n"
19953+ "2: movq (%1), %%mm0\n"
19954+ " movq 8(%1), %%mm1\n"
19955+ " movq 16(%1), %%mm2\n"
19956+ " movq 24(%1), %%mm3\n"
19957+ " movq %%mm0, (%2)\n"
19958+ " movq %%mm1, 8(%2)\n"
19959+ " movq %%mm2, 16(%2)\n"
19960+ " movq %%mm3, 24(%2)\n"
19961+ " movq 32(%1), %%mm0\n"
19962+ " movq 40(%1), %%mm1\n"
19963+ " movq 48(%1), %%mm2\n"
19964+ " movq 56(%1), %%mm3\n"
19965+ " movq %%mm0, 32(%2)\n"
19966+ " movq %%mm1, 40(%2)\n"
19967+ " movq %%mm2, 48(%2)\n"
19968+ " movq %%mm3, 56(%2)\n"
19969 ".section .fixup, \"ax\"\n"
19970- "3: movw $0x05EB, 1b\n" /* jmp on 5 bytes */
19971+ "3:\n"
19972+
19973+#ifdef CONFIG_PAX_KERNEXEC
19974+ " movl %%cr0, %0\n"
19975+ " movl %0, %%eax\n"
19976+ " andl $0xFFFEFFFF, %%eax\n"
19977+ " movl %%eax, %%cr0\n"
19978+#endif
19979+
19980+ " movw $0x05EB, 1b\n" /* jmp on 5 bytes */
19981+
19982+#ifdef CONFIG_PAX_KERNEXEC
19983+ " movl %0, %%cr0\n"
19984+#endif
19985+
19986 " jmp 2b\n"
19987 ".previous\n"
19988 _ASM_EXTABLE(1b, 3b)
19989- : : "r" (from), "r" (to) : "memory");
19990+ : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
19991
19992 from += 64;
19993 to += 64;
19994diff -urNp linux-2.6.39/arch/x86/lib/putuser.S linux-2.6.39/arch/x86/lib/putuser.S
19995--- linux-2.6.39/arch/x86/lib/putuser.S 2011-05-19 00:06:34.000000000 -0400
19996+++ linux-2.6.39/arch/x86/lib/putuser.S 2011-05-22 19:36:30.000000000 -0400
19997@@ -15,7 +15,8 @@
19998 #include <asm/thread_info.h>
19999 #include <asm/errno.h>
20000 #include <asm/asm.h>
20001-
20002+#include <asm/segment.h>
20003+#include <asm/pgtable.h>
20004
20005 /*
20006 * __put_user_X
20007@@ -29,52 +30,119 @@
20008 * as they get called from within inline assembly.
20009 */
20010
20011-#define ENTER CFI_STARTPROC ; \
20012- GET_THREAD_INFO(%_ASM_BX)
20013+#define ENTER CFI_STARTPROC
20014 #define EXIT ret ; \
20015 CFI_ENDPROC
20016
20017+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
20018+#define _DEST %_ASM_CX,%_ASM_BX
20019+#else
20020+#define _DEST %_ASM_CX
20021+#endif
20022+
20023+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
20024+#define __copyuser_seg gs;
20025+#else
20026+#define __copyuser_seg
20027+#endif
20028+
20029 .text
20030 ENTRY(__put_user_1)
20031 ENTER
20032+
20033+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
20034+ GET_THREAD_INFO(%_ASM_BX)
20035 cmp TI_addr_limit(%_ASM_BX),%_ASM_CX
20036 jae bad_put_user
20037-1: movb %al,(%_ASM_CX)
20038+
20039+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
20040+ mov $PAX_USER_SHADOW_BASE,%_ASM_BX
20041+ cmp %_ASM_BX,%_ASM_CX
20042+ jb 1234f
20043+ xor %ebx,%ebx
20044+1234:
20045+#endif
20046+
20047+#endif
20048+
20049+1: __copyuser_seg movb %al,(_DEST)
20050 xor %eax,%eax
20051 EXIT
20052 ENDPROC(__put_user_1)
20053
20054 ENTRY(__put_user_2)
20055 ENTER
20056+
20057+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
20058+ GET_THREAD_INFO(%_ASM_BX)
20059 mov TI_addr_limit(%_ASM_BX),%_ASM_BX
20060 sub $1,%_ASM_BX
20061 cmp %_ASM_BX,%_ASM_CX
20062 jae bad_put_user
20063-2: movw %ax,(%_ASM_CX)
20064+
20065+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
20066+ mov $PAX_USER_SHADOW_BASE,%_ASM_BX
20067+ cmp %_ASM_BX,%_ASM_CX
20068+ jb 1234f
20069+ xor %ebx,%ebx
20070+1234:
20071+#endif
20072+
20073+#endif
20074+
20075+2: __copyuser_seg movw %ax,(_DEST)
20076 xor %eax,%eax
20077 EXIT
20078 ENDPROC(__put_user_2)
20079
20080 ENTRY(__put_user_4)
20081 ENTER
20082+
20083+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
20084+ GET_THREAD_INFO(%_ASM_BX)
20085 mov TI_addr_limit(%_ASM_BX),%_ASM_BX
20086 sub $3,%_ASM_BX
20087 cmp %_ASM_BX,%_ASM_CX
20088 jae bad_put_user
20089-3: movl %eax,(%_ASM_CX)
20090+
20091+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
20092+ mov $PAX_USER_SHADOW_BASE,%_ASM_BX
20093+ cmp %_ASM_BX,%_ASM_CX
20094+ jb 1234f
20095+ xor %ebx,%ebx
20096+1234:
20097+#endif
20098+
20099+#endif
20100+
20101+3: __copyuser_seg movl %eax,(_DEST)
20102 xor %eax,%eax
20103 EXIT
20104 ENDPROC(__put_user_4)
20105
20106 ENTRY(__put_user_8)
20107 ENTER
20108+
20109+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
20110+ GET_THREAD_INFO(%_ASM_BX)
20111 mov TI_addr_limit(%_ASM_BX),%_ASM_BX
20112 sub $7,%_ASM_BX
20113 cmp %_ASM_BX,%_ASM_CX
20114 jae bad_put_user
20115-4: mov %_ASM_AX,(%_ASM_CX)
20116+
20117+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
20118+ mov $PAX_USER_SHADOW_BASE,%_ASM_BX
20119+ cmp %_ASM_BX,%_ASM_CX
20120+ jb 1234f
20121+ xor %ebx,%ebx
20122+1234:
20123+#endif
20124+
20125+#endif
20126+
20127+4: __copyuser_seg mov %_ASM_AX,(_DEST)
20128 #ifdef CONFIG_X86_32
20129-5: movl %edx,4(%_ASM_CX)
20130+5: __copyuser_seg movl %edx,4(_DEST)
20131 #endif
20132 xor %eax,%eax
20133 EXIT
20134diff -urNp linux-2.6.39/arch/x86/lib/usercopy_32.c linux-2.6.39/arch/x86/lib/usercopy_32.c
20135--- linux-2.6.39/arch/x86/lib/usercopy_32.c 2011-05-19 00:06:34.000000000 -0400
20136+++ linux-2.6.39/arch/x86/lib/usercopy_32.c 2011-05-22 19:36:30.000000000 -0400
20137@@ -43,7 +43,7 @@ do { \
20138 __asm__ __volatile__( \
20139 " testl %1,%1\n" \
20140 " jz 2f\n" \
20141- "0: lodsb\n" \
20142+ "0: "__copyuser_seg"lodsb\n" \
20143 " stosb\n" \
20144 " testb %%al,%%al\n" \
20145 " jz 1f\n" \
20146@@ -128,10 +128,12 @@ do { \
20147 int __d0; \
20148 might_fault(); \
20149 __asm__ __volatile__( \
20150+ __COPYUSER_SET_ES \
20151 "0: rep; stosl\n" \
20152 " movl %2,%0\n" \
20153 "1: rep; stosb\n" \
20154 "2:\n" \
20155+ __COPYUSER_RESTORE_ES \
20156 ".section .fixup,\"ax\"\n" \
20157 "3: lea 0(%2,%0,4),%0\n" \
20158 " jmp 2b\n" \
20159@@ -200,6 +202,7 @@ long strnlen_user(const char __user *s,
20160 might_fault();
20161
20162 __asm__ __volatile__(
20163+ __COPYUSER_SET_ES
20164 " testl %0, %0\n"
20165 " jz 3f\n"
20166 " andl %0,%%ecx\n"
20167@@ -208,6 +211,7 @@ long strnlen_user(const char __user *s,
20168 " subl %%ecx,%0\n"
20169 " addl %0,%%eax\n"
20170 "1:\n"
20171+ __COPYUSER_RESTORE_ES
20172 ".section .fixup,\"ax\"\n"
20173 "2: xorl %%eax,%%eax\n"
20174 " jmp 1b\n"
20175@@ -227,7 +231,7 @@ EXPORT_SYMBOL(strnlen_user);
20176
20177 #ifdef CONFIG_X86_INTEL_USERCOPY
20178 static unsigned long
20179-__copy_user_intel(void __user *to, const void *from, unsigned long size)
20180+__generic_copy_to_user_intel(void __user *to, const void *from, unsigned long size)
20181 {
20182 int d0, d1;
20183 __asm__ __volatile__(
20184@@ -239,36 +243,36 @@ __copy_user_intel(void __user *to, const
20185 " .align 2,0x90\n"
20186 "3: movl 0(%4), %%eax\n"
20187 "4: movl 4(%4), %%edx\n"
20188- "5: movl %%eax, 0(%3)\n"
20189- "6: movl %%edx, 4(%3)\n"
20190+ "5: "__copyuser_seg" movl %%eax, 0(%3)\n"
20191+ "6: "__copyuser_seg" movl %%edx, 4(%3)\n"
20192 "7: movl 8(%4), %%eax\n"
20193 "8: movl 12(%4),%%edx\n"
20194- "9: movl %%eax, 8(%3)\n"
20195- "10: movl %%edx, 12(%3)\n"
20196+ "9: "__copyuser_seg" movl %%eax, 8(%3)\n"
20197+ "10: "__copyuser_seg" movl %%edx, 12(%3)\n"
20198 "11: movl 16(%4), %%eax\n"
20199 "12: movl 20(%4), %%edx\n"
20200- "13: movl %%eax, 16(%3)\n"
20201- "14: movl %%edx, 20(%3)\n"
20202+ "13: "__copyuser_seg" movl %%eax, 16(%3)\n"
20203+ "14: "__copyuser_seg" movl %%edx, 20(%3)\n"
20204 "15: movl 24(%4), %%eax\n"
20205 "16: movl 28(%4), %%edx\n"
20206- "17: movl %%eax, 24(%3)\n"
20207- "18: movl %%edx, 28(%3)\n"
20208+ "17: "__copyuser_seg" movl %%eax, 24(%3)\n"
20209+ "18: "__copyuser_seg" movl %%edx, 28(%3)\n"
20210 "19: movl 32(%4), %%eax\n"
20211 "20: movl 36(%4), %%edx\n"
20212- "21: movl %%eax, 32(%3)\n"
20213- "22: movl %%edx, 36(%3)\n"
20214+ "21: "__copyuser_seg" movl %%eax, 32(%3)\n"
20215+ "22: "__copyuser_seg" movl %%edx, 36(%3)\n"
20216 "23: movl 40(%4), %%eax\n"
20217 "24: movl 44(%4), %%edx\n"
20218- "25: movl %%eax, 40(%3)\n"
20219- "26: movl %%edx, 44(%3)\n"
20220+ "25: "__copyuser_seg" movl %%eax, 40(%3)\n"
20221+ "26: "__copyuser_seg" movl %%edx, 44(%3)\n"
20222 "27: movl 48(%4), %%eax\n"
20223 "28: movl 52(%4), %%edx\n"
20224- "29: movl %%eax, 48(%3)\n"
20225- "30: movl %%edx, 52(%3)\n"
20226+ "29: "__copyuser_seg" movl %%eax, 48(%3)\n"
20227+ "30: "__copyuser_seg" movl %%edx, 52(%3)\n"
20228 "31: movl 56(%4), %%eax\n"
20229 "32: movl 60(%4), %%edx\n"
20230- "33: movl %%eax, 56(%3)\n"
20231- "34: movl %%edx, 60(%3)\n"
20232+ "33: "__copyuser_seg" movl %%eax, 56(%3)\n"
20233+ "34: "__copyuser_seg" movl %%edx, 60(%3)\n"
20234 " addl $-64, %0\n"
20235 " addl $64, %4\n"
20236 " addl $64, %3\n"
20237@@ -278,10 +282,119 @@ __copy_user_intel(void __user *to, const
20238 " shrl $2, %0\n"
20239 " andl $3, %%eax\n"
20240 " cld\n"
20241+ __COPYUSER_SET_ES
20242 "99: rep; movsl\n"
20243 "36: movl %%eax, %0\n"
20244 "37: rep; movsb\n"
20245 "100:\n"
20246+ __COPYUSER_RESTORE_ES
20247+ ".section .fixup,\"ax\"\n"
20248+ "101: lea 0(%%eax,%0,4),%0\n"
20249+ " jmp 100b\n"
20250+ ".previous\n"
20251+ ".section __ex_table,\"a\"\n"
20252+ " .align 4\n"
20253+ " .long 1b,100b\n"
20254+ " .long 2b,100b\n"
20255+ " .long 3b,100b\n"
20256+ " .long 4b,100b\n"
20257+ " .long 5b,100b\n"
20258+ " .long 6b,100b\n"
20259+ " .long 7b,100b\n"
20260+ " .long 8b,100b\n"
20261+ " .long 9b,100b\n"
20262+ " .long 10b,100b\n"
20263+ " .long 11b,100b\n"
20264+ " .long 12b,100b\n"
20265+ " .long 13b,100b\n"
20266+ " .long 14b,100b\n"
20267+ " .long 15b,100b\n"
20268+ " .long 16b,100b\n"
20269+ " .long 17b,100b\n"
20270+ " .long 18b,100b\n"
20271+ " .long 19b,100b\n"
20272+ " .long 20b,100b\n"
20273+ " .long 21b,100b\n"
20274+ " .long 22b,100b\n"
20275+ " .long 23b,100b\n"
20276+ " .long 24b,100b\n"
20277+ " .long 25b,100b\n"
20278+ " .long 26b,100b\n"
20279+ " .long 27b,100b\n"
20280+ " .long 28b,100b\n"
20281+ " .long 29b,100b\n"
20282+ " .long 30b,100b\n"
20283+ " .long 31b,100b\n"
20284+ " .long 32b,100b\n"
20285+ " .long 33b,100b\n"
20286+ " .long 34b,100b\n"
20287+ " .long 35b,100b\n"
20288+ " .long 36b,100b\n"
20289+ " .long 37b,100b\n"
20290+ " .long 99b,101b\n"
20291+ ".previous"
20292+ : "=&c"(size), "=&D" (d0), "=&S" (d1)
20293+ : "1"(to), "2"(from), "0"(size)
20294+ : "eax", "edx", "memory");
20295+ return size;
20296+}
20297+
20298+static unsigned long
20299+__generic_copy_from_user_intel(void *to, const void __user *from, unsigned long size)
20300+{
20301+ int d0, d1;
20302+ __asm__ __volatile__(
20303+ " .align 2,0x90\n"
20304+ "1: "__copyuser_seg" movl 32(%4), %%eax\n"
20305+ " cmpl $67, %0\n"
20306+ " jbe 3f\n"
20307+ "2: "__copyuser_seg" movl 64(%4), %%eax\n"
20308+ " .align 2,0x90\n"
20309+ "3: "__copyuser_seg" movl 0(%4), %%eax\n"
20310+ "4: "__copyuser_seg" movl 4(%4), %%edx\n"
20311+ "5: movl %%eax, 0(%3)\n"
20312+ "6: movl %%edx, 4(%3)\n"
20313+ "7: "__copyuser_seg" movl 8(%4), %%eax\n"
20314+ "8: "__copyuser_seg" movl 12(%4),%%edx\n"
20315+ "9: movl %%eax, 8(%3)\n"
20316+ "10: movl %%edx, 12(%3)\n"
20317+ "11: "__copyuser_seg" movl 16(%4), %%eax\n"
20318+ "12: "__copyuser_seg" movl 20(%4), %%edx\n"
20319+ "13: movl %%eax, 16(%3)\n"
20320+ "14: movl %%edx, 20(%3)\n"
20321+ "15: "__copyuser_seg" movl 24(%4), %%eax\n"
20322+ "16: "__copyuser_seg" movl 28(%4), %%edx\n"
20323+ "17: movl %%eax, 24(%3)\n"
20324+ "18: movl %%edx, 28(%3)\n"
20325+ "19: "__copyuser_seg" movl 32(%4), %%eax\n"
20326+ "20: "__copyuser_seg" movl 36(%4), %%edx\n"
20327+ "21: movl %%eax, 32(%3)\n"
20328+ "22: movl %%edx, 36(%3)\n"
20329+ "23: "__copyuser_seg" movl 40(%4), %%eax\n"
20330+ "24: "__copyuser_seg" movl 44(%4), %%edx\n"
20331+ "25: movl %%eax, 40(%3)\n"
20332+ "26: movl %%edx, 44(%3)\n"
20333+ "27: "__copyuser_seg" movl 48(%4), %%eax\n"
20334+ "28: "__copyuser_seg" movl 52(%4), %%edx\n"
20335+ "29: movl %%eax, 48(%3)\n"
20336+ "30: movl %%edx, 52(%3)\n"
20337+ "31: "__copyuser_seg" movl 56(%4), %%eax\n"
20338+ "32: "__copyuser_seg" movl 60(%4), %%edx\n"
20339+ "33: movl %%eax, 56(%3)\n"
20340+ "34: movl %%edx, 60(%3)\n"
20341+ " addl $-64, %0\n"
20342+ " addl $64, %4\n"
20343+ " addl $64, %3\n"
20344+ " cmpl $63, %0\n"
20345+ " ja 1b\n"
20346+ "35: movl %0, %%eax\n"
20347+ " shrl $2, %0\n"
20348+ " andl $3, %%eax\n"
20349+ " cld\n"
20350+ "99: rep; "__copyuser_seg" movsl\n"
20351+ "36: movl %%eax, %0\n"
20352+ "37: rep; "__copyuser_seg" movsb\n"
20353+ "100:\n"
20354 ".section .fixup,\"ax\"\n"
20355 "101: lea 0(%%eax,%0,4),%0\n"
20356 " jmp 100b\n"
20357@@ -339,41 +452,41 @@ __copy_user_zeroing_intel(void *to, cons
20358 int d0, d1;
20359 __asm__ __volatile__(
20360 " .align 2,0x90\n"
20361- "0: movl 32(%4), %%eax\n"
20362+ "0: "__copyuser_seg" movl 32(%4), %%eax\n"
20363 " cmpl $67, %0\n"
20364 " jbe 2f\n"
20365- "1: movl 64(%4), %%eax\n"
20366+ "1: "__copyuser_seg" movl 64(%4), %%eax\n"
20367 " .align 2,0x90\n"
20368- "2: movl 0(%4), %%eax\n"
20369- "21: movl 4(%4), %%edx\n"
20370+ "2: "__copyuser_seg" movl 0(%4), %%eax\n"
20371+ "21: "__copyuser_seg" movl 4(%4), %%edx\n"
20372 " movl %%eax, 0(%3)\n"
20373 " movl %%edx, 4(%3)\n"
20374- "3: movl 8(%4), %%eax\n"
20375- "31: movl 12(%4),%%edx\n"
20376+ "3: "__copyuser_seg" movl 8(%4), %%eax\n"
20377+ "31: "__copyuser_seg" movl 12(%4),%%edx\n"
20378 " movl %%eax, 8(%3)\n"
20379 " movl %%edx, 12(%3)\n"
20380- "4: movl 16(%4), %%eax\n"
20381- "41: movl 20(%4), %%edx\n"
20382+ "4: "__copyuser_seg" movl 16(%4), %%eax\n"
20383+ "41: "__copyuser_seg" movl 20(%4), %%edx\n"
20384 " movl %%eax, 16(%3)\n"
20385 " movl %%edx, 20(%3)\n"
20386- "10: movl 24(%4), %%eax\n"
20387- "51: movl 28(%4), %%edx\n"
20388+ "10: "__copyuser_seg" movl 24(%4), %%eax\n"
20389+ "51: "__copyuser_seg" movl 28(%4), %%edx\n"
20390 " movl %%eax, 24(%3)\n"
20391 " movl %%edx, 28(%3)\n"
20392- "11: movl 32(%4), %%eax\n"
20393- "61: movl 36(%4), %%edx\n"
20394+ "11: "__copyuser_seg" movl 32(%4), %%eax\n"
20395+ "61: "__copyuser_seg" movl 36(%4), %%edx\n"
20396 " movl %%eax, 32(%3)\n"
20397 " movl %%edx, 36(%3)\n"
20398- "12: movl 40(%4), %%eax\n"
20399- "71: movl 44(%4), %%edx\n"
20400+ "12: "__copyuser_seg" movl 40(%4), %%eax\n"
20401+ "71: "__copyuser_seg" movl 44(%4), %%edx\n"
20402 " movl %%eax, 40(%3)\n"
20403 " movl %%edx, 44(%3)\n"
20404- "13: movl 48(%4), %%eax\n"
20405- "81: movl 52(%4), %%edx\n"
20406+ "13: "__copyuser_seg" movl 48(%4), %%eax\n"
20407+ "81: "__copyuser_seg" movl 52(%4), %%edx\n"
20408 " movl %%eax, 48(%3)\n"
20409 " movl %%edx, 52(%3)\n"
20410- "14: movl 56(%4), %%eax\n"
20411- "91: movl 60(%4), %%edx\n"
20412+ "14: "__copyuser_seg" movl 56(%4), %%eax\n"
20413+ "91: "__copyuser_seg" movl 60(%4), %%edx\n"
20414 " movl %%eax, 56(%3)\n"
20415 " movl %%edx, 60(%3)\n"
20416 " addl $-64, %0\n"
20417@@ -385,9 +498,9 @@ __copy_user_zeroing_intel(void *to, cons
20418 " shrl $2, %0\n"
20419 " andl $3, %%eax\n"
20420 " cld\n"
20421- "6: rep; movsl\n"
20422+ "6: rep; "__copyuser_seg" movsl\n"
20423 " movl %%eax,%0\n"
20424- "7: rep; movsb\n"
20425+ "7: rep; "__copyuser_seg" movsb\n"
20426 "8:\n"
20427 ".section .fixup,\"ax\"\n"
20428 "9: lea 0(%%eax,%0,4),%0\n"
20429@@ -440,41 +553,41 @@ static unsigned long __copy_user_zeroing
20430
20431 __asm__ __volatile__(
20432 " .align 2,0x90\n"
20433- "0: movl 32(%4), %%eax\n"
20434+ "0: "__copyuser_seg" movl 32(%4), %%eax\n"
20435 " cmpl $67, %0\n"
20436 " jbe 2f\n"
20437- "1: movl 64(%4), %%eax\n"
20438+ "1: "__copyuser_seg" movl 64(%4), %%eax\n"
20439 " .align 2,0x90\n"
20440- "2: movl 0(%4), %%eax\n"
20441- "21: movl 4(%4), %%edx\n"
20442+ "2: "__copyuser_seg" movl 0(%4), %%eax\n"
20443+ "21: "__copyuser_seg" movl 4(%4), %%edx\n"
20444 " movnti %%eax, 0(%3)\n"
20445 " movnti %%edx, 4(%3)\n"
20446- "3: movl 8(%4), %%eax\n"
20447- "31: movl 12(%4),%%edx\n"
20448+ "3: "__copyuser_seg" movl 8(%4), %%eax\n"
20449+ "31: "__copyuser_seg" movl 12(%4),%%edx\n"
20450 " movnti %%eax, 8(%3)\n"
20451 " movnti %%edx, 12(%3)\n"
20452- "4: movl 16(%4), %%eax\n"
20453- "41: movl 20(%4), %%edx\n"
20454+ "4: "__copyuser_seg" movl 16(%4), %%eax\n"
20455+ "41: "__copyuser_seg" movl 20(%4), %%edx\n"
20456 " movnti %%eax, 16(%3)\n"
20457 " movnti %%edx, 20(%3)\n"
20458- "10: movl 24(%4), %%eax\n"
20459- "51: movl 28(%4), %%edx\n"
20460+ "10: "__copyuser_seg" movl 24(%4), %%eax\n"
20461+ "51: "__copyuser_seg" movl 28(%4), %%edx\n"
20462 " movnti %%eax, 24(%3)\n"
20463 " movnti %%edx, 28(%3)\n"
20464- "11: movl 32(%4), %%eax\n"
20465- "61: movl 36(%4), %%edx\n"
20466+ "11: "__copyuser_seg" movl 32(%4), %%eax\n"
20467+ "61: "__copyuser_seg" movl 36(%4), %%edx\n"
20468 " movnti %%eax, 32(%3)\n"
20469 " movnti %%edx, 36(%3)\n"
20470- "12: movl 40(%4), %%eax\n"
20471- "71: movl 44(%4), %%edx\n"
20472+ "12: "__copyuser_seg" movl 40(%4), %%eax\n"
20473+ "71: "__copyuser_seg" movl 44(%4), %%edx\n"
20474 " movnti %%eax, 40(%3)\n"
20475 " movnti %%edx, 44(%3)\n"
20476- "13: movl 48(%4), %%eax\n"
20477- "81: movl 52(%4), %%edx\n"
20478+ "13: "__copyuser_seg" movl 48(%4), %%eax\n"
20479+ "81: "__copyuser_seg" movl 52(%4), %%edx\n"
20480 " movnti %%eax, 48(%3)\n"
20481 " movnti %%edx, 52(%3)\n"
20482- "14: movl 56(%4), %%eax\n"
20483- "91: movl 60(%4), %%edx\n"
20484+ "14: "__copyuser_seg" movl 56(%4), %%eax\n"
20485+ "91: "__copyuser_seg" movl 60(%4), %%edx\n"
20486 " movnti %%eax, 56(%3)\n"
20487 " movnti %%edx, 60(%3)\n"
20488 " addl $-64, %0\n"
20489@@ -487,9 +600,9 @@ static unsigned long __copy_user_zeroing
20490 " shrl $2, %0\n"
20491 " andl $3, %%eax\n"
20492 " cld\n"
20493- "6: rep; movsl\n"
20494+ "6: rep; "__copyuser_seg" movsl\n"
20495 " movl %%eax,%0\n"
20496- "7: rep; movsb\n"
20497+ "7: rep; "__copyuser_seg" movsb\n"
20498 "8:\n"
20499 ".section .fixup,\"ax\"\n"
20500 "9: lea 0(%%eax,%0,4),%0\n"
20501@@ -537,41 +650,41 @@ static unsigned long __copy_user_intel_n
20502
20503 __asm__ __volatile__(
20504 " .align 2,0x90\n"
20505- "0: movl 32(%4), %%eax\n"
20506+ "0: "__copyuser_seg" movl 32(%4), %%eax\n"
20507 " cmpl $67, %0\n"
20508 " jbe 2f\n"
20509- "1: movl 64(%4), %%eax\n"
20510+ "1: "__copyuser_seg" movl 64(%4), %%eax\n"
20511 " .align 2,0x90\n"
20512- "2: movl 0(%4), %%eax\n"
20513- "21: movl 4(%4), %%edx\n"
20514+ "2: "__copyuser_seg" movl 0(%4), %%eax\n"
20515+ "21: "__copyuser_seg" movl 4(%4), %%edx\n"
20516 " movnti %%eax, 0(%3)\n"
20517 " movnti %%edx, 4(%3)\n"
20518- "3: movl 8(%4), %%eax\n"
20519- "31: movl 12(%4),%%edx\n"
20520+ "3: "__copyuser_seg" movl 8(%4), %%eax\n"
20521+ "31: "__copyuser_seg" movl 12(%4),%%edx\n"
20522 " movnti %%eax, 8(%3)\n"
20523 " movnti %%edx, 12(%3)\n"
20524- "4: movl 16(%4), %%eax\n"
20525- "41: movl 20(%4), %%edx\n"
20526+ "4: "__copyuser_seg" movl 16(%4), %%eax\n"
20527+ "41: "__copyuser_seg" movl 20(%4), %%edx\n"
20528 " movnti %%eax, 16(%3)\n"
20529 " movnti %%edx, 20(%3)\n"
20530- "10: movl 24(%4), %%eax\n"
20531- "51: movl 28(%4), %%edx\n"
20532+ "10: "__copyuser_seg" movl 24(%4), %%eax\n"
20533+ "51: "__copyuser_seg" movl 28(%4), %%edx\n"
20534 " movnti %%eax, 24(%3)\n"
20535 " movnti %%edx, 28(%3)\n"
20536- "11: movl 32(%4), %%eax\n"
20537- "61: movl 36(%4), %%edx\n"
20538+ "11: "__copyuser_seg" movl 32(%4), %%eax\n"
20539+ "61: "__copyuser_seg" movl 36(%4), %%edx\n"
20540 " movnti %%eax, 32(%3)\n"
20541 " movnti %%edx, 36(%3)\n"
20542- "12: movl 40(%4), %%eax\n"
20543- "71: movl 44(%4), %%edx\n"
20544+ "12: "__copyuser_seg" movl 40(%4), %%eax\n"
20545+ "71: "__copyuser_seg" movl 44(%4), %%edx\n"
20546 " movnti %%eax, 40(%3)\n"
20547 " movnti %%edx, 44(%3)\n"
20548- "13: movl 48(%4), %%eax\n"
20549- "81: movl 52(%4), %%edx\n"
20550+ "13: "__copyuser_seg" movl 48(%4), %%eax\n"
20551+ "81: "__copyuser_seg" movl 52(%4), %%edx\n"
20552 " movnti %%eax, 48(%3)\n"
20553 " movnti %%edx, 52(%3)\n"
20554- "14: movl 56(%4), %%eax\n"
20555- "91: movl 60(%4), %%edx\n"
20556+ "14: "__copyuser_seg" movl 56(%4), %%eax\n"
20557+ "91: "__copyuser_seg" movl 60(%4), %%edx\n"
20558 " movnti %%eax, 56(%3)\n"
20559 " movnti %%edx, 60(%3)\n"
20560 " addl $-64, %0\n"
20561@@ -584,9 +697,9 @@ static unsigned long __copy_user_intel_n
20562 " shrl $2, %0\n"
20563 " andl $3, %%eax\n"
20564 " cld\n"
20565- "6: rep; movsl\n"
20566+ "6: rep; "__copyuser_seg" movsl\n"
20567 " movl %%eax,%0\n"
20568- "7: rep; movsb\n"
20569+ "7: rep; "__copyuser_seg" movsb\n"
20570 "8:\n"
20571 ".section .fixup,\"ax\"\n"
20572 "9: lea 0(%%eax,%0,4),%0\n"
20573@@ -629,32 +742,36 @@ static unsigned long __copy_user_intel_n
20574 */
20575 unsigned long __copy_user_zeroing_intel(void *to, const void __user *from,
20576 unsigned long size);
20577-unsigned long __copy_user_intel(void __user *to, const void *from,
20578+unsigned long __generic_copy_to_user_intel(void __user *to, const void *from,
20579+ unsigned long size);
20580+unsigned long __generic_copy_from_user_intel(void *to, const void __user *from,
20581 unsigned long size);
20582 unsigned long __copy_user_zeroing_intel_nocache(void *to,
20583 const void __user *from, unsigned long size);
20584 #endif /* CONFIG_X86_INTEL_USERCOPY */
20585
20586 /* Generic arbitrary sized copy. */
20587-#define __copy_user(to, from, size) \
20588+#define __copy_user(to, from, size, prefix, set, restore) \
20589 do { \
20590 int __d0, __d1, __d2; \
20591 __asm__ __volatile__( \
20592+ set \
20593 " cmp $7,%0\n" \
20594 " jbe 1f\n" \
20595 " movl %1,%0\n" \
20596 " negl %0\n" \
20597 " andl $7,%0\n" \
20598 " subl %0,%3\n" \
20599- "4: rep; movsb\n" \
20600+ "4: rep; "prefix"movsb\n" \
20601 " movl %3,%0\n" \
20602 " shrl $2,%0\n" \
20603 " andl $3,%3\n" \
20604 " .align 2,0x90\n" \
20605- "0: rep; movsl\n" \
20606+ "0: rep; "prefix"movsl\n" \
20607 " movl %3,%0\n" \
20608- "1: rep; movsb\n" \
20609+ "1: rep; "prefix"movsb\n" \
20610 "2:\n" \
20611+ restore \
20612 ".section .fixup,\"ax\"\n" \
20613 "5: addl %3,%0\n" \
20614 " jmp 2b\n" \
20615@@ -682,14 +799,14 @@ do { \
20616 " negl %0\n" \
20617 " andl $7,%0\n" \
20618 " subl %0,%3\n" \
20619- "4: rep; movsb\n" \
20620+ "4: rep; "__copyuser_seg"movsb\n" \
20621 " movl %3,%0\n" \
20622 " shrl $2,%0\n" \
20623 " andl $3,%3\n" \
20624 " .align 2,0x90\n" \
20625- "0: rep; movsl\n" \
20626+ "0: rep; "__copyuser_seg"movsl\n" \
20627 " movl %3,%0\n" \
20628- "1: rep; movsb\n" \
20629+ "1: rep; "__copyuser_seg"movsb\n" \
20630 "2:\n" \
20631 ".section .fixup,\"ax\"\n" \
20632 "5: addl %3,%0\n" \
20633@@ -775,9 +892,9 @@ survive:
20634 }
20635 #endif
20636 if (movsl_is_ok(to, from, n))
20637- __copy_user(to, from, n);
20638+ __copy_user(to, from, n, "", __COPYUSER_SET_ES, __COPYUSER_RESTORE_ES);
20639 else
20640- n = __copy_user_intel(to, from, n);
20641+ n = __generic_copy_to_user_intel(to, from, n);
20642 return n;
20643 }
20644 EXPORT_SYMBOL(__copy_to_user_ll);
20645@@ -797,10 +914,9 @@ unsigned long __copy_from_user_ll_nozero
20646 unsigned long n)
20647 {
20648 if (movsl_is_ok(to, from, n))
20649- __copy_user(to, from, n);
20650+ __copy_user(to, from, n, __copyuser_seg, "", "");
20651 else
20652- n = __copy_user_intel((void __user *)to,
20653- (const void *)from, n);
20654+ n = __generic_copy_from_user_intel(to, from, n);
20655 return n;
20656 }
20657 EXPORT_SYMBOL(__copy_from_user_ll_nozero);
20658@@ -827,65 +943,50 @@ unsigned long __copy_from_user_ll_nocach
20659 if (n > 64 && cpu_has_xmm2)
20660 n = __copy_user_intel_nocache(to, from, n);
20661 else
20662- __copy_user(to, from, n);
20663+ __copy_user(to, from, n, __copyuser_seg, "", "");
20664 #else
20665- __copy_user(to, from, n);
20666+ __copy_user(to, from, n, __copyuser_seg, "", "");
20667 #endif
20668 return n;
20669 }
20670 EXPORT_SYMBOL(__copy_from_user_ll_nocache_nozero);
20671
20672-/**
20673- * copy_to_user: - Copy a block of data into user space.
20674- * @to: Destination address, in user space.
20675- * @from: Source address, in kernel space.
20676- * @n: Number of bytes to copy.
20677- *
20678- * Context: User context only. This function may sleep.
20679- *
20680- * Copy data from kernel space to user space.
20681- *
20682- * Returns number of bytes that could not be copied.
20683- * On success, this will be zero.
20684- */
20685-unsigned long
20686-copy_to_user(void __user *to, const void *from, unsigned long n)
20687+void copy_from_user_overflow(void)
20688 {
20689- if (access_ok(VERIFY_WRITE, to, n))
20690- n = __copy_to_user(to, from, n);
20691- return n;
20692+ WARN(1, "Buffer overflow detected!\n");
20693 }
20694-EXPORT_SYMBOL(copy_to_user);
20695+EXPORT_SYMBOL(copy_from_user_overflow);
20696
20697-/**
20698- * copy_from_user: - Copy a block of data from user space.
20699- * @to: Destination address, in kernel space.
20700- * @from: Source address, in user space.
20701- * @n: Number of bytes to copy.
20702- *
20703- * Context: User context only. This function may sleep.
20704- *
20705- * Copy data from user space to kernel space.
20706- *
20707- * Returns number of bytes that could not be copied.
20708- * On success, this will be zero.
20709- *
20710- * If some data could not be copied, this function will pad the copied
20711- * data to the requested size using zero bytes.
20712- */
20713-unsigned long
20714-_copy_from_user(void *to, const void __user *from, unsigned long n)
20715+void copy_to_user_overflow(void)
20716 {
20717- if (access_ok(VERIFY_READ, from, n))
20718- n = __copy_from_user(to, from, n);
20719- else
20720- memset(to, 0, n);
20721- return n;
20722+ WARN(1, "Buffer overflow detected!\n");
20723 }
20724-EXPORT_SYMBOL(_copy_from_user);
20725+EXPORT_SYMBOL(copy_to_user_overflow);
20726
20727-void copy_from_user_overflow(void)
20728+#ifdef CONFIG_PAX_MEMORY_UDEREF
20729+void __set_fs(mm_segment_t x)
20730 {
20731- WARN(1, "Buffer overflow detected!\n");
20732+ switch (x.seg) {
20733+ case 0:
20734+ loadsegment(gs, 0);
20735+ break;
20736+ case TASK_SIZE_MAX:
20737+ loadsegment(gs, __USER_DS);
20738+ break;
20739+ case -1UL:
20740+ loadsegment(gs, __KERNEL_DS);
20741+ break;
20742+ default:
20743+ BUG();
20744+ }
20745+ return;
20746 }
20747-EXPORT_SYMBOL(copy_from_user_overflow);
20748+EXPORT_SYMBOL(__set_fs);
20749+
20750+void set_fs(mm_segment_t x)
20751+{
20752+ current_thread_info()->addr_limit = x;
20753+ __set_fs(x);
20754+}
20755+EXPORT_SYMBOL(set_fs);
20756+#endif
20757diff -urNp linux-2.6.39/arch/x86/lib/usercopy_64.c linux-2.6.39/arch/x86/lib/usercopy_64.c
20758--- linux-2.6.39/arch/x86/lib/usercopy_64.c 2011-05-19 00:06:34.000000000 -0400
20759+++ linux-2.6.39/arch/x86/lib/usercopy_64.c 2011-05-22 19:36:30.000000000 -0400
20760@@ -42,6 +42,12 @@ long
20761 __strncpy_from_user(char *dst, const char __user *src, long count)
20762 {
20763 long res;
20764+
20765+#ifdef CONFIG_PAX_MEMORY_UDEREF
20766+ if ((unsigned long)src < PAX_USER_SHADOW_BASE)
20767+ src += PAX_USER_SHADOW_BASE;
20768+#endif
20769+
20770 __do_strncpy_from_user(dst, src, count, res);
20771 return res;
20772 }
20773@@ -65,6 +71,12 @@ unsigned long __clear_user(void __user *
20774 {
20775 long __d0;
20776 might_fault();
20777+
20778+#ifdef CONFIG_PAX_MEMORY_UDEREF
20779+ if ((unsigned long)addr < PAX_USER_SHADOW_BASE)
20780+ addr += PAX_USER_SHADOW_BASE;
20781+#endif
20782+
20783 /* no memory constraint because it doesn't change any memory gcc knows
20784 about */
20785 asm volatile(
20786@@ -151,10 +163,18 @@ EXPORT_SYMBOL(strlen_user);
20787
20788 unsigned long copy_in_user(void __user *to, const void __user *from, unsigned len)
20789 {
20790- if (access_ok(VERIFY_WRITE, to, len) && access_ok(VERIFY_READ, from, len)) {
20791+ if (access_ok(VERIFY_WRITE, to, len) && access_ok(VERIFY_READ, from, len)) {
20792+
20793+#ifdef CONFIG_PAX_MEMORY_UDEREF
20794+ if ((unsigned long)to < PAX_USER_SHADOW_BASE)
20795+ to += PAX_USER_SHADOW_BASE;
20796+ if ((unsigned long)from < PAX_USER_SHADOW_BASE)
20797+ from += PAX_USER_SHADOW_BASE;
20798+#endif
20799+
20800 return copy_user_generic((__force void *)to, (__force void *)from, len);
20801- }
20802- return len;
20803+ }
20804+ return len;
20805 }
20806 EXPORT_SYMBOL(copy_in_user);
20807
20808diff -urNp linux-2.6.39/arch/x86/Makefile linux-2.6.39/arch/x86/Makefile
20809--- linux-2.6.39/arch/x86/Makefile 2011-05-19 00:06:34.000000000 -0400
20810+++ linux-2.6.39/arch/x86/Makefile 2011-05-22 19:36:30.000000000 -0400
20811@@ -195,3 +195,12 @@ define archhelp
20812 echo ' FDARGS="..." arguments for the booted kernel'
20813 echo ' FDINITRD=file initrd for the booted kernel'
20814 endef
20815+
20816+define OLD_LD
20817+
20818+*** ${VERSION}.${PATCHLEVEL} PaX kernels no longer build correctly with old versions of binutils.
20819+*** Please upgrade your binutils to 2.18 or newer
20820+endef
20821+
20822+archprepare:
20823+ $(if $(LDFLAGS_BUILD_ID),,$(error $(OLD_LD)))
20824diff -urNp linux-2.6.39/arch/x86/mm/extable.c linux-2.6.39/arch/x86/mm/extable.c
20825--- linux-2.6.39/arch/x86/mm/extable.c 2011-05-19 00:06:34.000000000 -0400
20826+++ linux-2.6.39/arch/x86/mm/extable.c 2011-05-22 19:36:30.000000000 -0400
20827@@ -1,14 +1,71 @@
20828 #include <linux/module.h>
20829 #include <linux/spinlock.h>
20830+#include <linux/sort.h>
20831 #include <asm/uaccess.h>
20832+#include <asm/pgtable.h>
20833
20834+/*
20835+ * The exception table needs to be sorted so that the binary
20836+ * search that we use to find entries in it works properly.
20837+ * This is used both for the kernel exception table and for
20838+ * the exception tables of modules that get loaded.
20839+ */
20840+static int cmp_ex(const void *a, const void *b)
20841+{
20842+ const struct exception_table_entry *x = a, *y = b;
20843+
20844+ /* avoid overflow */
20845+ if (x->insn > y->insn)
20846+ return 1;
20847+ if (x->insn < y->insn)
20848+ return -1;
20849+ return 0;
20850+}
20851+
20852+static void swap_ex(void *a, void *b, int size)
20853+{
20854+ struct exception_table_entry t, *x = a, *y = b;
20855+
20856+ t = *x;
20857+
20858+ pax_open_kernel();
20859+ *x = *y;
20860+ *y = t;
20861+ pax_close_kernel();
20862+}
20863+
20864+void sort_extable(struct exception_table_entry *start,
20865+ struct exception_table_entry *finish)
20866+{
20867+ sort(start, finish - start, sizeof(struct exception_table_entry),
20868+ cmp_ex, swap_ex);
20869+}
20870+
20871+#ifdef CONFIG_MODULES
20872+/*
20873+ * If the exception table is sorted, any referring to the module init
20874+ * will be at the beginning or the end.
20875+ */
20876+void trim_init_extable(struct module *m)
20877+{
20878+ /*trim the beginning*/
20879+ while (m->num_exentries && within_module_init(m->extable[0].insn, m)) {
20880+ m->extable++;
20881+ m->num_exentries--;
20882+ }
20883+ /*trim the end*/
20884+ while (m->num_exentries &&
20885+ within_module_init(m->extable[m->num_exentries-1].insn, m))
20886+ m->num_exentries--;
20887+}
20888+#endif /* CONFIG_MODULES */
20889
20890 int fixup_exception(struct pt_regs *regs)
20891 {
20892 const struct exception_table_entry *fixup;
20893
20894 #ifdef CONFIG_PNPBIOS
20895- if (unlikely(SEGMENT_IS_PNP_CODE(regs->cs))) {
20896+ if (unlikely(!v8086_mode(regs) && SEGMENT_IS_PNP_CODE(regs->cs))) {
20897 extern u32 pnp_bios_fault_eip, pnp_bios_fault_esp;
20898 extern u32 pnp_bios_is_utter_crap;
20899 pnp_bios_is_utter_crap = 1;
20900diff -urNp linux-2.6.39/arch/x86/mm/fault.c linux-2.6.39/arch/x86/mm/fault.c
20901--- linux-2.6.39/arch/x86/mm/fault.c 2011-05-19 00:06:34.000000000 -0400
20902+++ linux-2.6.39/arch/x86/mm/fault.c 2011-05-22 20:33:41.000000000 -0400
20903@@ -12,10 +12,18 @@
20904 #include <linux/mmiotrace.h> /* kmmio_handler, ... */
20905 #include <linux/perf_event.h> /* perf_sw_event */
20906 #include <linux/hugetlb.h> /* hstate_index_to_shift */
20907+#include <linux/unistd.h>
20908+#include <linux/compiler.h>
20909
20910 #include <asm/traps.h> /* dotraplinkage, ... */
20911 #include <asm/pgalloc.h> /* pgd_*(), ... */
20912 #include <asm/kmemcheck.h> /* kmemcheck_*(), ... */
20913+#include <asm/vsyscall.h>
20914+#include <asm/tlbflush.h>
20915+
20916+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
20917+#include <asm/stacktrace.h>
20918+#endif
20919
20920 /*
20921 * Page fault error code bits:
20922@@ -53,7 +61,7 @@ static inline int __kprobes notify_page_
20923 int ret = 0;
20924
20925 /* kprobe_running() needs smp_processor_id() */
20926- if (kprobes_built_in() && !user_mode_vm(regs)) {
20927+ if (kprobes_built_in() && !user_mode(regs)) {
20928 preempt_disable();
20929 if (kprobe_running() && kprobe_fault_handler(regs, 14))
20930 ret = 1;
20931@@ -114,7 +122,10 @@ check_prefetch_opcode(struct pt_regs *re
20932 return !instr_lo || (instr_lo>>1) == 1;
20933 case 0x00:
20934 /* Prefetch instruction is 0x0F0D or 0x0F18 */
20935- if (probe_kernel_address(instr, opcode))
20936+ if (user_mode(regs)) {
20937+ if (__copy_from_user_inatomic(&opcode, (__force unsigned char __user *)(instr), 1))
20938+ return 0;
20939+ } else if (probe_kernel_address(instr, opcode))
20940 return 0;
20941
20942 *prefetch = (instr_lo == 0xF) &&
20943@@ -148,7 +159,10 @@ is_prefetch(struct pt_regs *regs, unsign
20944 while (instr < max_instr) {
20945 unsigned char opcode;
20946
20947- if (probe_kernel_address(instr, opcode))
20948+ if (user_mode(regs)) {
20949+ if (__copy_from_user_inatomic(&opcode, (__force unsigned char __user *)(instr), 1))
20950+ break;
20951+ } else if (probe_kernel_address(instr, opcode))
20952 break;
20953
20954 instr++;
20955@@ -179,6 +193,30 @@ force_sig_info_fault(int si_signo, int s
20956 force_sig_info(si_signo, &info, tsk);
20957 }
20958
20959+#ifdef CONFIG_PAX_EMUTRAMP
20960+static int pax_handle_fetch_fault(struct pt_regs *regs);
20961+#endif
20962+
20963+#ifdef CONFIG_PAX_PAGEEXEC
20964+static inline pmd_t * pax_get_pmd(struct mm_struct *mm, unsigned long address)
20965+{
20966+ pgd_t *pgd;
20967+ pud_t *pud;
20968+ pmd_t *pmd;
20969+
20970+ pgd = pgd_offset(mm, address);
20971+ if (!pgd_present(*pgd))
20972+ return NULL;
20973+ pud = pud_offset(pgd, address);
20974+ if (!pud_present(*pud))
20975+ return NULL;
20976+ pmd = pmd_offset(pud, address);
20977+ if (!pmd_present(*pmd))
20978+ return NULL;
20979+ return pmd;
20980+}
20981+#endif
20982+
20983 DEFINE_SPINLOCK(pgd_lock);
20984 LIST_HEAD(pgd_list);
20985
20986@@ -229,10 +267,22 @@ void vmalloc_sync_all(void)
20987 for (address = VMALLOC_START & PMD_MASK;
20988 address >= TASK_SIZE && address < FIXADDR_TOP;
20989 address += PMD_SIZE) {
20990+
20991+#ifdef CONFIG_PAX_PER_CPU_PGD
20992+ unsigned long cpu;
20993+#else
20994 struct page *page;
20995+#endif
20996
20997 spin_lock(&pgd_lock);
20998+
20999+#ifdef CONFIG_PAX_PER_CPU_PGD
21000+ for (cpu = 0; cpu < NR_CPUS; ++cpu) {
21001+ pgd_t *pgd = get_cpu_pgd(cpu);
21002+ pmd_t *ret;
21003+#else
21004 list_for_each_entry(page, &pgd_list, lru) {
21005+ pgd_t *pgd = page_address(page);
21006 spinlock_t *pgt_lock;
21007 pmd_t *ret;
21008
21009@@ -240,8 +290,13 @@ void vmalloc_sync_all(void)
21010 pgt_lock = &pgd_page_get_mm(page)->page_table_lock;
21011
21012 spin_lock(pgt_lock);
21013- ret = vmalloc_sync_one(page_address(page), address);
21014+#endif
21015+
21016+ ret = vmalloc_sync_one(pgd, address);
21017+
21018+#ifndef CONFIG_PAX_PER_CPU_PGD
21019 spin_unlock(pgt_lock);
21020+#endif
21021
21022 if (!ret)
21023 break;
21024@@ -275,6 +330,11 @@ static noinline __kprobes int vmalloc_fa
21025 * an interrupt in the middle of a task switch..
21026 */
21027 pgd_paddr = read_cr3();
21028+
21029+#ifdef CONFIG_PAX_PER_CPU_PGD
21030+ BUG_ON(__pa(get_cpu_pgd(smp_processor_id())) != (pgd_paddr & PHYSICAL_PAGE_MASK));
21031+#endif
21032+
21033 pmd_k = vmalloc_sync_one(__va(pgd_paddr), address);
21034 if (!pmd_k)
21035 return -1;
21036@@ -370,7 +430,14 @@ static noinline __kprobes int vmalloc_fa
21037 * happen within a race in page table update. In the later
21038 * case just flush:
21039 */
21040+
21041+#ifdef CONFIG_PAX_PER_CPU_PGD
21042+ BUG_ON(__pa(get_cpu_pgd(smp_processor_id())) != (read_cr3() & PHYSICAL_PAGE_MASK));
21043+ pgd = pgd_offset_cpu(smp_processor_id(), address);
21044+#else
21045 pgd = pgd_offset(current->active_mm, address);
21046+#endif
21047+
21048 pgd_ref = pgd_offset_k(address);
21049 if (pgd_none(*pgd_ref))
21050 return -1;
21051@@ -532,7 +599,7 @@ static int is_errata93(struct pt_regs *r
21052 static int is_errata100(struct pt_regs *regs, unsigned long address)
21053 {
21054 #ifdef CONFIG_X86_64
21055- if ((regs->cs == __USER32_CS || (regs->cs & (1<<2))) && (address >> 32))
21056+ if ((regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT)) && (address >> 32))
21057 return 1;
21058 #endif
21059 return 0;
21060@@ -559,7 +626,7 @@ static int is_f00f_bug(struct pt_regs *r
21061 }
21062
21063 static const char nx_warning[] = KERN_CRIT
21064-"kernel tried to execute NX-protected page - exploit attempt? (uid: %d)\n";
21065+"kernel tried to execute NX-protected page - exploit attempt? (uid: %d, task: %s, pid: %d)\n";
21066
21067 static void
21068 show_fault_oops(struct pt_regs *regs, unsigned long error_code,
21069@@ -568,15 +635,26 @@ show_fault_oops(struct pt_regs *regs, un
21070 if (!oops_may_print())
21071 return;
21072
21073- if (error_code & PF_INSTR) {
21074+ if ((__supported_pte_mask & _PAGE_NX) && (error_code & PF_INSTR)) {
21075 unsigned int level;
21076
21077 pte_t *pte = lookup_address(address, &level);
21078
21079 if (pte && pte_present(*pte) && !pte_exec(*pte))
21080- printk(nx_warning, current_uid());
21081+ printk(nx_warning, current_uid(), current->comm, task_pid_nr(current));
21082 }
21083
21084+#ifdef CONFIG_PAX_KERNEXEC
21085+ if (init_mm.start_code <= address && address < init_mm.end_code) {
21086+ if (current->signal->curr_ip)
21087+ printk(KERN_ERR "PAX: From %pI4: %s:%d, uid/euid: %u/%u, attempted to modify kernel code\n",
21088+ &current->signal->curr_ip, current->comm, task_pid_nr(current), current_uid(), current_euid());
21089+ else
21090+ printk(KERN_ERR "PAX: %s:%d, uid/euid: %u/%u, attempted to modify kernel code\n",
21091+ current->comm, task_pid_nr(current), current_uid(), current_euid());
21092+ }
21093+#endif
21094+
21095 printk(KERN_ALERT "BUG: unable to handle kernel ");
21096 if (address < PAGE_SIZE)
21097 printk(KERN_CONT "NULL pointer dereference");
21098@@ -701,6 +779,68 @@ __bad_area_nosemaphore(struct pt_regs *r
21099 unsigned long address, int si_code)
21100 {
21101 struct task_struct *tsk = current;
21102+ struct mm_struct *mm = tsk->mm;
21103+
21104+#ifdef CONFIG_X86_64
21105+ if (mm && (error_code & PF_INSTR) && mm->context.vdso) {
21106+ if (regs->ip == (unsigned long)vgettimeofday) {
21107+ regs->ip = (unsigned long)VDSO64_SYMBOL(mm->context.vdso, fallback_gettimeofday);
21108+ return;
21109+ } else if (regs->ip == (unsigned long)vtime) {
21110+ regs->ip = (unsigned long)VDSO64_SYMBOL(mm->context.vdso, fallback_time);
21111+ return;
21112+ } else if (regs->ip == (unsigned long)vgetcpu) {
21113+ regs->ip = (unsigned long)VDSO64_SYMBOL(mm->context.vdso, getcpu);
21114+ return;
21115+ }
21116+ }
21117+#endif
21118+
21119+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
21120+ if (mm && (error_code & PF_USER)) {
21121+ unsigned long ip = regs->ip;
21122+
21123+ if (v8086_mode(regs))
21124+ ip = ((regs->cs & 0xffff) << 4) + (ip & 0xffff);
21125+
21126+ /*
21127+ * It's possible to have interrupts off here:
21128+ */
21129+ local_irq_enable();
21130+
21131+#ifdef CONFIG_PAX_PAGEEXEC
21132+ if ((mm->pax_flags & MF_PAX_PAGEEXEC) &&
21133+ (((__supported_pte_mask & _PAGE_NX) && (error_code & PF_INSTR)) || (!(error_code & (PF_PROT | PF_WRITE)) && ip == address))) {
21134+
21135+#ifdef CONFIG_PAX_EMUTRAMP
21136+ switch (pax_handle_fetch_fault(regs)) {
21137+ case 2:
21138+ return;
21139+ }
21140+#endif
21141+
21142+ pax_report_fault(regs, (void *)ip, (void *)regs->sp);
21143+ do_group_exit(SIGKILL);
21144+ }
21145+#endif
21146+
21147+#ifdef CONFIG_PAX_SEGMEXEC
21148+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && !(error_code & (PF_PROT | PF_WRITE)) && (ip + SEGMEXEC_TASK_SIZE == address)) {
21149+
21150+#ifdef CONFIG_PAX_EMUTRAMP
21151+ switch (pax_handle_fetch_fault(regs)) {
21152+ case 2:
21153+ return;
21154+ }
21155+#endif
21156+
21157+ pax_report_fault(regs, (void *)ip, (void *)regs->sp);
21158+ do_group_exit(SIGKILL);
21159+ }
21160+#endif
21161+
21162+ }
21163+#endif
21164
21165 /* User mode accesses just cause a SIGSEGV */
21166 if (error_code & PF_USER) {
21167@@ -855,6 +995,99 @@ static int spurious_fault_check(unsigned
21168 return 1;
21169 }
21170
21171+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
21172+static int pax_handle_pageexec_fault(struct pt_regs *regs, struct mm_struct *mm, unsigned long address, unsigned long error_code)
21173+{
21174+ pte_t *pte;
21175+ pmd_t *pmd;
21176+ spinlock_t *ptl;
21177+ unsigned char pte_mask;
21178+
21179+ if ((__supported_pte_mask & _PAGE_NX) || (error_code & (PF_PROT|PF_USER)) != (PF_PROT|PF_USER) || v8086_mode(regs) ||
21180+ !(mm->pax_flags & MF_PAX_PAGEEXEC))
21181+ return 0;
21182+
21183+ /* PaX: it's our fault, let's handle it if we can */
21184+
21185+ /* PaX: take a look at read faults before acquiring any locks */
21186+ if (unlikely(!(error_code & PF_WRITE) && (regs->ip == address))) {
21187+ /* instruction fetch attempt from a protected page in user mode */
21188+ up_read(&mm->mmap_sem);
21189+
21190+#ifdef CONFIG_PAX_EMUTRAMP
21191+ switch (pax_handle_fetch_fault(regs)) {
21192+ case 2:
21193+ return 1;
21194+ }
21195+#endif
21196+
21197+ pax_report_fault(regs, (void *)regs->ip, (void *)regs->sp);
21198+ do_group_exit(SIGKILL);
21199+ }
21200+
21201+ pmd = pax_get_pmd(mm, address);
21202+ if (unlikely(!pmd))
21203+ return 0;
21204+
21205+ pte = pte_offset_map_lock(mm, pmd, address, &ptl);
21206+ if (unlikely(!(pte_val(*pte) & _PAGE_PRESENT) || pte_user(*pte))) {
21207+ pte_unmap_unlock(pte, ptl);
21208+ return 0;
21209+ }
21210+
21211+ if (unlikely((error_code & PF_WRITE) && !pte_write(*pte))) {
21212+ /* write attempt to a protected page in user mode */
21213+ pte_unmap_unlock(pte, ptl);
21214+ return 0;
21215+ }
21216+
21217+#ifdef CONFIG_SMP
21218+ if (likely(address > get_limit(regs->cs) && cpu_isset(smp_processor_id(), mm->context.cpu_user_cs_mask)))
21219+#else
21220+ if (likely(address > get_limit(regs->cs)))
21221+#endif
21222+ {
21223+ set_pte(pte, pte_mkread(*pte));
21224+ __flush_tlb_one(address);
21225+ pte_unmap_unlock(pte, ptl);
21226+ up_read(&mm->mmap_sem);
21227+ return 1;
21228+ }
21229+
21230+ pte_mask = _PAGE_ACCESSED | _PAGE_USER | ((error_code & PF_WRITE) << (_PAGE_BIT_DIRTY-1));
21231+
21232+ /*
21233+ * PaX: fill DTLB with user rights and retry
21234+ */
21235+ __asm__ __volatile__ (
21236+ "orb %2,(%1)\n"
21237+#if defined(CONFIG_M586) || defined(CONFIG_M586TSC)
21238+/*
21239+ * PaX: let this uncommented 'invlpg' remind us on the behaviour of Intel's
21240+ * (and AMD's) TLBs. namely, they do not cache PTEs that would raise *any*
21241+ * page fault when examined during a TLB load attempt. this is true not only
21242+ * for PTEs holding a non-present entry but also present entries that will
21243+ * raise a page fault (such as those set up by PaX, or the copy-on-write
21244+ * mechanism). in effect it means that we do *not* need to flush the TLBs
21245+ * for our target pages since their PTEs are simply not in the TLBs at all.
21246+
21247+ * the best thing in omitting it is that we gain around 15-20% speed in the
21248+ * fast path of the page fault handler and can get rid of tracing since we
21249+ * can no longer flush unintended entries.
21250+ */
21251+ "invlpg (%0)\n"
21252+#endif
21253+ __copyuser_seg"testb $0,(%0)\n"
21254+ "xorb %3,(%1)\n"
21255+ :
21256+ : "r" (address), "r" (pte), "q" (pte_mask), "i" (_PAGE_USER)
21257+ : "memory", "cc");
21258+ pte_unmap_unlock(pte, ptl);
21259+ up_read(&mm->mmap_sem);
21260+ return 1;
21261+}
21262+#endif
21263+
21264 /*
21265 * Handle a spurious fault caused by a stale TLB entry.
21266 *
21267@@ -927,6 +1160,9 @@ int show_unhandled_signals = 1;
21268 static inline int
21269 access_error(unsigned long error_code, struct vm_area_struct *vma)
21270 {
21271+ if ((__supported_pte_mask & _PAGE_NX) && (error_code & PF_INSTR) && !(vma->vm_flags & VM_EXEC))
21272+ return 1;
21273+
21274 if (error_code & PF_WRITE) {
21275 /* write, present and write, not present: */
21276 if (unlikely(!(vma->vm_flags & VM_WRITE)))
21277@@ -960,19 +1196,33 @@ do_page_fault(struct pt_regs *regs, unsi
21278 {
21279 struct vm_area_struct *vma;
21280 struct task_struct *tsk;
21281- unsigned long address;
21282 struct mm_struct *mm;
21283 int fault;
21284 int write = error_code & PF_WRITE;
21285 unsigned int flags = FAULT_FLAG_ALLOW_RETRY |
21286 (write ? FAULT_FLAG_WRITE : 0);
21287
21288+ /* Get the faulting address: */
21289+ unsigned long address = read_cr2();
21290+
21291+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
21292+ if (!user_mode(regs) && address < 2 * PAX_USER_SHADOW_BASE) {
21293+ if (!search_exception_tables(regs->ip)) {
21294+ bad_area_nosemaphore(regs, error_code, address);
21295+ return;
21296+ }
21297+ if (address < PAX_USER_SHADOW_BASE) {
21298+ printk(KERN_ERR "PAX: please report this to pageexec@freemail.hu\n");
21299+ printk(KERN_ERR "PAX: faulting IP: %pA\n", (void *)regs->ip);
21300+ show_trace_log_lvl(NULL, NULL, (void *)regs->sp, regs->bp, KERN_ERR);
21301+ } else
21302+ address -= PAX_USER_SHADOW_BASE;
21303+ }
21304+#endif
21305+
21306 tsk = current;
21307 mm = tsk->mm;
21308
21309- /* Get the faulting address: */
21310- address = read_cr2();
21311-
21312 /*
21313 * Detect and handle instructions that would cause a page fault for
21314 * both a tracked kernel page and a userspace page.
21315@@ -1032,7 +1282,7 @@ do_page_fault(struct pt_regs *regs, unsi
21316 * User-mode registers count as a user access even for any
21317 * potential system fault or CPU buglet:
21318 */
21319- if (user_mode_vm(regs)) {
21320+ if (user_mode(regs)) {
21321 local_irq_enable();
21322 error_code |= PF_USER;
21323 } else {
21324@@ -1087,6 +1337,11 @@ retry:
21325 might_sleep();
21326 }
21327
21328+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
21329+ if (pax_handle_pageexec_fault(regs, mm, address, error_code))
21330+ return;
21331+#endif
21332+
21333 vma = find_vma(mm, address);
21334 if (unlikely(!vma)) {
21335 bad_area(regs, error_code, address);
21336@@ -1098,18 +1353,24 @@ retry:
21337 bad_area(regs, error_code, address);
21338 return;
21339 }
21340- if (error_code & PF_USER) {
21341- /*
21342- * Accessing the stack below %sp is always a bug.
21343- * The large cushion allows instructions like enter
21344- * and pusha to work. ("enter $65535, $31" pushes
21345- * 32 pointers and then decrements %sp by 65535.)
21346- */
21347- if (unlikely(address + 65536 + 32 * sizeof(unsigned long) < regs->sp)) {
21348- bad_area(regs, error_code, address);
21349- return;
21350- }
21351+ /*
21352+ * Accessing the stack below %sp is always a bug.
21353+ * The large cushion allows instructions like enter
21354+ * and pusha to work. ("enter $65535, $31" pushes
21355+ * 32 pointers and then decrements %sp by 65535.)
21356+ */
21357+ if (unlikely(address + 65536 + 32 * sizeof(unsigned long) < task_pt_regs(tsk)->sp)) {
21358+ bad_area(regs, error_code, address);
21359+ return;
21360 }
21361+
21362+#ifdef CONFIG_PAX_SEGMEXEC
21363+ if (unlikely((mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_end - SEGMEXEC_TASK_SIZE - 1 < address - SEGMEXEC_TASK_SIZE - 1)) {
21364+ bad_area(regs, error_code, address);
21365+ return;
21366+ }
21367+#endif
21368+
21369 if (unlikely(expand_stack(vma, address))) {
21370 bad_area(regs, error_code, address);
21371 return;
21372@@ -1164,3 +1425,199 @@ good_area:
21373
21374 up_read(&mm->mmap_sem);
21375 }
21376+
21377+#ifdef CONFIG_PAX_EMUTRAMP
21378+static int pax_handle_fetch_fault_32(struct pt_regs *regs)
21379+{
21380+ int err;
21381+
21382+ do { /* PaX: gcc trampoline emulation #1 */
21383+ unsigned char mov1, mov2;
21384+ unsigned short jmp;
21385+ unsigned int addr1, addr2;
21386+
21387+#ifdef CONFIG_X86_64
21388+ if ((regs->ip + 11) >> 32)
21389+ break;
21390+#endif
21391+
21392+ err = get_user(mov1, (unsigned char __user *)regs->ip);
21393+ err |= get_user(addr1, (unsigned int __user *)(regs->ip + 1));
21394+ err |= get_user(mov2, (unsigned char __user *)(regs->ip + 5));
21395+ err |= get_user(addr2, (unsigned int __user *)(regs->ip + 6));
21396+ err |= get_user(jmp, (unsigned short __user *)(regs->ip + 10));
21397+
21398+ if (err)
21399+ break;
21400+
21401+ if (mov1 == 0xB9 && mov2 == 0xB8 && jmp == 0xE0FF) {
21402+ regs->cx = addr1;
21403+ regs->ax = addr2;
21404+ regs->ip = addr2;
21405+ return 2;
21406+ }
21407+ } while (0);
21408+
21409+ do { /* PaX: gcc trampoline emulation #2 */
21410+ unsigned char mov, jmp;
21411+ unsigned int addr1, addr2;
21412+
21413+#ifdef CONFIG_X86_64
21414+ if ((regs->ip + 9) >> 32)
21415+ break;
21416+#endif
21417+
21418+ err = get_user(mov, (unsigned char __user *)regs->ip);
21419+ err |= get_user(addr1, (unsigned int __user *)(regs->ip + 1));
21420+ err |= get_user(jmp, (unsigned char __user *)(regs->ip + 5));
21421+ err |= get_user(addr2, (unsigned int __user *)(regs->ip + 6));
21422+
21423+ if (err)
21424+ break;
21425+
21426+ if (mov == 0xB9 && jmp == 0xE9) {
21427+ regs->cx = addr1;
21428+ regs->ip = (unsigned int)(regs->ip + addr2 + 10);
21429+ return 2;
21430+ }
21431+ } while (0);
21432+
21433+ return 1; /* PaX in action */
21434+}
21435+
21436+#ifdef CONFIG_X86_64
21437+static int pax_handle_fetch_fault_64(struct pt_regs *regs)
21438+{
21439+ int err;
21440+
21441+ do { /* PaX: gcc trampoline emulation #1 */
21442+ unsigned short mov1, mov2, jmp1;
21443+ unsigned char jmp2;
21444+ unsigned int addr1;
21445+ unsigned long addr2;
21446+
21447+ err = get_user(mov1, (unsigned short __user *)regs->ip);
21448+ err |= get_user(addr1, (unsigned int __user *)(regs->ip + 2));
21449+ err |= get_user(mov2, (unsigned short __user *)(regs->ip + 6));
21450+ err |= get_user(addr2, (unsigned long __user *)(regs->ip + 8));
21451+ err |= get_user(jmp1, (unsigned short __user *)(regs->ip + 16));
21452+ err |= get_user(jmp2, (unsigned char __user *)(regs->ip + 18));
21453+
21454+ if (err)
21455+ break;
21456+
21457+ if (mov1 == 0xBB41 && mov2 == 0xBA49 && jmp1 == 0xFF49 && jmp2 == 0xE3) {
21458+ regs->r11 = addr1;
21459+ regs->r10 = addr2;
21460+ regs->ip = addr1;
21461+ return 2;
21462+ }
21463+ } while (0);
21464+
21465+ do { /* PaX: gcc trampoline emulation #2 */
21466+ unsigned short mov1, mov2, jmp1;
21467+ unsigned char jmp2;
21468+ unsigned long addr1, addr2;
21469+
21470+ err = get_user(mov1, (unsigned short __user *)regs->ip);
21471+ err |= get_user(addr1, (unsigned long __user *)(regs->ip + 2));
21472+ err |= get_user(mov2, (unsigned short __user *)(regs->ip + 10));
21473+ err |= get_user(addr2, (unsigned long __user *)(regs->ip + 12));
21474+ err |= get_user(jmp1, (unsigned short __user *)(regs->ip + 20));
21475+ err |= get_user(jmp2, (unsigned char __user *)(regs->ip + 22));
21476+
21477+ if (err)
21478+ break;
21479+
21480+ if (mov1 == 0xBB49 && mov2 == 0xBA49 && jmp1 == 0xFF49 && jmp2 == 0xE3) {
21481+ regs->r11 = addr1;
21482+ regs->r10 = addr2;
21483+ regs->ip = addr1;
21484+ return 2;
21485+ }
21486+ } while (0);
21487+
21488+ return 1; /* PaX in action */
21489+}
21490+#endif
21491+
21492+/*
21493+ * PaX: decide what to do with offenders (regs->ip = fault address)
21494+ *
21495+ * returns 1 when task should be killed
21496+ * 2 when gcc trampoline was detected
21497+ */
21498+static int pax_handle_fetch_fault(struct pt_regs *regs)
21499+{
21500+ if (v8086_mode(regs))
21501+ return 1;
21502+
21503+ if (!(current->mm->pax_flags & MF_PAX_EMUTRAMP))
21504+ return 1;
21505+
21506+#ifdef CONFIG_X86_32
21507+ return pax_handle_fetch_fault_32(regs);
21508+#else
21509+ if (regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT))
21510+ return pax_handle_fetch_fault_32(regs);
21511+ else
21512+ return pax_handle_fetch_fault_64(regs);
21513+#endif
21514+}
21515+#endif
21516+
21517+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
21518+void pax_report_insns(void *pc, void *sp)
21519+{
21520+ long i;
21521+
21522+ printk(KERN_ERR "PAX: bytes at PC: ");
21523+ for (i = 0; i < 20; i++) {
21524+ unsigned char c;
21525+ if (get_user(c, (__force unsigned char __user *)pc+i))
21526+ printk(KERN_CONT "?? ");
21527+ else
21528+ printk(KERN_CONT "%02x ", c);
21529+ }
21530+ printk("\n");
21531+
21532+ printk(KERN_ERR "PAX: bytes at SP-%lu: ", (unsigned long)sizeof(long));
21533+ for (i = -1; i < 80 / (long)sizeof(long); i++) {
21534+ unsigned long c;
21535+ if (get_user(c, (__force unsigned long __user *)sp+i))
21536+#ifdef CONFIG_X86_32
21537+ printk(KERN_CONT "???????? ");
21538+#else
21539+ printk(KERN_CONT "???????????????? ");
21540+#endif
21541+ else
21542+ printk(KERN_CONT "%0*lx ", 2 * (int)sizeof(long), c);
21543+ }
21544+ printk("\n");
21545+}
21546+#endif
21547+
21548+/**
21549+ * probe_kernel_write(): safely attempt to write to a location
21550+ * @dst: address to write to
21551+ * @src: pointer to the data that shall be written
21552+ * @size: size of the data chunk
21553+ *
21554+ * Safely write to address @dst from the buffer at @src. If a kernel fault
21555+ * happens, handle that and return -EFAULT.
21556+ */
21557+long notrace probe_kernel_write(void *dst, const void *src, size_t size)
21558+{
21559+ long ret;
21560+ mm_segment_t old_fs = get_fs();
21561+
21562+ set_fs(KERNEL_DS);
21563+ pagefault_disable();
21564+ pax_open_kernel();
21565+ ret = __copy_to_user_inatomic((__force void __user *)dst, src, size);
21566+ pax_close_kernel();
21567+ pagefault_enable();
21568+ set_fs(old_fs);
21569+
21570+ return ret ? -EFAULT : 0;
21571+}
21572diff -urNp linux-2.6.39/arch/x86/mm/gup.c linux-2.6.39/arch/x86/mm/gup.c
21573--- linux-2.6.39/arch/x86/mm/gup.c 2011-05-19 00:06:34.000000000 -0400
21574+++ linux-2.6.39/arch/x86/mm/gup.c 2011-05-22 19:36:30.000000000 -0400
21575@@ -263,7 +263,7 @@ int __get_user_pages_fast(unsigned long
21576 addr = start;
21577 len = (unsigned long) nr_pages << PAGE_SHIFT;
21578 end = start + len;
21579- if (unlikely(!access_ok(write ? VERIFY_WRITE : VERIFY_READ,
21580+ if (unlikely(!__access_ok(write ? VERIFY_WRITE : VERIFY_READ,
21581 (void __user *)start, len)))
21582 return 0;
21583
21584diff -urNp linux-2.6.39/arch/x86/mm/highmem_32.c linux-2.6.39/arch/x86/mm/highmem_32.c
21585--- linux-2.6.39/arch/x86/mm/highmem_32.c 2011-05-19 00:06:34.000000000 -0400
21586+++ linux-2.6.39/arch/x86/mm/highmem_32.c 2011-05-22 19:36:30.000000000 -0400
21587@@ -44,7 +44,10 @@ void *kmap_atomic_prot(struct page *page
21588 idx = type + KM_TYPE_NR*smp_processor_id();
21589 vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
21590 BUG_ON(!pte_none(*(kmap_pte-idx)));
21591+
21592+ pax_open_kernel();
21593 set_pte(kmap_pte-idx, mk_pte(page, prot));
21594+ pax_close_kernel();
21595
21596 return (void *)vaddr;
21597 }
21598diff -urNp linux-2.6.39/arch/x86/mm/hugetlbpage.c linux-2.6.39/arch/x86/mm/hugetlbpage.c
21599--- linux-2.6.39/arch/x86/mm/hugetlbpage.c 2011-05-19 00:06:34.000000000 -0400
21600+++ linux-2.6.39/arch/x86/mm/hugetlbpage.c 2011-05-22 19:36:30.000000000 -0400
21601@@ -266,13 +266,20 @@ static unsigned long hugetlb_get_unmappe
21602 struct hstate *h = hstate_file(file);
21603 struct mm_struct *mm = current->mm;
21604 struct vm_area_struct *vma;
21605- unsigned long start_addr;
21606+ unsigned long start_addr, pax_task_size = TASK_SIZE;
21607+
21608+#ifdef CONFIG_PAX_SEGMEXEC
21609+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
21610+ pax_task_size = SEGMEXEC_TASK_SIZE;
21611+#endif
21612+
21613+ pax_task_size -= PAGE_SIZE;
21614
21615 if (len > mm->cached_hole_size) {
21616- start_addr = mm->free_area_cache;
21617+ start_addr = mm->free_area_cache;
21618 } else {
21619- start_addr = TASK_UNMAPPED_BASE;
21620- mm->cached_hole_size = 0;
21621+ start_addr = mm->mmap_base;
21622+ mm->cached_hole_size = 0;
21623 }
21624
21625 full_search:
21626@@ -280,26 +287,27 @@ full_search:
21627
21628 for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
21629 /* At this point: (!vma || addr < vma->vm_end). */
21630- if (TASK_SIZE - len < addr) {
21631+ if (pax_task_size - len < addr) {
21632 /*
21633 * Start a new search - just in case we missed
21634 * some holes.
21635 */
21636- if (start_addr != TASK_UNMAPPED_BASE) {
21637- start_addr = TASK_UNMAPPED_BASE;
21638+ if (start_addr != mm->mmap_base) {
21639+ start_addr = mm->mmap_base;
21640 mm->cached_hole_size = 0;
21641 goto full_search;
21642 }
21643 return -ENOMEM;
21644 }
21645- if (!vma || addr + len <= vma->vm_start) {
21646- mm->free_area_cache = addr + len;
21647- return addr;
21648- }
21649+ if (check_heap_stack_gap(vma, addr, len))
21650+ break;
21651 if (addr + mm->cached_hole_size < vma->vm_start)
21652 mm->cached_hole_size = vma->vm_start - addr;
21653 addr = ALIGN(vma->vm_end, huge_page_size(h));
21654 }
21655+
21656+ mm->free_area_cache = addr + len;
21657+ return addr;
21658 }
21659
21660 static unsigned long hugetlb_get_unmapped_area_topdown(struct file *file,
21661@@ -308,10 +316,9 @@ static unsigned long hugetlb_get_unmappe
21662 {
21663 struct hstate *h = hstate_file(file);
21664 struct mm_struct *mm = current->mm;
21665- struct vm_area_struct *vma, *prev_vma;
21666- unsigned long base = mm->mmap_base, addr = addr0;
21667+ struct vm_area_struct *vma;
21668+ unsigned long base = mm->mmap_base, addr;
21669 unsigned long largest_hole = mm->cached_hole_size;
21670- int first_time = 1;
21671
21672 /* don't allow allocations above current base */
21673 if (mm->free_area_cache > base)
21674@@ -321,64 +328,63 @@ static unsigned long hugetlb_get_unmappe
21675 largest_hole = 0;
21676 mm->free_area_cache = base;
21677 }
21678-try_again:
21679+
21680 /* make sure it can fit in the remaining address space */
21681 if (mm->free_area_cache < len)
21682 goto fail;
21683
21684 /* either no address requested or can't fit in requested address hole */
21685- addr = (mm->free_area_cache - len) & huge_page_mask(h);
21686+ addr = (mm->free_area_cache - len);
21687 do {
21688+ addr &= huge_page_mask(h);
21689+ vma = find_vma(mm, addr);
21690 /*
21691 * Lookup failure means no vma is above this address,
21692 * i.e. return with success:
21693- */
21694- if (!(vma = find_vma_prev(mm, addr, &prev_vma)))
21695- return addr;
21696-
21697- /*
21698 * new region fits between prev_vma->vm_end and
21699 * vma->vm_start, use it:
21700 */
21701- if (addr + len <= vma->vm_start &&
21702- (!prev_vma || (addr >= prev_vma->vm_end))) {
21703+ if (check_heap_stack_gap(vma, addr, len)) {
21704 /* remember the address as a hint for next time */
21705- mm->cached_hole_size = largest_hole;
21706- return (mm->free_area_cache = addr);
21707- } else {
21708- /* pull free_area_cache down to the first hole */
21709- if (mm->free_area_cache == vma->vm_end) {
21710- mm->free_area_cache = vma->vm_start;
21711- mm->cached_hole_size = largest_hole;
21712- }
21713+ mm->cached_hole_size = largest_hole;
21714+ return (mm->free_area_cache = addr);
21715+ }
21716+ /* pull free_area_cache down to the first hole */
21717+ if (mm->free_area_cache == vma->vm_end) {
21718+ mm->free_area_cache = vma->vm_start;
21719+ mm->cached_hole_size = largest_hole;
21720 }
21721
21722 /* remember the largest hole we saw so far */
21723 if (addr + largest_hole < vma->vm_start)
21724- largest_hole = vma->vm_start - addr;
21725+ largest_hole = vma->vm_start - addr;
21726
21727 /* try just below the current vma->vm_start */
21728- addr = (vma->vm_start - len) & huge_page_mask(h);
21729- } while (len <= vma->vm_start);
21730+ addr = skip_heap_stack_gap(vma, len);
21731+ } while (!IS_ERR_VALUE(addr));
21732
21733 fail:
21734 /*
21735- * if hint left us with no space for the requested
21736- * mapping then try again:
21737- */
21738- if (first_time) {
21739- mm->free_area_cache = base;
21740- largest_hole = 0;
21741- first_time = 0;
21742- goto try_again;
21743- }
21744- /*
21745 * A failed mmap() very likely causes application failure,
21746 * so fall back to the bottom-up function here. This scenario
21747 * can happen with large stack limits and large mmap()
21748 * allocations.
21749 */
21750- mm->free_area_cache = TASK_UNMAPPED_BASE;
21751+
21752+#ifdef CONFIG_PAX_SEGMEXEC
21753+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
21754+ mm->mmap_base = SEGMEXEC_TASK_UNMAPPED_BASE;
21755+ else
21756+#endif
21757+
21758+ mm->mmap_base = TASK_UNMAPPED_BASE;
21759+
21760+#ifdef CONFIG_PAX_RANDMMAP
21761+ if (mm->pax_flags & MF_PAX_RANDMMAP)
21762+ mm->mmap_base += mm->delta_mmap;
21763+#endif
21764+
21765+ mm->free_area_cache = mm->mmap_base;
21766 mm->cached_hole_size = ~0UL;
21767 addr = hugetlb_get_unmapped_area_bottomup(file, addr0,
21768 len, pgoff, flags);
21769@@ -386,6 +392,7 @@ fail:
21770 /*
21771 * Restore the topdown base:
21772 */
21773+ mm->mmap_base = base;
21774 mm->free_area_cache = base;
21775 mm->cached_hole_size = ~0UL;
21776
21777@@ -399,10 +406,19 @@ hugetlb_get_unmapped_area(struct file *f
21778 struct hstate *h = hstate_file(file);
21779 struct mm_struct *mm = current->mm;
21780 struct vm_area_struct *vma;
21781+ unsigned long pax_task_size = TASK_SIZE;
21782
21783 if (len & ~huge_page_mask(h))
21784 return -EINVAL;
21785- if (len > TASK_SIZE)
21786+
21787+#ifdef CONFIG_PAX_SEGMEXEC
21788+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
21789+ pax_task_size = SEGMEXEC_TASK_SIZE;
21790+#endif
21791+
21792+ pax_task_size -= PAGE_SIZE;
21793+
21794+ if (len > pax_task_size)
21795 return -ENOMEM;
21796
21797 if (flags & MAP_FIXED) {
21798@@ -414,8 +430,7 @@ hugetlb_get_unmapped_area(struct file *f
21799 if (addr) {
21800 addr = ALIGN(addr, huge_page_size(h));
21801 vma = find_vma(mm, addr);
21802- if (TASK_SIZE - len >= addr &&
21803- (!vma || addr + len <= vma->vm_start))
21804+ if (pax_task_size - len >= addr && check_heap_stack_gap(vma, addr, len))
21805 return addr;
21806 }
21807 if (mm->get_unmapped_area == arch_get_unmapped_area)
21808diff -urNp linux-2.6.39/arch/x86/mm/init_32.c linux-2.6.39/arch/x86/mm/init_32.c
21809--- linux-2.6.39/arch/x86/mm/init_32.c 2011-05-19 00:06:34.000000000 -0400
21810+++ linux-2.6.39/arch/x86/mm/init_32.c 2011-05-22 19:36:30.000000000 -0400
21811@@ -74,36 +74,6 @@ static __init void *alloc_low_page(void)
21812 }
21813
21814 /*
21815- * Creates a middle page table and puts a pointer to it in the
21816- * given global directory entry. This only returns the gd entry
21817- * in non-PAE compilation mode, since the middle layer is folded.
21818- */
21819-static pmd_t * __init one_md_table_init(pgd_t *pgd)
21820-{
21821- pud_t *pud;
21822- pmd_t *pmd_table;
21823-
21824-#ifdef CONFIG_X86_PAE
21825- if (!(pgd_val(*pgd) & _PAGE_PRESENT)) {
21826- if (after_bootmem)
21827- pmd_table = (pmd_t *)alloc_bootmem_pages(PAGE_SIZE);
21828- else
21829- pmd_table = (pmd_t *)alloc_low_page();
21830- paravirt_alloc_pmd(&init_mm, __pa(pmd_table) >> PAGE_SHIFT);
21831- set_pgd(pgd, __pgd(__pa(pmd_table) | _PAGE_PRESENT));
21832- pud = pud_offset(pgd, 0);
21833- BUG_ON(pmd_table != pmd_offset(pud, 0));
21834-
21835- return pmd_table;
21836- }
21837-#endif
21838- pud = pud_offset(pgd, 0);
21839- pmd_table = pmd_offset(pud, 0);
21840-
21841- return pmd_table;
21842-}
21843-
21844-/*
21845 * Create a page table and place a pointer to it in a middle page
21846 * directory entry:
21847 */
21848@@ -123,13 +93,28 @@ static pte_t * __init one_page_table_ini
21849 page_table = (pte_t *)alloc_low_page();
21850
21851 paravirt_alloc_pte(&init_mm, __pa(page_table) >> PAGE_SHIFT);
21852+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
21853+ set_pmd(pmd, __pmd(__pa(page_table) | _KERNPG_TABLE));
21854+#else
21855 set_pmd(pmd, __pmd(__pa(page_table) | _PAGE_TABLE));
21856+#endif
21857 BUG_ON(page_table != pte_offset_kernel(pmd, 0));
21858 }
21859
21860 return pte_offset_kernel(pmd, 0);
21861 }
21862
21863+static pmd_t * __init one_md_table_init(pgd_t *pgd)
21864+{
21865+ pud_t *pud;
21866+ pmd_t *pmd_table;
21867+
21868+ pud = pud_offset(pgd, 0);
21869+ pmd_table = pmd_offset(pud, 0);
21870+
21871+ return pmd_table;
21872+}
21873+
21874 pmd_t * __init populate_extra_pmd(unsigned long vaddr)
21875 {
21876 int pgd_idx = pgd_index(vaddr);
21877@@ -203,6 +188,7 @@ page_table_range_init(unsigned long star
21878 int pgd_idx, pmd_idx;
21879 unsigned long vaddr;
21880 pgd_t *pgd;
21881+ pud_t *pud;
21882 pmd_t *pmd;
21883 pte_t *pte = NULL;
21884
21885@@ -212,8 +198,13 @@ page_table_range_init(unsigned long star
21886 pgd = pgd_base + pgd_idx;
21887
21888 for ( ; (pgd_idx < PTRS_PER_PGD) && (vaddr != end); pgd++, pgd_idx++) {
21889- pmd = one_md_table_init(pgd);
21890- pmd = pmd + pmd_index(vaddr);
21891+ pud = pud_offset(pgd, vaddr);
21892+ pmd = pmd_offset(pud, vaddr);
21893+
21894+#ifdef CONFIG_X86_PAE
21895+ paravirt_alloc_pmd(&init_mm, __pa(pmd) >> PAGE_SHIFT);
21896+#endif
21897+
21898 for (; (pmd_idx < PTRS_PER_PMD) && (vaddr != end);
21899 pmd++, pmd_idx++) {
21900 pte = page_table_kmap_check(one_page_table_init(pmd),
21901@@ -225,11 +216,20 @@ page_table_range_init(unsigned long star
21902 }
21903 }
21904
21905-static inline int is_kernel_text(unsigned long addr)
21906+static inline int is_kernel_text(unsigned long start, unsigned long end)
21907 {
21908- if (addr >= (unsigned long)_text && addr <= (unsigned long)__init_end)
21909- return 1;
21910- return 0;
21911+ if ((start > ktla_ktva((unsigned long)_etext) ||
21912+ end <= ktla_ktva((unsigned long)_stext)) &&
21913+ (start > ktla_ktva((unsigned long)_einittext) ||
21914+ end <= ktla_ktva((unsigned long)_sinittext)) &&
21915+
21916+#ifdef CONFIG_ACPI_SLEEP
21917+ (start > (unsigned long)__va(acpi_wakeup_address) + 0x4000 || end <= (unsigned long)__va(acpi_wakeup_address)) &&
21918+#endif
21919+
21920+ (start > (unsigned long)__va(0xfffff) || end <= (unsigned long)__va(0xc0000)))
21921+ return 0;
21922+ return 1;
21923 }
21924
21925 /*
21926@@ -246,9 +246,10 @@ kernel_physical_mapping_init(unsigned lo
21927 unsigned long last_map_addr = end;
21928 unsigned long start_pfn, end_pfn;
21929 pgd_t *pgd_base = swapper_pg_dir;
21930- int pgd_idx, pmd_idx, pte_ofs;
21931+ unsigned int pgd_idx, pmd_idx, pte_ofs;
21932 unsigned long pfn;
21933 pgd_t *pgd;
21934+ pud_t *pud;
21935 pmd_t *pmd;
21936 pte_t *pte;
21937 unsigned pages_2m, pages_4k;
21938@@ -281,8 +282,13 @@ repeat:
21939 pfn = start_pfn;
21940 pgd_idx = pgd_index((pfn<<PAGE_SHIFT) + PAGE_OFFSET);
21941 pgd = pgd_base + pgd_idx;
21942- for (; pgd_idx < PTRS_PER_PGD; pgd++, pgd_idx++) {
21943- pmd = one_md_table_init(pgd);
21944+ for (; pgd_idx < PTRS_PER_PGD && pfn < max_low_pfn; pgd++, pgd_idx++) {
21945+ pud = pud_offset(pgd, 0);
21946+ pmd = pmd_offset(pud, 0);
21947+
21948+#ifdef CONFIG_X86_PAE
21949+ paravirt_alloc_pmd(&init_mm, __pa(pmd) >> PAGE_SHIFT);
21950+#endif
21951
21952 if (pfn >= end_pfn)
21953 continue;
21954@@ -294,14 +300,13 @@ repeat:
21955 #endif
21956 for (; pmd_idx < PTRS_PER_PMD && pfn < end_pfn;
21957 pmd++, pmd_idx++) {
21958- unsigned int addr = pfn * PAGE_SIZE + PAGE_OFFSET;
21959+ unsigned long address = pfn * PAGE_SIZE + PAGE_OFFSET;
21960
21961 /*
21962 * Map with big pages if possible, otherwise
21963 * create normal page tables:
21964 */
21965 if (use_pse) {
21966- unsigned int addr2;
21967 pgprot_t prot = PAGE_KERNEL_LARGE;
21968 /*
21969 * first pass will use the same initial
21970@@ -311,11 +316,7 @@ repeat:
21971 __pgprot(PTE_IDENT_ATTR |
21972 _PAGE_PSE);
21973
21974- addr2 = (pfn + PTRS_PER_PTE-1) * PAGE_SIZE +
21975- PAGE_OFFSET + PAGE_SIZE-1;
21976-
21977- if (is_kernel_text(addr) ||
21978- is_kernel_text(addr2))
21979+ if (is_kernel_text(address, address + PMD_SIZE))
21980 prot = PAGE_KERNEL_LARGE_EXEC;
21981
21982 pages_2m++;
21983@@ -332,7 +333,7 @@ repeat:
21984 pte_ofs = pte_index((pfn<<PAGE_SHIFT) + PAGE_OFFSET);
21985 pte += pte_ofs;
21986 for (; pte_ofs < PTRS_PER_PTE && pfn < end_pfn;
21987- pte++, pfn++, pte_ofs++, addr += PAGE_SIZE) {
21988+ pte++, pfn++, pte_ofs++, address += PAGE_SIZE) {
21989 pgprot_t prot = PAGE_KERNEL;
21990 /*
21991 * first pass will use the same initial
21992@@ -340,7 +341,7 @@ repeat:
21993 */
21994 pgprot_t init_prot = __pgprot(PTE_IDENT_ATTR);
21995
21996- if (is_kernel_text(addr))
21997+ if (is_kernel_text(address, address + PAGE_SIZE))
21998 prot = PAGE_KERNEL_EXEC;
21999
22000 pages_4k++;
22001@@ -472,7 +473,7 @@ void __init native_pagetable_setup_start
22002
22003 pud = pud_offset(pgd, va);
22004 pmd = pmd_offset(pud, va);
22005- if (!pmd_present(*pmd))
22006+ if (!pmd_present(*pmd) || pmd_huge(*pmd))
22007 break;
22008
22009 pte = pte_offset_kernel(pmd, va);
22010@@ -524,12 +525,10 @@ void __init early_ioremap_page_table_ran
22011
22012 static void __init pagetable_init(void)
22013 {
22014- pgd_t *pgd_base = swapper_pg_dir;
22015-
22016- permanent_kmaps_init(pgd_base);
22017+ permanent_kmaps_init(swapper_pg_dir);
22018 }
22019
22020-pteval_t __supported_pte_mask __read_mostly = ~(_PAGE_NX | _PAGE_GLOBAL | _PAGE_IOMAP);
22021+pteval_t __supported_pte_mask __read_only = ~(_PAGE_NX | _PAGE_GLOBAL | _PAGE_IOMAP);
22022 EXPORT_SYMBOL_GPL(__supported_pte_mask);
22023
22024 /* user-defined highmem size */
22025@@ -754,6 +753,12 @@ void __init mem_init(void)
22026
22027 pci_iommu_alloc();
22028
22029+#ifdef CONFIG_PAX_PER_CPU_PGD
22030+ clone_pgd_range(get_cpu_pgd(0) + KERNEL_PGD_BOUNDARY,
22031+ swapper_pg_dir + KERNEL_PGD_BOUNDARY,
22032+ KERNEL_PGD_PTRS);
22033+#endif
22034+
22035 #ifdef CONFIG_FLATMEM
22036 BUG_ON(!mem_map);
22037 #endif
22038@@ -771,7 +776,7 @@ void __init mem_init(void)
22039 set_highmem_pages_init();
22040
22041 codesize = (unsigned long) &_etext - (unsigned long) &_text;
22042- datasize = (unsigned long) &_edata - (unsigned long) &_etext;
22043+ datasize = (unsigned long) &_edata - (unsigned long) &_sdata;
22044 initsize = (unsigned long) &__init_end - (unsigned long) &__init_begin;
22045
22046 printk(KERN_INFO "Memory: %luk/%luk available (%dk kernel code, "
22047@@ -812,10 +817,10 @@ void __init mem_init(void)
22048 ((unsigned long)&__init_end -
22049 (unsigned long)&__init_begin) >> 10,
22050
22051- (unsigned long)&_etext, (unsigned long)&_edata,
22052- ((unsigned long)&_edata - (unsigned long)&_etext) >> 10,
22053+ (unsigned long)&_sdata, (unsigned long)&_edata,
22054+ ((unsigned long)&_edata - (unsigned long)&_sdata) >> 10,
22055
22056- (unsigned long)&_text, (unsigned long)&_etext,
22057+ ktla_ktva((unsigned long)&_text), ktla_ktva((unsigned long)&_etext),
22058 ((unsigned long)&_etext - (unsigned long)&_text) >> 10);
22059
22060 /*
22061@@ -893,6 +898,7 @@ void set_kernel_text_rw(void)
22062 if (!kernel_set_to_readonly)
22063 return;
22064
22065+ start = ktla_ktva(start);
22066 pr_debug("Set kernel text: %lx - %lx for read write\n",
22067 start, start+size);
22068
22069@@ -907,6 +913,7 @@ void set_kernel_text_ro(void)
22070 if (!kernel_set_to_readonly)
22071 return;
22072
22073+ start = ktla_ktva(start);
22074 pr_debug("Set kernel text: %lx - %lx for read only\n",
22075 start, start+size);
22076
22077@@ -935,6 +942,7 @@ void mark_rodata_ro(void)
22078 unsigned long start = PFN_ALIGN(_text);
22079 unsigned long size = PFN_ALIGN(_etext) - start;
22080
22081+ start = ktla_ktva(start);
22082 set_pages_ro(virt_to_page(start), size >> PAGE_SHIFT);
22083 printk(KERN_INFO "Write protecting the kernel text: %luk\n",
22084 size >> 10);
22085diff -urNp linux-2.6.39/arch/x86/mm/init_64.c linux-2.6.39/arch/x86/mm/init_64.c
22086--- linux-2.6.39/arch/x86/mm/init_64.c 2011-05-19 00:06:34.000000000 -0400
22087+++ linux-2.6.39/arch/x86/mm/init_64.c 2011-05-22 19:36:30.000000000 -0400
22088@@ -74,7 +74,7 @@ early_param("gbpages", parse_direct_gbpa
22089 * around without checking the pgd every time.
22090 */
22091
22092-pteval_t __supported_pte_mask __read_mostly = ~_PAGE_IOMAP;
22093+pteval_t __supported_pte_mask __read_only = ~(_PAGE_NX | _PAGE_IOMAP);
22094 EXPORT_SYMBOL_GPL(__supported_pte_mask);
22095
22096 int force_personality32;
22097@@ -107,12 +107,22 @@ void sync_global_pgds(unsigned long star
22098
22099 for (address = start; address <= end; address += PGDIR_SIZE) {
22100 const pgd_t *pgd_ref = pgd_offset_k(address);
22101+
22102+#ifdef CONFIG_PAX_PER_CPU_PGD
22103+ unsigned long cpu;
22104+#else
22105 struct page *page;
22106+#endif
22107
22108 if (pgd_none(*pgd_ref))
22109 continue;
22110
22111 spin_lock(&pgd_lock);
22112+
22113+#ifdef CONFIG_PAX_PER_CPU_PGD
22114+ for (cpu = 0; cpu < NR_CPUS; ++cpu) {
22115+ pgd_t *pgd = pgd_offset_cpu(cpu, address);
22116+#else
22117 list_for_each_entry(page, &pgd_list, lru) {
22118 pgd_t *pgd;
22119 spinlock_t *pgt_lock;
22120@@ -121,6 +131,7 @@ void sync_global_pgds(unsigned long star
22121 /* the pgt_lock only for Xen */
22122 pgt_lock = &pgd_page_get_mm(page)->page_table_lock;
22123 spin_lock(pgt_lock);
22124+#endif
22125
22126 if (pgd_none(*pgd))
22127 set_pgd(pgd, *pgd_ref);
22128@@ -128,7 +139,10 @@ void sync_global_pgds(unsigned long star
22129 BUG_ON(pgd_page_vaddr(*pgd)
22130 != pgd_page_vaddr(*pgd_ref));
22131
22132+#ifndef CONFIG_PAX_PER_CPU_PGD
22133 spin_unlock(pgt_lock);
22134+#endif
22135+
22136 }
22137 spin_unlock(&pgd_lock);
22138 }
22139@@ -202,7 +216,9 @@ void set_pte_vaddr_pud(pud_t *pud_page,
22140 pmd = fill_pmd(pud, vaddr);
22141 pte = fill_pte(pmd, vaddr);
22142
22143+ pax_open_kernel();
22144 set_pte(pte, new_pte);
22145+ pax_close_kernel();
22146
22147 /*
22148 * It's enough to flush this one mapping.
22149@@ -261,14 +277,12 @@ static void __init __init_extra_mapping(
22150 pgd = pgd_offset_k((unsigned long)__va(phys));
22151 if (pgd_none(*pgd)) {
22152 pud = (pud_t *) spp_getpage();
22153- set_pgd(pgd, __pgd(__pa(pud) | _KERNPG_TABLE |
22154- _PAGE_USER));
22155+ set_pgd(pgd, __pgd(__pa(pud) | _PAGE_TABLE));
22156 }
22157 pud = pud_offset(pgd, (unsigned long)__va(phys));
22158 if (pud_none(*pud)) {
22159 pmd = (pmd_t *) spp_getpage();
22160- set_pud(pud, __pud(__pa(pmd) | _KERNPG_TABLE |
22161- _PAGE_USER));
22162+ set_pud(pud, __pud(__pa(pmd) | _PAGE_TABLE));
22163 }
22164 pmd = pmd_offset(pud, phys);
22165 BUG_ON(!pmd_none(*pmd));
22166@@ -698,6 +712,12 @@ void __init mem_init(void)
22167
22168 pci_iommu_alloc();
22169
22170+#ifdef CONFIG_PAX_PER_CPU_PGD
22171+ clone_pgd_range(get_cpu_pgd(0) + KERNEL_PGD_BOUNDARY,
22172+ swapper_pg_dir + KERNEL_PGD_BOUNDARY,
22173+ KERNEL_PGD_PTRS);
22174+#endif
22175+
22176 /* clear_bss() already clear the empty_zero_page */
22177
22178 reservedpages = 0;
22179@@ -858,8 +878,8 @@ int kern_addr_valid(unsigned long addr)
22180 static struct vm_area_struct gate_vma = {
22181 .vm_start = VSYSCALL_START,
22182 .vm_end = VSYSCALL_START + (VSYSCALL_MAPPED_PAGES * PAGE_SIZE),
22183- .vm_page_prot = PAGE_READONLY_EXEC,
22184- .vm_flags = VM_READ | VM_EXEC
22185+ .vm_page_prot = PAGE_READONLY,
22186+ .vm_flags = VM_READ
22187 };
22188
22189 struct vm_area_struct *get_gate_vma(struct mm_struct *mm)
22190@@ -893,7 +913,7 @@ int in_gate_area_no_mm(unsigned long add
22191
22192 const char *arch_vma_name(struct vm_area_struct *vma)
22193 {
22194- if (vma->vm_mm && vma->vm_start == (long)vma->vm_mm->context.vdso)
22195+ if (vma->vm_mm && vma->vm_start == vma->vm_mm->context.vdso)
22196 return "[vdso]";
22197 if (vma == &gate_vma)
22198 return "[vsyscall]";
22199diff -urNp linux-2.6.39/arch/x86/mm/init.c linux-2.6.39/arch/x86/mm/init.c
22200--- linux-2.6.39/arch/x86/mm/init.c 2011-05-19 00:06:34.000000000 -0400
22201+++ linux-2.6.39/arch/x86/mm/init.c 2011-05-23 19:01:08.000000000 -0400
22202@@ -33,7 +33,7 @@ int direct_gbpages
22203 static void __init find_early_table_space(unsigned long end, int use_pse,
22204 int use_gbpages)
22205 {
22206- unsigned long puds, pmds, ptes, tables, start = 0, good_end = end;
22207+ unsigned long puds, pmds, ptes, tables, start = 0x100000, good_end = end;
22208 phys_addr_t base;
22209
22210 puds = (end + PUD_SIZE - 1) >> PUD_SHIFT;
22211@@ -315,12 +315,25 @@ unsigned long __init_refok init_memory_m
22212 */
22213 int devmem_is_allowed(unsigned long pagenr)
22214 {
22215- if (pagenr <= 256)
22216+#ifndef CONFIG_GRKERNSEC_KMEM
22217+ if (!pagenr)
22218+ return 1;
22219+#ifdef CONFIG_VM86
22220+ if (pagenr < (ISA_START_ADDRESS >> PAGE_SHIFT))
22221+ return 1;
22222+#endif
22223+#else
22224+ if (pagenr < (ISA_START_ADDRESS >> PAGE_SHIFT))
22225+ return 0;
22226+#endif
22227+
22228+ if ((ISA_START_ADDRESS >> PAGE_SHIFT) <= pagenr && pagenr < (ISA_END_ADDRESS >> PAGE_SHIFT))
22229 return 1;
22230 if (iomem_is_exclusive(pagenr << PAGE_SHIFT))
22231 return 0;
22232 if (!page_is_ram(pagenr))
22233 return 1;
22234+
22235 return 0;
22236 }
22237
22238@@ -375,6 +388,86 @@ void free_init_pages(char *what, unsigne
22239
22240 void free_initmem(void)
22241 {
22242+
22243+#ifdef CONFIG_PAX_KERNEXEC
22244+#ifdef CONFIG_X86_32
22245+ /* PaX: limit KERNEL_CS to actual size */
22246+ unsigned long addr, limit;
22247+ struct desc_struct d;
22248+ int cpu;
22249+
22250+ limit = paravirt_enabled() ? ktva_ktla(0xffffffff) : (unsigned long)&_etext;
22251+ limit = (limit - 1UL) >> PAGE_SHIFT;
22252+
22253+ memset(__LOAD_PHYSICAL_ADDR + PAGE_OFFSET, POISON_FREE_INITMEM, PAGE_SIZE);
22254+ for (cpu = 0; cpu < NR_CPUS; cpu++) {
22255+ pack_descriptor(&d, get_desc_base(&get_cpu_gdt_table(cpu)[GDT_ENTRY_KERNEL_CS]), limit, 0x9B, 0xC);
22256+ write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_KERNEL_CS, &d, DESCTYPE_S);
22257+ }
22258+
22259+ /* PaX: make KERNEL_CS read-only */
22260+ addr = PFN_ALIGN(ktla_ktva((unsigned long)&_text));
22261+ if (!paravirt_enabled())
22262+ set_memory_ro(addr, (PFN_ALIGN(_sdata) - addr) >> PAGE_SHIFT);
22263+/*
22264+ for (addr = ktla_ktva((unsigned long)&_text); addr < (unsigned long)&_sdata; addr += PMD_SIZE) {
22265+ pgd = pgd_offset_k(addr);
22266+ pud = pud_offset(pgd, addr);
22267+ pmd = pmd_offset(pud, addr);
22268+ set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
22269+ }
22270+*/
22271+#ifdef CONFIG_X86_PAE
22272+ set_memory_nx(PFN_ALIGN(__init_begin), (PFN_ALIGN(__init_end) - PFN_ALIGN(__init_begin)) >> PAGE_SHIFT);
22273+/*
22274+ for (addr = (unsigned long)&__init_begin; addr < (unsigned long)&__init_end; addr += PMD_SIZE) {
22275+ pgd = pgd_offset_k(addr);
22276+ pud = pud_offset(pgd, addr);
22277+ pmd = pmd_offset(pud, addr);
22278+ set_pmd(pmd, __pmd(pmd_val(*pmd) | (_PAGE_NX & __supported_pte_mask)));
22279+ }
22280+*/
22281+#endif
22282+
22283+#ifdef CONFIG_MODULES
22284+ set_memory_4k((unsigned long)MODULES_EXEC_VADDR, (MODULES_EXEC_END - MODULES_EXEC_VADDR) >> PAGE_SHIFT);
22285+#endif
22286+
22287+#else
22288+ pgd_t *pgd;
22289+ pud_t *pud;
22290+ pmd_t *pmd;
22291+ unsigned long addr, end;
22292+
22293+ /* PaX: make kernel code/rodata read-only, rest non-executable */
22294+ for (addr = __START_KERNEL_map; addr < __START_KERNEL_map + KERNEL_IMAGE_SIZE; addr += PMD_SIZE) {
22295+ pgd = pgd_offset_k(addr);
22296+ pud = pud_offset(pgd, addr);
22297+ pmd = pmd_offset(pud, addr);
22298+ if (!pmd_present(*pmd))
22299+ continue;
22300+ if ((unsigned long)_text <= addr && addr < (unsigned long)_sdata)
22301+ set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
22302+ else
22303+ set_pmd(pmd, __pmd(pmd_val(*pmd) | (_PAGE_NX & __supported_pte_mask)));
22304+ }
22305+
22306+ addr = (unsigned long)__va(__pa(__START_KERNEL_map));
22307+ end = addr + KERNEL_IMAGE_SIZE;
22308+ for (; addr < end; addr += PMD_SIZE) {
22309+ pgd = pgd_offset_k(addr);
22310+ pud = pud_offset(pgd, addr);
22311+ pmd = pmd_offset(pud, addr);
22312+ if (!pmd_present(*pmd))
22313+ continue;
22314+ if ((unsigned long)__va(__pa(_text)) <= addr && addr < (unsigned long)__va(__pa(_sdata)))
22315+ set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
22316+ }
22317+#endif
22318+
22319+ flush_tlb_all();
22320+#endif
22321+
22322 free_init_pages("unused kernel memory",
22323 (unsigned long)(&__init_begin),
22324 (unsigned long)(&__init_end));
22325diff -urNp linux-2.6.39/arch/x86/mm/iomap_32.c linux-2.6.39/arch/x86/mm/iomap_32.c
22326--- linux-2.6.39/arch/x86/mm/iomap_32.c 2011-05-19 00:06:34.000000000 -0400
22327+++ linux-2.6.39/arch/x86/mm/iomap_32.c 2011-05-22 19:36:30.000000000 -0400
22328@@ -64,7 +64,11 @@ void *kmap_atomic_prot_pfn(unsigned long
22329 type = kmap_atomic_idx_push();
22330 idx = type + KM_TYPE_NR * smp_processor_id();
22331 vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
22332+
22333+ pax_open_kernel();
22334 set_pte(kmap_pte - idx, pfn_pte(pfn, prot));
22335+ pax_close_kernel();
22336+
22337 arch_flush_lazy_mmu_mode();
22338
22339 return (void *)vaddr;
22340diff -urNp linux-2.6.39/arch/x86/mm/ioremap.c linux-2.6.39/arch/x86/mm/ioremap.c
22341--- linux-2.6.39/arch/x86/mm/ioremap.c 2011-05-19 00:06:34.000000000 -0400
22342+++ linux-2.6.39/arch/x86/mm/ioremap.c 2011-05-22 19:36:30.000000000 -0400
22343@@ -104,7 +104,7 @@ static void __iomem *__ioremap_caller(re
22344 for (pfn = phys_addr >> PAGE_SHIFT; pfn <= last_pfn; pfn++) {
22345 int is_ram = page_is_ram(pfn);
22346
22347- if (is_ram && pfn_valid(pfn) && !PageReserved(pfn_to_page(pfn)))
22348+ if (is_ram && pfn_valid(pfn) && (pfn >= 0x100 || !PageReserved(pfn_to_page(pfn))))
22349 return NULL;
22350 WARN_ON_ONCE(is_ram);
22351 }
22352@@ -344,7 +344,7 @@ static int __init early_ioremap_debug_se
22353 early_param("early_ioremap_debug", early_ioremap_debug_setup);
22354
22355 static __initdata int after_paging_init;
22356-static pte_t bm_pte[PAGE_SIZE/sizeof(pte_t)] __page_aligned_bss;
22357+static pte_t bm_pte[PAGE_SIZE/sizeof(pte_t)] __read_only __aligned(PAGE_SIZE);
22358
22359 static inline pmd_t * __init early_ioremap_pmd(unsigned long addr)
22360 {
22361@@ -381,8 +381,7 @@ void __init early_ioremap_init(void)
22362 slot_virt[i] = __fix_to_virt(FIX_BTMAP_BEGIN - NR_FIX_BTMAPS*i);
22363
22364 pmd = early_ioremap_pmd(fix_to_virt(FIX_BTMAP_BEGIN));
22365- memset(bm_pte, 0, sizeof(bm_pte));
22366- pmd_populate_kernel(&init_mm, pmd, bm_pte);
22367+ pmd_populate_user(&init_mm, pmd, bm_pte);
22368
22369 /*
22370 * The boot-ioremap range spans multiple pmds, for which
22371diff -urNp linux-2.6.39/arch/x86/mm/kmemcheck/kmemcheck.c linux-2.6.39/arch/x86/mm/kmemcheck/kmemcheck.c
22372--- linux-2.6.39/arch/x86/mm/kmemcheck/kmemcheck.c 2011-05-19 00:06:34.000000000 -0400
22373+++ linux-2.6.39/arch/x86/mm/kmemcheck/kmemcheck.c 2011-05-22 19:36:30.000000000 -0400
22374@@ -622,9 +622,9 @@ bool kmemcheck_fault(struct pt_regs *reg
22375 * memory (e.g. tracked pages)? For now, we need this to avoid
22376 * invoking kmemcheck for PnP BIOS calls.
22377 */
22378- if (regs->flags & X86_VM_MASK)
22379+ if (v8086_mode(regs))
22380 return false;
22381- if (regs->cs != __KERNEL_CS)
22382+ if (regs->cs != __KERNEL_CS && regs->cs != __KERNEXEC_KERNEL_CS)
22383 return false;
22384
22385 pte = kmemcheck_pte_lookup(address);
22386diff -urNp linux-2.6.39/arch/x86/mm/mmap.c linux-2.6.39/arch/x86/mm/mmap.c
22387--- linux-2.6.39/arch/x86/mm/mmap.c 2011-05-19 00:06:34.000000000 -0400
22388+++ linux-2.6.39/arch/x86/mm/mmap.c 2011-05-22 19:36:30.000000000 -0400
22389@@ -49,7 +49,7 @@ static unsigned int stack_maxrandom_size
22390 * Leave an at least ~128 MB hole with possible stack randomization.
22391 */
22392 #define MIN_GAP (128*1024*1024UL + stack_maxrandom_size())
22393-#define MAX_GAP (TASK_SIZE/6*5)
22394+#define MAX_GAP (pax_task_size/6*5)
22395
22396 /*
22397 * True on X86_32 or when emulating IA32 on X86_64
22398@@ -94,27 +94,40 @@ static unsigned long mmap_rnd(void)
22399 return rnd << PAGE_SHIFT;
22400 }
22401
22402-static unsigned long mmap_base(void)
22403+static unsigned long mmap_base(struct mm_struct *mm)
22404 {
22405 unsigned long gap = rlimit(RLIMIT_STACK);
22406+ unsigned long pax_task_size = TASK_SIZE;
22407+
22408+#ifdef CONFIG_PAX_SEGMEXEC
22409+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
22410+ pax_task_size = SEGMEXEC_TASK_SIZE;
22411+#endif
22412
22413 if (gap < MIN_GAP)
22414 gap = MIN_GAP;
22415 else if (gap > MAX_GAP)
22416 gap = MAX_GAP;
22417
22418- return PAGE_ALIGN(TASK_SIZE - gap - mmap_rnd());
22419+ return PAGE_ALIGN(pax_task_size - gap - mmap_rnd());
22420 }
22421
22422 /*
22423 * Bottom-up (legacy) layout on X86_32 did not support randomization, X86_64
22424 * does, but not when emulating X86_32
22425 */
22426-static unsigned long mmap_legacy_base(void)
22427+static unsigned long mmap_legacy_base(struct mm_struct *mm)
22428 {
22429- if (mmap_is_ia32())
22430+ if (mmap_is_ia32()) {
22431+
22432+#ifdef CONFIG_PAX_SEGMEXEC
22433+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
22434+ return SEGMEXEC_TASK_UNMAPPED_BASE;
22435+ else
22436+#endif
22437+
22438 return TASK_UNMAPPED_BASE;
22439- else
22440+ } else
22441 return TASK_UNMAPPED_BASE + mmap_rnd();
22442 }
22443
22444@@ -125,11 +138,23 @@ static unsigned long mmap_legacy_base(vo
22445 void arch_pick_mmap_layout(struct mm_struct *mm)
22446 {
22447 if (mmap_is_legacy()) {
22448- mm->mmap_base = mmap_legacy_base();
22449+ mm->mmap_base = mmap_legacy_base(mm);
22450+
22451+#ifdef CONFIG_PAX_RANDMMAP
22452+ if (mm->pax_flags & MF_PAX_RANDMMAP)
22453+ mm->mmap_base += mm->delta_mmap;
22454+#endif
22455+
22456 mm->get_unmapped_area = arch_get_unmapped_area;
22457 mm->unmap_area = arch_unmap_area;
22458 } else {
22459- mm->mmap_base = mmap_base();
22460+ mm->mmap_base = mmap_base(mm);
22461+
22462+#ifdef CONFIG_PAX_RANDMMAP
22463+ if (mm->pax_flags & MF_PAX_RANDMMAP)
22464+ mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
22465+#endif
22466+
22467 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
22468 mm->unmap_area = arch_unmap_area_topdown;
22469 }
22470diff -urNp linux-2.6.39/arch/x86/mm/mmio-mod.c linux-2.6.39/arch/x86/mm/mmio-mod.c
22471--- linux-2.6.39/arch/x86/mm/mmio-mod.c 2011-05-19 00:06:34.000000000 -0400
22472+++ linux-2.6.39/arch/x86/mm/mmio-mod.c 2011-05-22 19:36:30.000000000 -0400
22473@@ -235,7 +235,7 @@ static void post(struct kmmio_probe *p,
22474 static void ioremap_trace_core(resource_size_t offset, unsigned long size,
22475 void __iomem *addr)
22476 {
22477- static atomic_t next_id;
22478+ static atomic_unchecked_t next_id;
22479 struct remap_trace *trace = kmalloc(sizeof(*trace), GFP_KERNEL);
22480 /* These are page-unaligned. */
22481 struct mmiotrace_map map = {
22482@@ -259,7 +259,7 @@ static void ioremap_trace_core(resource_
22483 .private = trace
22484 },
22485 .phys = offset,
22486- .id = atomic_inc_return(&next_id)
22487+ .id = atomic_inc_return_unchecked(&next_id)
22488 };
22489 map.map_id = trace->id;
22490
22491diff -urNp linux-2.6.39/arch/x86/mm/numa_32.c linux-2.6.39/arch/x86/mm/numa_32.c
22492--- linux-2.6.39/arch/x86/mm/numa_32.c 2011-05-19 00:06:34.000000000 -0400
22493+++ linux-2.6.39/arch/x86/mm/numa_32.c 2011-05-22 19:36:30.000000000 -0400
22494@@ -99,7 +99,6 @@ unsigned long node_memmap_size_bytes(int
22495 }
22496 #endif
22497
22498-extern unsigned long find_max_low_pfn(void);
22499 extern unsigned long highend_pfn, highstart_pfn;
22500
22501 #define LARGE_PAGE_BYTES (PTRS_PER_PTE * PAGE_SIZE)
22502diff -urNp linux-2.6.39/arch/x86/mm/pageattr.c linux-2.6.39/arch/x86/mm/pageattr.c
22503--- linux-2.6.39/arch/x86/mm/pageattr.c 2011-05-19 00:06:34.000000000 -0400
22504+++ linux-2.6.39/arch/x86/mm/pageattr.c 2011-05-22 19:36:30.000000000 -0400
22505@@ -261,7 +261,7 @@ static inline pgprot_t static_protection
22506 */
22507 #ifdef CONFIG_PCI_BIOS
22508 if (pcibios_enabled && within(pfn, BIOS_BEGIN >> PAGE_SHIFT, BIOS_END >> PAGE_SHIFT))
22509- pgprot_val(forbidden) |= _PAGE_NX;
22510+ pgprot_val(forbidden) |= _PAGE_NX & __supported_pte_mask;
22511 #endif
22512
22513 /*
22514@@ -269,9 +269,10 @@ static inline pgprot_t static_protection
22515 * Does not cover __inittext since that is gone later on. On
22516 * 64bit we do not enforce !NX on the low mapping
22517 */
22518- if (within(address, (unsigned long)_text, (unsigned long)_etext))
22519- pgprot_val(forbidden) |= _PAGE_NX;
22520+ if (within(address, ktla_ktva((unsigned long)_text), ktla_ktva((unsigned long)_etext)))
22521+ pgprot_val(forbidden) |= _PAGE_NX & __supported_pte_mask;
22522
22523+#ifdef CONFIG_DEBUG_RODATA
22524 /*
22525 * The .rodata section needs to be read-only. Using the pfn
22526 * catches all aliases.
22527@@ -279,6 +280,7 @@ static inline pgprot_t static_protection
22528 if (within(pfn, __pa((unsigned long)__start_rodata) >> PAGE_SHIFT,
22529 __pa((unsigned long)__end_rodata) >> PAGE_SHIFT))
22530 pgprot_val(forbidden) |= _PAGE_RW;
22531+#endif
22532
22533 #if defined(CONFIG_X86_64) && defined(CONFIG_DEBUG_RODATA)
22534 /*
22535@@ -317,6 +319,13 @@ static inline pgprot_t static_protection
22536 }
22537 #endif
22538
22539+#ifdef CONFIG_PAX_KERNEXEC
22540+ if (within(pfn, __pa((unsigned long)&_text), __pa((unsigned long)&_sdata))) {
22541+ pgprot_val(forbidden) |= _PAGE_RW;
22542+ pgprot_val(forbidden) |= _PAGE_NX & __supported_pte_mask;
22543+ }
22544+#endif
22545+
22546 prot = __pgprot(pgprot_val(prot) & ~pgprot_val(forbidden));
22547
22548 return prot;
22549@@ -369,23 +378,37 @@ EXPORT_SYMBOL_GPL(lookup_address);
22550 static void __set_pmd_pte(pte_t *kpte, unsigned long address, pte_t pte)
22551 {
22552 /* change init_mm */
22553+ pax_open_kernel();
22554 set_pte_atomic(kpte, pte);
22555+
22556 #ifdef CONFIG_X86_32
22557 if (!SHARED_KERNEL_PMD) {
22558+
22559+#ifdef CONFIG_PAX_PER_CPU_PGD
22560+ unsigned long cpu;
22561+#else
22562 struct page *page;
22563+#endif
22564
22565+#ifdef CONFIG_PAX_PER_CPU_PGD
22566+ for (cpu = 0; cpu < NR_CPUS; ++cpu) {
22567+ pgd_t *pgd = get_cpu_pgd(cpu);
22568+#else
22569 list_for_each_entry(page, &pgd_list, lru) {
22570- pgd_t *pgd;
22571+ pgd_t *pgd = (pgd_t *)page_address(page);
22572+#endif
22573+
22574 pud_t *pud;
22575 pmd_t *pmd;
22576
22577- pgd = (pgd_t *)page_address(page) + pgd_index(address);
22578+ pgd += pgd_index(address);
22579 pud = pud_offset(pgd, address);
22580 pmd = pmd_offset(pud, address);
22581 set_pte_atomic((pte_t *)pmd, pte);
22582 }
22583 }
22584 #endif
22585+ pax_close_kernel();
22586 }
22587
22588 static int
22589diff -urNp linux-2.6.39/arch/x86/mm/pageattr-test.c linux-2.6.39/arch/x86/mm/pageattr-test.c
22590--- linux-2.6.39/arch/x86/mm/pageattr-test.c 2011-05-19 00:06:34.000000000 -0400
22591+++ linux-2.6.39/arch/x86/mm/pageattr-test.c 2011-05-22 19:36:30.000000000 -0400
22592@@ -36,7 +36,7 @@ enum {
22593
22594 static int pte_testbit(pte_t pte)
22595 {
22596- return pte_flags(pte) & _PAGE_UNUSED1;
22597+ return pte_flags(pte) & _PAGE_CPA_TEST;
22598 }
22599
22600 struct split_state {
22601diff -urNp linux-2.6.39/arch/x86/mm/pat.c linux-2.6.39/arch/x86/mm/pat.c
22602--- linux-2.6.39/arch/x86/mm/pat.c 2011-05-19 00:06:34.000000000 -0400
22603+++ linux-2.6.39/arch/x86/mm/pat.c 2011-05-22 19:36:30.000000000 -0400
22604@@ -361,7 +361,7 @@ int free_memtype(u64 start, u64 end)
22605
22606 if (!entry) {
22607 printk(KERN_INFO "%s:%d freeing invalid memtype %Lx-%Lx\n",
22608- current->comm, current->pid, start, end);
22609+ current->comm, task_pid_nr(current), start, end);
22610 return -EINVAL;
22611 }
22612
22613@@ -492,8 +492,8 @@ static inline int range_is_allowed(unsig
22614 while (cursor < to) {
22615 if (!devmem_is_allowed(pfn)) {
22616 printk(KERN_INFO
22617- "Program %s tried to access /dev/mem between %Lx->%Lx.\n",
22618- current->comm, from, to);
22619+ "Program %s tried to access /dev/mem between %Lx->%Lx (%Lx).\n",
22620+ current->comm, from, to, cursor);
22621 return 0;
22622 }
22623 cursor += PAGE_SIZE;
22624@@ -557,7 +557,7 @@ int kernel_map_sync_memtype(u64 base, un
22625 printk(KERN_INFO
22626 "%s:%d ioremap_change_attr failed %s "
22627 "for %Lx-%Lx\n",
22628- current->comm, current->pid,
22629+ current->comm, task_pid_nr(current),
22630 cattr_name(flags),
22631 base, (unsigned long long)(base + size));
22632 return -EINVAL;
22633@@ -593,7 +593,7 @@ static int reserve_pfn_range(u64 paddr,
22634 if (want_flags != flags) {
22635 printk(KERN_WARNING
22636 "%s:%d map pfn RAM range req %s for %Lx-%Lx, got %s\n",
22637- current->comm, current->pid,
22638+ current->comm, task_pid_nr(current),
22639 cattr_name(want_flags),
22640 (unsigned long long)paddr,
22641 (unsigned long long)(paddr + size),
22642@@ -615,7 +615,7 @@ static int reserve_pfn_range(u64 paddr,
22643 free_memtype(paddr, paddr + size);
22644 printk(KERN_ERR "%s:%d map pfn expected mapping type %s"
22645 " for %Lx-%Lx, got %s\n",
22646- current->comm, current->pid,
22647+ current->comm, task_pid_nr(current),
22648 cattr_name(want_flags),
22649 (unsigned long long)paddr,
22650 (unsigned long long)(paddr + size),
22651diff -urNp linux-2.6.39/arch/x86/mm/pgtable_32.c linux-2.6.39/arch/x86/mm/pgtable_32.c
22652--- linux-2.6.39/arch/x86/mm/pgtable_32.c 2011-05-19 00:06:34.000000000 -0400
22653+++ linux-2.6.39/arch/x86/mm/pgtable_32.c 2011-05-22 19:36:30.000000000 -0400
22654@@ -48,10 +48,13 @@ void set_pte_vaddr(unsigned long vaddr,
22655 return;
22656 }
22657 pte = pte_offset_kernel(pmd, vaddr);
22658+
22659+ pax_open_kernel();
22660 if (pte_val(pteval))
22661 set_pte_at(&init_mm, vaddr, pte, pteval);
22662 else
22663 pte_clear(&init_mm, vaddr, pte);
22664+ pax_close_kernel();
22665
22666 /*
22667 * It's enough to flush this one mapping.
22668diff -urNp linux-2.6.39/arch/x86/mm/pgtable.c linux-2.6.39/arch/x86/mm/pgtable.c
22669--- linux-2.6.39/arch/x86/mm/pgtable.c 2011-05-19 00:06:34.000000000 -0400
22670+++ linux-2.6.39/arch/x86/mm/pgtable.c 2011-05-22 19:36:30.000000000 -0400
22671@@ -84,10 +84,52 @@ static inline void pgd_list_del(pgd_t *p
22672 list_del(&page->lru);
22673 }
22674
22675-#define UNSHARED_PTRS_PER_PGD \
22676- (SHARED_KERNEL_PMD ? KERNEL_PGD_BOUNDARY : PTRS_PER_PGD)
22677+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
22678+pgdval_t clone_pgd_mask __read_only = ~_PAGE_PRESENT;
22679
22680+void __shadow_user_pgds(pgd_t *dst, const pgd_t *src, int count)
22681+{
22682+ while (count--)
22683+ *dst++ = __pgd((pgd_val(*src++) | (_PAGE_NX & __supported_pte_mask)) & ~_PAGE_USER);
22684+}
22685+#endif
22686+
22687+#ifdef CONFIG_PAX_PER_CPU_PGD
22688+void __clone_user_pgds(pgd_t *dst, const pgd_t *src, int count)
22689+{
22690+ while (count--)
22691+
22692+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
22693+ *dst++ = __pgd(pgd_val(*src++) & clone_pgd_mask);
22694+#else
22695+ *dst++ = *src++;
22696+#endif
22697
22698+}
22699+#endif
22700+
22701+#ifdef CONFIG_X86_64
22702+#define pxd_t pud_t
22703+#define pyd_t pgd_t
22704+#define paravirt_release_pxd(pfn) paravirt_release_pud(pfn)
22705+#define pxd_free(mm, pud) pud_free((mm), (pud))
22706+#define pyd_populate(mm, pgd, pud) pgd_populate((mm), (pgd), (pud))
22707+#define pyd_offset(mm ,address) pgd_offset((mm), (address))
22708+#define PYD_SIZE PGDIR_SIZE
22709+#else
22710+#define pxd_t pmd_t
22711+#define pyd_t pud_t
22712+#define paravirt_release_pxd(pfn) paravirt_release_pmd(pfn)
22713+#define pxd_free(mm, pud) pmd_free((mm), (pud))
22714+#define pyd_populate(mm, pgd, pud) pud_populate((mm), (pgd), (pud))
22715+#define pyd_offset(mm ,address) pud_offset((mm), (address))
22716+#define PYD_SIZE PUD_SIZE
22717+#endif
22718+
22719+#ifdef CONFIG_PAX_PER_CPU_PGD
22720+static inline void pgd_ctor(struct mm_struct *mm, pgd_t *pgd) {}
22721+static inline void pgd_dtor(pgd_t *pgd) {}
22722+#else
22723 static void pgd_set_mm(pgd_t *pgd, struct mm_struct *mm)
22724 {
22725 BUILD_BUG_ON(sizeof(virt_to_page(pgd)->index) < sizeof(mm));
22726@@ -128,6 +170,7 @@ static void pgd_dtor(pgd_t *pgd)
22727 pgd_list_del(pgd);
22728 spin_unlock(&pgd_lock);
22729 }
22730+#endif
22731
22732 /*
22733 * List of all pgd's needed for non-PAE so it can invalidate entries
22734@@ -140,7 +183,7 @@ static void pgd_dtor(pgd_t *pgd)
22735 * -- wli
22736 */
22737
22738-#ifdef CONFIG_X86_PAE
22739+#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE)
22740 /*
22741 * In PAE mode, we need to do a cr3 reload (=tlb flush) when
22742 * updating the top-level pagetable entries to guarantee the
22743@@ -152,7 +195,7 @@ static void pgd_dtor(pgd_t *pgd)
22744 * not shared between pagetables (!SHARED_KERNEL_PMDS), we allocate
22745 * and initialize the kernel pmds here.
22746 */
22747-#define PREALLOCATED_PMDS UNSHARED_PTRS_PER_PGD
22748+#define PREALLOCATED_PXDS (SHARED_KERNEL_PMD ? KERNEL_PGD_BOUNDARY : PTRS_PER_PGD)
22749
22750 void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd)
22751 {
22752@@ -170,36 +213,38 @@ void pud_populate(struct mm_struct *mm,
22753 */
22754 flush_tlb_mm(mm);
22755 }
22756+#elif defined(CONFIG_X86_64) && defined(CONFIG_PAX_PER_CPU_PGD)
22757+#define PREALLOCATED_PXDS USER_PGD_PTRS
22758 #else /* !CONFIG_X86_PAE */
22759
22760 /* No need to prepopulate any pagetable entries in non-PAE modes. */
22761-#define PREALLOCATED_PMDS 0
22762+#define PREALLOCATED_PXDS 0
22763
22764 #endif /* CONFIG_X86_PAE */
22765
22766-static void free_pmds(pmd_t *pmds[])
22767+static void free_pxds(pxd_t *pxds[])
22768 {
22769 int i;
22770
22771- for(i = 0; i < PREALLOCATED_PMDS; i++)
22772- if (pmds[i])
22773- free_page((unsigned long)pmds[i]);
22774+ for(i = 0; i < PREALLOCATED_PXDS; i++)
22775+ if (pxds[i])
22776+ free_page((unsigned long)pxds[i]);
22777 }
22778
22779-static int preallocate_pmds(pmd_t *pmds[])
22780+static int preallocate_pxds(pxd_t *pxds[])
22781 {
22782 int i;
22783 bool failed = false;
22784
22785- for(i = 0; i < PREALLOCATED_PMDS; i++) {
22786- pmd_t *pmd = (pmd_t *)__get_free_page(PGALLOC_GFP);
22787- if (pmd == NULL)
22788+ for(i = 0; i < PREALLOCATED_PXDS; i++) {
22789+ pxd_t *pxd = (pxd_t *)__get_free_page(PGALLOC_GFP);
22790+ if (pxd == NULL)
22791 failed = true;
22792- pmds[i] = pmd;
22793+ pxds[i] = pxd;
22794 }
22795
22796 if (failed) {
22797- free_pmds(pmds);
22798+ free_pxds(pxds);
22799 return -ENOMEM;
22800 }
22801
22802@@ -212,51 +257,55 @@ static int preallocate_pmds(pmd_t *pmds[
22803 * preallocate which never got a corresponding vma will need to be
22804 * freed manually.
22805 */
22806-static void pgd_mop_up_pmds(struct mm_struct *mm, pgd_t *pgdp)
22807+static void pgd_mop_up_pxds(struct mm_struct *mm, pgd_t *pgdp)
22808 {
22809 int i;
22810
22811- for(i = 0; i < PREALLOCATED_PMDS; i++) {
22812+ for(i = 0; i < PREALLOCATED_PXDS; i++) {
22813 pgd_t pgd = pgdp[i];
22814
22815 if (pgd_val(pgd) != 0) {
22816- pmd_t *pmd = (pmd_t *)pgd_page_vaddr(pgd);
22817+ pxd_t *pxd = (pxd_t *)pgd_page_vaddr(pgd);
22818
22819- pgdp[i] = native_make_pgd(0);
22820+ set_pgd(pgdp + i, native_make_pgd(0));
22821
22822- paravirt_release_pmd(pgd_val(pgd) >> PAGE_SHIFT);
22823- pmd_free(mm, pmd);
22824+ paravirt_release_pxd(pgd_val(pgd) >> PAGE_SHIFT);
22825+ pxd_free(mm, pxd);
22826 }
22827 }
22828 }
22829
22830-static void pgd_prepopulate_pmd(struct mm_struct *mm, pgd_t *pgd, pmd_t *pmds[])
22831+static void pgd_prepopulate_pxd(struct mm_struct *mm, pgd_t *pgd, pxd_t *pxds[])
22832 {
22833- pud_t *pud;
22834+ pyd_t *pyd;
22835 unsigned long addr;
22836 int i;
22837
22838- if (PREALLOCATED_PMDS == 0) /* Work around gcc-3.4.x bug */
22839+ if (PREALLOCATED_PXDS == 0) /* Work around gcc-3.4.x bug */
22840 return;
22841
22842- pud = pud_offset(pgd, 0);
22843+#ifdef CONFIG_X86_64
22844+ pyd = pyd_offset(mm, 0L);
22845+#else
22846+ pyd = pyd_offset(pgd, 0L);
22847+#endif
22848
22849- for (addr = i = 0; i < PREALLOCATED_PMDS;
22850- i++, pud++, addr += PUD_SIZE) {
22851- pmd_t *pmd = pmds[i];
22852+ for (addr = i = 0; i < PREALLOCATED_PXDS;
22853+ i++, pyd++, addr += PYD_SIZE) {
22854+ pxd_t *pxd = pxds[i];
22855
22856 if (i >= KERNEL_PGD_BOUNDARY)
22857- memcpy(pmd, (pmd_t *)pgd_page_vaddr(swapper_pg_dir[i]),
22858- sizeof(pmd_t) * PTRS_PER_PMD);
22859+ memcpy(pxd, (pxd_t *)pgd_page_vaddr(swapper_pg_dir[i]),
22860+ sizeof(pxd_t) * PTRS_PER_PMD);
22861
22862- pud_populate(mm, pud, pmd);
22863+ pyd_populate(mm, pyd, pxd);
22864 }
22865 }
22866
22867 pgd_t *pgd_alloc(struct mm_struct *mm)
22868 {
22869 pgd_t *pgd;
22870- pmd_t *pmds[PREALLOCATED_PMDS];
22871+ pxd_t *pxds[PREALLOCATED_PXDS];
22872
22873 pgd = (pgd_t *)__get_free_page(PGALLOC_GFP);
22874
22875@@ -265,11 +314,11 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
22876
22877 mm->pgd = pgd;
22878
22879- if (preallocate_pmds(pmds) != 0)
22880+ if (preallocate_pxds(pxds) != 0)
22881 goto out_free_pgd;
22882
22883 if (paravirt_pgd_alloc(mm) != 0)
22884- goto out_free_pmds;
22885+ goto out_free_pxds;
22886
22887 /*
22888 * Make sure that pre-populating the pmds is atomic with
22889@@ -279,14 +328,14 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
22890 spin_lock(&pgd_lock);
22891
22892 pgd_ctor(mm, pgd);
22893- pgd_prepopulate_pmd(mm, pgd, pmds);
22894+ pgd_prepopulate_pxd(mm, pgd, pxds);
22895
22896 spin_unlock(&pgd_lock);
22897
22898 return pgd;
22899
22900-out_free_pmds:
22901- free_pmds(pmds);
22902+out_free_pxds:
22903+ free_pxds(pxds);
22904 out_free_pgd:
22905 free_page((unsigned long)pgd);
22906 out:
22907@@ -295,7 +344,7 @@ out:
22908
22909 void pgd_free(struct mm_struct *mm, pgd_t *pgd)
22910 {
22911- pgd_mop_up_pmds(mm, pgd);
22912+ pgd_mop_up_pxds(mm, pgd);
22913 pgd_dtor(pgd);
22914 paravirt_pgd_free(mm, pgd);
22915 free_page((unsigned long)pgd);
22916diff -urNp linux-2.6.39/arch/x86/mm/setup_nx.c linux-2.6.39/arch/x86/mm/setup_nx.c
22917--- linux-2.6.39/arch/x86/mm/setup_nx.c 2011-05-19 00:06:34.000000000 -0400
22918+++ linux-2.6.39/arch/x86/mm/setup_nx.c 2011-05-22 19:36:30.000000000 -0400
22919@@ -5,8 +5,10 @@
22920 #include <asm/pgtable.h>
22921 #include <asm/proto.h>
22922
22923+#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
22924 static int disable_nx __cpuinitdata;
22925
22926+#ifndef CONFIG_PAX_PAGEEXEC
22927 /*
22928 * noexec = on|off
22929 *
22930@@ -28,12 +30,17 @@ static int __init noexec_setup(char *str
22931 return 0;
22932 }
22933 early_param("noexec", noexec_setup);
22934+#endif
22935+
22936+#endif
22937
22938 void __cpuinit x86_configure_nx(void)
22939 {
22940+#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
22941 if (cpu_has_nx && !disable_nx)
22942 __supported_pte_mask |= _PAGE_NX;
22943 else
22944+#endif
22945 __supported_pte_mask &= ~_PAGE_NX;
22946 }
22947
22948diff -urNp linux-2.6.39/arch/x86/mm/tlb.c linux-2.6.39/arch/x86/mm/tlb.c
22949--- linux-2.6.39/arch/x86/mm/tlb.c 2011-05-19 00:06:34.000000000 -0400
22950+++ linux-2.6.39/arch/x86/mm/tlb.c 2011-05-22 19:36:30.000000000 -0400
22951@@ -65,7 +65,11 @@ void leave_mm(int cpu)
22952 BUG();
22953 cpumask_clear_cpu(cpu,
22954 mm_cpumask(percpu_read(cpu_tlbstate.active_mm)));
22955+
22956+#ifndef CONFIG_PAX_PER_CPU_PGD
22957 load_cr3(swapper_pg_dir);
22958+#endif
22959+
22960 }
22961 EXPORT_SYMBOL_GPL(leave_mm);
22962
22963diff -urNp linux-2.6.39/arch/x86/oprofile/backtrace.c linux-2.6.39/arch/x86/oprofile/backtrace.c
22964--- linux-2.6.39/arch/x86/oprofile/backtrace.c 2011-05-19 00:06:34.000000000 -0400
22965+++ linux-2.6.39/arch/x86/oprofile/backtrace.c 2011-05-22 19:36:30.000000000 -0400
22966@@ -57,7 +57,7 @@ dump_user_backtrace_32(struct stack_fram
22967 struct stack_frame_ia32 *fp;
22968
22969 /* Also check accessibility of one struct frame_head beyond */
22970- if (!access_ok(VERIFY_READ, head, sizeof(bufhead)))
22971+ if (!__access_ok(VERIFY_READ, head, sizeof(bufhead)))
22972 return NULL;
22973 if (__copy_from_user_inatomic(bufhead, head, sizeof(bufhead)))
22974 return NULL;
22975@@ -123,7 +123,7 @@ x86_backtrace(struct pt_regs * const reg
22976 {
22977 struct stack_frame *head = (struct stack_frame *)frame_pointer(regs);
22978
22979- if (!user_mode_vm(regs)) {
22980+ if (!user_mode(regs)) {
22981 unsigned long stack = kernel_stack_pointer(regs);
22982 if (depth)
22983 dump_trace(NULL, regs, (unsigned long *)stack, 0,
22984diff -urNp linux-2.6.39/arch/x86/pci/ce4100.c linux-2.6.39/arch/x86/pci/ce4100.c
22985--- linux-2.6.39/arch/x86/pci/ce4100.c 2011-05-19 00:06:34.000000000 -0400
22986+++ linux-2.6.39/arch/x86/pci/ce4100.c 2011-05-22 19:36:30.000000000 -0400
22987@@ -302,7 +302,7 @@ static int ce4100_conf_write(unsigned in
22988 return pci_direct_conf1.write(seg, bus, devfn, reg, len, value);
22989 }
22990
22991-struct pci_raw_ops ce4100_pci_conf = {
22992+const struct pci_raw_ops ce4100_pci_conf = {
22993 .read = ce4100_conf_read,
22994 .write = ce4100_conf_write,
22995 };
22996diff -urNp linux-2.6.39/arch/x86/pci/common.c linux-2.6.39/arch/x86/pci/common.c
22997--- linux-2.6.39/arch/x86/pci/common.c 2011-05-19 00:06:34.000000000 -0400
22998+++ linux-2.6.39/arch/x86/pci/common.c 2011-05-22 19:36:30.000000000 -0400
22999@@ -33,8 +33,8 @@ int noioapicreroute = 1;
23000 int pcibios_last_bus = -1;
23001 unsigned long pirq_table_addr;
23002 struct pci_bus *pci_root_bus;
23003-struct pci_raw_ops *raw_pci_ops;
23004-struct pci_raw_ops *raw_pci_ext_ops;
23005+const struct pci_raw_ops *raw_pci_ops;
23006+const struct pci_raw_ops *raw_pci_ext_ops;
23007
23008 int raw_pci_read(unsigned int domain, unsigned int bus, unsigned int devfn,
23009 int reg, int len, u32 *val)
23010diff -urNp linux-2.6.39/arch/x86/pci/direct.c linux-2.6.39/arch/x86/pci/direct.c
23011--- linux-2.6.39/arch/x86/pci/direct.c 2011-05-19 00:06:34.000000000 -0400
23012+++ linux-2.6.39/arch/x86/pci/direct.c 2011-05-22 19:36:30.000000000 -0400
23013@@ -79,7 +79,7 @@ static int pci_conf1_write(unsigned int
23014
23015 #undef PCI_CONF1_ADDRESS
23016
23017-struct pci_raw_ops pci_direct_conf1 = {
23018+const struct pci_raw_ops pci_direct_conf1 = {
23019 .read = pci_conf1_read,
23020 .write = pci_conf1_write,
23021 };
23022@@ -173,7 +173,7 @@ static int pci_conf2_write(unsigned int
23023
23024 #undef PCI_CONF2_ADDRESS
23025
23026-struct pci_raw_ops pci_direct_conf2 = {
23027+const struct pci_raw_ops pci_direct_conf2 = {
23028 .read = pci_conf2_read,
23029 .write = pci_conf2_write,
23030 };
23031@@ -189,7 +189,7 @@ struct pci_raw_ops pci_direct_conf2 = {
23032 * This should be close to trivial, but it isn't, because there are buggy
23033 * chipsets (yes, you guessed it, by Intel and Compaq) that have no class ID.
23034 */
23035-static int __init pci_sanity_check(struct pci_raw_ops *o)
23036+static int __init pci_sanity_check(const struct pci_raw_ops *o)
23037 {
23038 u32 x = 0;
23039 int year, devfn;
23040diff -urNp linux-2.6.39/arch/x86/pci/fixup.c linux-2.6.39/arch/x86/pci/fixup.c
23041--- linux-2.6.39/arch/x86/pci/fixup.c 2011-05-19 00:06:34.000000000 -0400
23042+++ linux-2.6.39/arch/x86/pci/fixup.c 2011-05-22 19:36:30.000000000 -0400
23043@@ -435,7 +435,7 @@ static const struct dmi_system_id __devi
23044 DMI_MATCH(DMI_PRODUCT_VERSION, "PSA40U"),
23045 },
23046 },
23047- { }
23048+ {}
23049 };
23050
23051 static void __devinit pci_pre_fixup_toshiba_ohci1394(struct pci_dev *dev)
23052diff -urNp linux-2.6.39/arch/x86/pci/mmconfig_32.c linux-2.6.39/arch/x86/pci/mmconfig_32.c
23053--- linux-2.6.39/arch/x86/pci/mmconfig_32.c 2011-05-19 00:06:34.000000000 -0400
23054+++ linux-2.6.39/arch/x86/pci/mmconfig_32.c 2011-05-22 19:36:30.000000000 -0400
23055@@ -117,7 +117,7 @@ static int pci_mmcfg_write(unsigned int
23056 return 0;
23057 }
23058
23059-static struct pci_raw_ops pci_mmcfg = {
23060+static const struct pci_raw_ops pci_mmcfg = {
23061 .read = pci_mmcfg_read,
23062 .write = pci_mmcfg_write,
23063 };
23064diff -urNp linux-2.6.39/arch/x86/pci/mmconfig_64.c linux-2.6.39/arch/x86/pci/mmconfig_64.c
23065--- linux-2.6.39/arch/x86/pci/mmconfig_64.c 2011-05-19 00:06:34.000000000 -0400
23066+++ linux-2.6.39/arch/x86/pci/mmconfig_64.c 2011-05-22 19:36:30.000000000 -0400
23067@@ -81,7 +81,7 @@ static int pci_mmcfg_write(unsigned int
23068 return 0;
23069 }
23070
23071-static struct pci_raw_ops pci_mmcfg = {
23072+static const struct pci_raw_ops pci_mmcfg = {
23073 .read = pci_mmcfg_read,
23074 .write = pci_mmcfg_write,
23075 };
23076diff -urNp linux-2.6.39/arch/x86/pci/mrst.c linux-2.6.39/arch/x86/pci/mrst.c
23077--- linux-2.6.39/arch/x86/pci/mrst.c 2011-05-19 00:06:34.000000000 -0400
23078+++ linux-2.6.39/arch/x86/pci/mrst.c 2011-05-22 19:36:30.000000000 -0400
23079@@ -218,7 +218,7 @@ static int mrst_pci_irq_enable(struct pc
23080 return 0;
23081 }
23082
23083-struct pci_ops pci_mrst_ops = {
23084+const struct pci_ops pci_mrst_ops = {
23085 .read = pci_read,
23086 .write = pci_write,
23087 };
23088diff -urNp linux-2.6.39/arch/x86/pci/numaq_32.c linux-2.6.39/arch/x86/pci/numaq_32.c
23089--- linux-2.6.39/arch/x86/pci/numaq_32.c 2011-05-19 00:06:34.000000000 -0400
23090+++ linux-2.6.39/arch/x86/pci/numaq_32.c 2011-05-22 19:36:30.000000000 -0400
23091@@ -108,7 +108,7 @@ static int pci_conf1_mq_write(unsigned i
23092
23093 #undef PCI_CONF1_MQ_ADDRESS
23094
23095-static struct pci_raw_ops pci_direct_conf1_mq = {
23096+static const struct pci_raw_ops pci_direct_conf1_mq = {
23097 .read = pci_conf1_mq_read,
23098 .write = pci_conf1_mq_write
23099 };
23100diff -urNp linux-2.6.39/arch/x86/pci/olpc.c linux-2.6.39/arch/x86/pci/olpc.c
23101--- linux-2.6.39/arch/x86/pci/olpc.c 2011-05-19 00:06:34.000000000 -0400
23102+++ linux-2.6.39/arch/x86/pci/olpc.c 2011-05-22 19:36:30.000000000 -0400
23103@@ -297,7 +297,7 @@ static int pci_olpc_write(unsigned int s
23104 return 0;
23105 }
23106
23107-static struct pci_raw_ops pci_olpc_conf = {
23108+static const struct pci_raw_ops pci_olpc_conf = {
23109 .read = pci_olpc_read,
23110 .write = pci_olpc_write,
23111 };
23112diff -urNp linux-2.6.39/arch/x86/pci/pcbios.c linux-2.6.39/arch/x86/pci/pcbios.c
23113--- linux-2.6.39/arch/x86/pci/pcbios.c 2011-05-19 00:06:34.000000000 -0400
23114+++ linux-2.6.39/arch/x86/pci/pcbios.c 2011-05-22 19:36:30.000000000 -0400
23115@@ -79,50 +79,93 @@ union bios32 {
23116 static struct {
23117 unsigned long address;
23118 unsigned short segment;
23119-} bios32_indirect = { 0, __KERNEL_CS };
23120+} bios32_indirect __read_only = { 0, __PCIBIOS_CS };
23121
23122 /*
23123 * Returns the entry point for the given service, NULL on error
23124 */
23125
23126-static unsigned long bios32_service(unsigned long service)
23127+static unsigned long __devinit bios32_service(unsigned long service)
23128 {
23129 unsigned char return_code; /* %al */
23130 unsigned long address; /* %ebx */
23131 unsigned long length; /* %ecx */
23132 unsigned long entry; /* %edx */
23133 unsigned long flags;
23134+ struct desc_struct d, *gdt;
23135
23136 local_irq_save(flags);
23137- __asm__("lcall *(%%edi); cld"
23138+
23139+ gdt = get_cpu_gdt_table(smp_processor_id());
23140+
23141+ pack_descriptor(&d, 0UL, 0xFFFFFUL, 0x9B, 0xC);
23142+ write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_CS, &d, DESCTYPE_S);
23143+ pack_descriptor(&d, 0UL, 0xFFFFFUL, 0x93, 0xC);
23144+ write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_DS, &d, DESCTYPE_S);
23145+
23146+ __asm__("movw %w7, %%ds; lcall *(%%edi); push %%ss; pop %%ds; cld"
23147 : "=a" (return_code),
23148 "=b" (address),
23149 "=c" (length),
23150 "=d" (entry)
23151 : "0" (service),
23152 "1" (0),
23153- "D" (&bios32_indirect));
23154+ "D" (&bios32_indirect),
23155+ "r"(__PCIBIOS_DS)
23156+ : "memory");
23157+
23158+ pax_open_kernel();
23159+ gdt[GDT_ENTRY_PCIBIOS_CS].a = 0;
23160+ gdt[GDT_ENTRY_PCIBIOS_CS].b = 0;
23161+ gdt[GDT_ENTRY_PCIBIOS_DS].a = 0;
23162+ gdt[GDT_ENTRY_PCIBIOS_DS].b = 0;
23163+ pax_close_kernel();
23164+
23165 local_irq_restore(flags);
23166
23167 switch (return_code) {
23168- case 0:
23169- return address + entry;
23170- case 0x80: /* Not present */
23171- printk(KERN_WARNING "bios32_service(0x%lx): not present\n", service);
23172- return 0;
23173- default: /* Shouldn't happen */
23174- printk(KERN_WARNING "bios32_service(0x%lx): returned 0x%x -- BIOS bug!\n",
23175- service, return_code);
23176+ case 0: {
23177+ int cpu;
23178+ unsigned char flags;
23179+
23180+ printk(KERN_INFO "bios32_service: base:%08lx length:%08lx entry:%08lx\n", address, length, entry);
23181+ if (address >= 0xFFFF0 || length > 0x100000 - address || length <= entry) {
23182+ printk(KERN_WARNING "bios32_service: not valid\n");
23183 return 0;
23184+ }
23185+ address = address + PAGE_OFFSET;
23186+ length += 16UL; /* some BIOSs underreport this... */
23187+ flags = 4;
23188+ if (length >= 64*1024*1024) {
23189+ length >>= PAGE_SHIFT;
23190+ flags |= 8;
23191+ }
23192+
23193+ for (cpu = 0; cpu < NR_CPUS; cpu++) {
23194+ gdt = get_cpu_gdt_table(cpu);
23195+ pack_descriptor(&d, address, length, 0x9b, flags);
23196+ write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_CS, &d, DESCTYPE_S);
23197+ pack_descriptor(&d, address, length, 0x93, flags);
23198+ write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_DS, &d, DESCTYPE_S);
23199+ }
23200+ return entry;
23201+ }
23202+ case 0x80: /* Not present */
23203+ printk(KERN_WARNING "bios32_service(0x%lx): not present\n", service);
23204+ return 0;
23205+ default: /* Shouldn't happen */
23206+ printk(KERN_WARNING "bios32_service(0x%lx): returned 0x%x -- BIOS bug!\n",
23207+ service, return_code);
23208+ return 0;
23209 }
23210 }
23211
23212 static struct {
23213 unsigned long address;
23214 unsigned short segment;
23215-} pci_indirect = { 0, __KERNEL_CS };
23216+} pci_indirect __read_only = { 0, __PCIBIOS_CS };
23217
23218-static int pci_bios_present;
23219+static int pci_bios_present __read_only;
23220
23221 static int __devinit check_pcibios(void)
23222 {
23223@@ -131,11 +174,13 @@ static int __devinit check_pcibios(void)
23224 unsigned long flags, pcibios_entry;
23225
23226 if ((pcibios_entry = bios32_service(PCI_SERVICE))) {
23227- pci_indirect.address = pcibios_entry + PAGE_OFFSET;
23228+ pci_indirect.address = pcibios_entry;
23229
23230 local_irq_save(flags);
23231- __asm__(
23232- "lcall *(%%edi); cld\n\t"
23233+ __asm__("movw %w6, %%ds\n\t"
23234+ "lcall *%%ss:(%%edi); cld\n\t"
23235+ "push %%ss\n\t"
23236+ "pop %%ds\n\t"
23237 "jc 1f\n\t"
23238 "xor %%ah, %%ah\n"
23239 "1:"
23240@@ -144,7 +189,8 @@ static int __devinit check_pcibios(void)
23241 "=b" (ebx),
23242 "=c" (ecx)
23243 : "1" (PCIBIOS_PCI_BIOS_PRESENT),
23244- "D" (&pci_indirect)
23245+ "D" (&pci_indirect),
23246+ "r" (__PCIBIOS_DS)
23247 : "memory");
23248 local_irq_restore(flags);
23249
23250@@ -188,7 +234,10 @@ static int pci_bios_read(unsigned int se
23251
23252 switch (len) {
23253 case 1:
23254- __asm__("lcall *(%%esi); cld\n\t"
23255+ __asm__("movw %w6, %%ds\n\t"
23256+ "lcall *%%ss:(%%esi); cld\n\t"
23257+ "push %%ss\n\t"
23258+ "pop %%ds\n\t"
23259 "jc 1f\n\t"
23260 "xor %%ah, %%ah\n"
23261 "1:"
23262@@ -197,7 +246,8 @@ static int pci_bios_read(unsigned int se
23263 : "1" (PCIBIOS_READ_CONFIG_BYTE),
23264 "b" (bx),
23265 "D" ((long)reg),
23266- "S" (&pci_indirect));
23267+ "S" (&pci_indirect),
23268+ "r" (__PCIBIOS_DS));
23269 /*
23270 * Zero-extend the result beyond 8 bits, do not trust the
23271 * BIOS having done it:
23272@@ -205,7 +255,10 @@ static int pci_bios_read(unsigned int se
23273 *value &= 0xff;
23274 break;
23275 case 2:
23276- __asm__("lcall *(%%esi); cld\n\t"
23277+ __asm__("movw %w6, %%ds\n\t"
23278+ "lcall *%%ss:(%%esi); cld\n\t"
23279+ "push %%ss\n\t"
23280+ "pop %%ds\n\t"
23281 "jc 1f\n\t"
23282 "xor %%ah, %%ah\n"
23283 "1:"
23284@@ -214,7 +267,8 @@ static int pci_bios_read(unsigned int se
23285 : "1" (PCIBIOS_READ_CONFIG_WORD),
23286 "b" (bx),
23287 "D" ((long)reg),
23288- "S" (&pci_indirect));
23289+ "S" (&pci_indirect),
23290+ "r" (__PCIBIOS_DS));
23291 /*
23292 * Zero-extend the result beyond 16 bits, do not trust the
23293 * BIOS having done it:
23294@@ -222,7 +276,10 @@ static int pci_bios_read(unsigned int se
23295 *value &= 0xffff;
23296 break;
23297 case 4:
23298- __asm__("lcall *(%%esi); cld\n\t"
23299+ __asm__("movw %w6, %%ds\n\t"
23300+ "lcall *%%ss:(%%esi); cld\n\t"
23301+ "push %%ss\n\t"
23302+ "pop %%ds\n\t"
23303 "jc 1f\n\t"
23304 "xor %%ah, %%ah\n"
23305 "1:"
23306@@ -231,7 +288,8 @@ static int pci_bios_read(unsigned int se
23307 : "1" (PCIBIOS_READ_CONFIG_DWORD),
23308 "b" (bx),
23309 "D" ((long)reg),
23310- "S" (&pci_indirect));
23311+ "S" (&pci_indirect),
23312+ "r" (__PCIBIOS_DS));
23313 break;
23314 }
23315
23316@@ -254,7 +312,10 @@ static int pci_bios_write(unsigned int s
23317
23318 switch (len) {
23319 case 1:
23320- __asm__("lcall *(%%esi); cld\n\t"
23321+ __asm__("movw %w6, %%ds\n\t"
23322+ "lcall *%%ss:(%%esi); cld\n\t"
23323+ "push %%ss\n\t"
23324+ "pop %%ds\n\t"
23325 "jc 1f\n\t"
23326 "xor %%ah, %%ah\n"
23327 "1:"
23328@@ -263,10 +324,14 @@ static int pci_bios_write(unsigned int s
23329 "c" (value),
23330 "b" (bx),
23331 "D" ((long)reg),
23332- "S" (&pci_indirect));
23333+ "S" (&pci_indirect),
23334+ "r" (__PCIBIOS_DS));
23335 break;
23336 case 2:
23337- __asm__("lcall *(%%esi); cld\n\t"
23338+ __asm__("movw %w6, %%ds\n\t"
23339+ "lcall *%%ss:(%%esi); cld\n\t"
23340+ "push %%ss\n\t"
23341+ "pop %%ds\n\t"
23342 "jc 1f\n\t"
23343 "xor %%ah, %%ah\n"
23344 "1:"
23345@@ -275,10 +340,14 @@ static int pci_bios_write(unsigned int s
23346 "c" (value),
23347 "b" (bx),
23348 "D" ((long)reg),
23349- "S" (&pci_indirect));
23350+ "S" (&pci_indirect),
23351+ "r" (__PCIBIOS_DS));
23352 break;
23353 case 4:
23354- __asm__("lcall *(%%esi); cld\n\t"
23355+ __asm__("movw %w6, %%ds\n\t"
23356+ "lcall *%%ss:(%%esi); cld\n\t"
23357+ "push %%ss\n\t"
23358+ "pop %%ds\n\t"
23359 "jc 1f\n\t"
23360 "xor %%ah, %%ah\n"
23361 "1:"
23362@@ -287,7 +356,8 @@ static int pci_bios_write(unsigned int s
23363 "c" (value),
23364 "b" (bx),
23365 "D" ((long)reg),
23366- "S" (&pci_indirect));
23367+ "S" (&pci_indirect),
23368+ "r" (__PCIBIOS_DS));
23369 break;
23370 }
23371
23372@@ -301,7 +371,7 @@ static int pci_bios_write(unsigned int s
23373 * Function table for BIOS32 access
23374 */
23375
23376-static struct pci_raw_ops pci_bios_access = {
23377+static const struct pci_raw_ops pci_bios_access = {
23378 .read = pci_bios_read,
23379 .write = pci_bios_write
23380 };
23381@@ -310,7 +380,7 @@ static struct pci_raw_ops pci_bios_acces
23382 * Try to find PCI BIOS.
23383 */
23384
23385-static struct pci_raw_ops * __devinit pci_find_bios(void)
23386+static const struct pci_raw_ops * __devinit pci_find_bios(void)
23387 {
23388 union bios32 *check;
23389 unsigned char sum;
23390@@ -392,10 +462,13 @@ struct irq_routing_table * pcibios_get_i
23391
23392 DBG("PCI: Fetching IRQ routing table... ");
23393 __asm__("push %%es\n\t"
23394+ "movw %w8, %%ds\n\t"
23395 "push %%ds\n\t"
23396 "pop %%es\n\t"
23397- "lcall *(%%esi); cld\n\t"
23398+ "lcall *%%ss:(%%esi); cld\n\t"
23399 "pop %%es\n\t"
23400+ "push %%ss\n\t"
23401+ "pop %%ds\n"
23402 "jc 1f\n\t"
23403 "xor %%ah, %%ah\n"
23404 "1:"
23405@@ -406,7 +479,8 @@ struct irq_routing_table * pcibios_get_i
23406 "1" (0),
23407 "D" ((long) &opt),
23408 "S" (&pci_indirect),
23409- "m" (opt)
23410+ "m" (opt),
23411+ "r" (__PCIBIOS_DS)
23412 : "memory");
23413 DBG("OK ret=%d, size=%d, map=%x\n", ret, opt.size, map);
23414 if (ret & 0xff00)
23415@@ -430,7 +504,10 @@ int pcibios_set_irq_routing(struct pci_d
23416 {
23417 int ret;
23418
23419- __asm__("lcall *(%%esi); cld\n\t"
23420+ __asm__("movw %w5, %%ds\n\t"
23421+ "lcall *%%ss:(%%esi); cld\n\t"
23422+ "push %%ss\n\t"
23423+ "pop %%ds\n"
23424 "jc 1f\n\t"
23425 "xor %%ah, %%ah\n"
23426 "1:"
23427@@ -438,7 +515,8 @@ int pcibios_set_irq_routing(struct pci_d
23428 : "0" (PCIBIOS_SET_PCI_HW_INT),
23429 "b" ((dev->bus->number << 8) | dev->devfn),
23430 "c" ((irq << 8) | (pin + 10)),
23431- "S" (&pci_indirect));
23432+ "S" (&pci_indirect),
23433+ "r" (__PCIBIOS_DS));
23434 return !(ret & 0xff00);
23435 }
23436 EXPORT_SYMBOL(pcibios_set_irq_routing);
23437diff -urNp linux-2.6.39/arch/x86/pci/xen.c linux-2.6.39/arch/x86/pci/xen.c
23438--- linux-2.6.39/arch/x86/pci/xen.c 2011-05-19 00:06:34.000000000 -0400
23439+++ linux-2.6.39/arch/x86/pci/xen.c 2011-05-22 19:36:30.000000000 -0400
23440@@ -62,7 +62,7 @@ static int acpi_register_gsi_xen_hvm(str
23441 #include <linux/msi.h>
23442 #include <asm/msidef.h>
23443
23444-struct xen_pci_frontend_ops *xen_pci_frontend;
23445+const struct xen_pci_frontend_ops *xen_pci_frontend;
23446 EXPORT_SYMBOL_GPL(xen_pci_frontend);
23447
23448 #define XEN_PIRQ_MSI_DATA (MSI_DATA_TRIGGER_EDGE | \
23449diff -urNp linux-2.6.39/arch/x86/platform/efi/efi_32.c linux-2.6.39/arch/x86/platform/efi/efi_32.c
23450--- linux-2.6.39/arch/x86/platform/efi/efi_32.c 2011-05-19 00:06:34.000000000 -0400
23451+++ linux-2.6.39/arch/x86/platform/efi/efi_32.c 2011-05-22 19:36:30.000000000 -0400
23452@@ -38,70 +38,37 @@
23453 */
23454
23455 static unsigned long efi_rt_eflags;
23456-static pgd_t efi_bak_pg_dir_pointer[2];
23457+static pgd_t __initdata efi_bak_pg_dir_pointer[KERNEL_PGD_PTRS];
23458
23459-void efi_call_phys_prelog(void)
23460+void __init efi_call_phys_prelog(void)
23461 {
23462- unsigned long cr4;
23463- unsigned long temp;
23464 struct desc_ptr gdt_descr;
23465
23466 local_irq_save(efi_rt_eflags);
23467
23468- /*
23469- * If I don't have PAE, I should just duplicate two entries in page
23470- * directory. If I have PAE, I just need to duplicate one entry in
23471- * page directory.
23472- */
23473- cr4 = read_cr4_safe();
23474-
23475- if (cr4 & X86_CR4_PAE) {
23476- efi_bak_pg_dir_pointer[0].pgd =
23477- swapper_pg_dir[pgd_index(0)].pgd;
23478- swapper_pg_dir[0].pgd =
23479- swapper_pg_dir[pgd_index(PAGE_OFFSET)].pgd;
23480- } else {
23481- efi_bak_pg_dir_pointer[0].pgd =
23482- swapper_pg_dir[pgd_index(0)].pgd;
23483- efi_bak_pg_dir_pointer[1].pgd =
23484- swapper_pg_dir[pgd_index(0x400000)].pgd;
23485- swapper_pg_dir[pgd_index(0)].pgd =
23486- swapper_pg_dir[pgd_index(PAGE_OFFSET)].pgd;
23487- temp = PAGE_OFFSET + 0x400000;
23488- swapper_pg_dir[pgd_index(0x400000)].pgd =
23489- swapper_pg_dir[pgd_index(temp)].pgd;
23490- }
23491+ clone_pgd_range(efi_bak_pg_dir_pointer, swapper_pg_dir, KERNEL_PGD_PTRS);
23492+ clone_pgd_range(swapper_pg_dir, swapper_pg_dir + KERNEL_PGD_BOUNDARY,
23493+ min_t(unsigned long, KERNEL_PGD_PTRS, KERNEL_PGD_BOUNDARY));
23494
23495 /*
23496 * After the lock is released, the original page table is restored.
23497 */
23498 __flush_tlb_all();
23499
23500- gdt_descr.address = __pa(get_cpu_gdt_table(0));
23501+ gdt_descr.address = (struct desc_struct *)__pa(get_cpu_gdt_table(0));
23502 gdt_descr.size = GDT_SIZE - 1;
23503 load_gdt(&gdt_descr);
23504 }
23505
23506-void efi_call_phys_epilog(void)
23507+void __init efi_call_phys_epilog(void)
23508 {
23509- unsigned long cr4;
23510 struct desc_ptr gdt_descr;
23511
23512- gdt_descr.address = (unsigned long)get_cpu_gdt_table(0);
23513+ gdt_descr.address = get_cpu_gdt_table(0);
23514 gdt_descr.size = GDT_SIZE - 1;
23515 load_gdt(&gdt_descr);
23516
23517- cr4 = read_cr4_safe();
23518-
23519- if (cr4 & X86_CR4_PAE) {
23520- swapper_pg_dir[pgd_index(0)].pgd =
23521- efi_bak_pg_dir_pointer[0].pgd;
23522- } else {
23523- swapper_pg_dir[pgd_index(0)].pgd =
23524- efi_bak_pg_dir_pointer[0].pgd;
23525- swapper_pg_dir[pgd_index(0x400000)].pgd =
23526- efi_bak_pg_dir_pointer[1].pgd;
23527- }
23528+ clone_pgd_range(swapper_pg_dir, efi_bak_pg_dir_pointer, KERNEL_PGD_PTRS);
23529
23530 /*
23531 * After the lock is released, the original page table is restored.
23532diff -urNp linux-2.6.39/arch/x86/platform/efi/efi_stub_32.S linux-2.6.39/arch/x86/platform/efi/efi_stub_32.S
23533--- linux-2.6.39/arch/x86/platform/efi/efi_stub_32.S 2011-05-19 00:06:34.000000000 -0400
23534+++ linux-2.6.39/arch/x86/platform/efi/efi_stub_32.S 2011-05-22 19:36:30.000000000 -0400
23535@@ -6,6 +6,7 @@
23536 */
23537
23538 #include <linux/linkage.h>
23539+#include <linux/init.h>
23540 #include <asm/page_types.h>
23541
23542 /*
23543@@ -20,7 +21,7 @@
23544 * service functions will comply with gcc calling convention, too.
23545 */
23546
23547-.text
23548+__INIT
23549 ENTRY(efi_call_phys)
23550 /*
23551 * 0. The function can only be called in Linux kernel. So CS has been
23552@@ -36,9 +37,7 @@ ENTRY(efi_call_phys)
23553 * The mapping of lower virtual memory has been created in prelog and
23554 * epilog.
23555 */
23556- movl $1f, %edx
23557- subl $__PAGE_OFFSET, %edx
23558- jmp *%edx
23559+ jmp 1f-__PAGE_OFFSET
23560 1:
23561
23562 /*
23563@@ -47,14 +46,8 @@ ENTRY(efi_call_phys)
23564 * parameter 2, ..., param n. To make things easy, we save the return
23565 * address of efi_call_phys in a global variable.
23566 */
23567- popl %edx
23568- movl %edx, saved_return_addr
23569- /* get the function pointer into ECX*/
23570- popl %ecx
23571- movl %ecx, efi_rt_function_ptr
23572- movl $2f, %edx
23573- subl $__PAGE_OFFSET, %edx
23574- pushl %edx
23575+ popl (saved_return_addr)
23576+ popl (efi_rt_function_ptr)
23577
23578 /*
23579 * 3. Clear PG bit in %CR0.
23580@@ -73,9 +66,8 @@ ENTRY(efi_call_phys)
23581 /*
23582 * 5. Call the physical function.
23583 */
23584- jmp *%ecx
23585+ call *(efi_rt_function_ptr-__PAGE_OFFSET)
23586
23587-2:
23588 /*
23589 * 6. After EFI runtime service returns, control will return to
23590 * following instruction. We'd better readjust stack pointer first.
23591@@ -88,35 +80,28 @@ ENTRY(efi_call_phys)
23592 movl %cr0, %edx
23593 orl $0x80000000, %edx
23594 movl %edx, %cr0
23595- jmp 1f
23596-1:
23597+
23598 /*
23599 * 8. Now restore the virtual mode from flat mode by
23600 * adding EIP with PAGE_OFFSET.
23601 */
23602- movl $1f, %edx
23603- jmp *%edx
23604+ jmp 1f+__PAGE_OFFSET
23605 1:
23606
23607 /*
23608 * 9. Balance the stack. And because EAX contain the return value,
23609 * we'd better not clobber it.
23610 */
23611- leal efi_rt_function_ptr, %edx
23612- movl (%edx), %ecx
23613- pushl %ecx
23614+ pushl (efi_rt_function_ptr)
23615
23616 /*
23617- * 10. Push the saved return address onto the stack and return.
23618+ * 10. Return to the saved return address.
23619 */
23620- leal saved_return_addr, %edx
23621- movl (%edx), %ecx
23622- pushl %ecx
23623- ret
23624+ jmpl *(saved_return_addr)
23625 ENDPROC(efi_call_phys)
23626 .previous
23627
23628-.data
23629+__INITDATA
23630 saved_return_addr:
23631 .long 0
23632 efi_rt_function_ptr:
23633diff -urNp linux-2.6.39/arch/x86/platform/olpc/olpc_dt.c linux-2.6.39/arch/x86/platform/olpc/olpc_dt.c
23634--- linux-2.6.39/arch/x86/platform/olpc/olpc_dt.c 2011-05-19 00:06:34.000000000 -0400
23635+++ linux-2.6.39/arch/x86/platform/olpc/olpc_dt.c 2011-05-22 19:36:30.000000000 -0400
23636@@ -154,7 +154,7 @@ void * __init prom_early_alloc(unsigned
23637 return res;
23638 }
23639
23640-static struct of_pdt_ops prom_olpc_ops __initdata = {
23641+static const struct of_pdt_ops prom_olpc_ops = {
23642 .nextprop = olpc_dt_nextprop,
23643 .getproplen = olpc_dt_getproplen,
23644 .getproperty = olpc_dt_getproperty,
23645diff -urNp linux-2.6.39/arch/x86/platform/uv/tlb_uv.c linux-2.6.39/arch/x86/platform/uv/tlb_uv.c
23646--- linux-2.6.39/arch/x86/platform/uv/tlb_uv.c 2011-05-19 00:06:34.000000000 -0400
23647+++ linux-2.6.39/arch/x86/platform/uv/tlb_uv.c 2011-05-22 19:36:30.000000000 -0400
23648@@ -342,6 +342,8 @@ static void uv_reset_with_ipi(struct bau
23649 cpumask_t mask;
23650 struct reset_args reset_args;
23651
23652+ pax_track_stack();
23653+
23654 reset_args.sender = sender;
23655
23656 cpus_clear(mask);
23657diff -urNp linux-2.6.39/arch/x86/power/cpu.c linux-2.6.39/arch/x86/power/cpu.c
23658--- linux-2.6.39/arch/x86/power/cpu.c 2011-05-19 00:06:34.000000000 -0400
23659+++ linux-2.6.39/arch/x86/power/cpu.c 2011-05-22 19:36:30.000000000 -0400
23660@@ -130,7 +130,7 @@ static void do_fpu_end(void)
23661 static void fix_processor_context(void)
23662 {
23663 int cpu = smp_processor_id();
23664- struct tss_struct *t = &per_cpu(init_tss, cpu);
23665+ struct tss_struct *t = init_tss + cpu;
23666
23667 set_tss_desc(cpu, t); /*
23668 * This just modifies memory; should not be
23669@@ -140,7 +140,9 @@ static void fix_processor_context(void)
23670 */
23671
23672 #ifdef CONFIG_X86_64
23673+ pax_open_kernel();
23674 get_cpu_gdt_table(cpu)[GDT_ENTRY_TSS].type = 9;
23675+ pax_close_kernel();
23676
23677 syscall_init(); /* This sets MSR_*STAR and related */
23678 #endif
23679diff -urNp linux-2.6.39/arch/x86/vdso/Makefile linux-2.6.39/arch/x86/vdso/Makefile
23680--- linux-2.6.39/arch/x86/vdso/Makefile 2011-05-19 00:06:34.000000000 -0400
23681+++ linux-2.6.39/arch/x86/vdso/Makefile 2011-05-22 19:36:30.000000000 -0400
23682@@ -123,7 +123,7 @@ quiet_cmd_vdso = VDSO $@
23683 -Wl,-T,$(filter %.lds,$^) $(filter %.o,$^) && \
23684 sh $(srctree)/$(src)/checkundef.sh '$(NM)' '$@'
23685
23686-VDSO_LDFLAGS = -fPIC -shared $(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
23687+VDSO_LDFLAGS = -fPIC -shared -Wl,--no-undefined $(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
23688 GCOV_PROFILE := n
23689
23690 #
23691diff -urNp linux-2.6.39/arch/x86/vdso/vclock_gettime.c linux-2.6.39/arch/x86/vdso/vclock_gettime.c
23692--- linux-2.6.39/arch/x86/vdso/vclock_gettime.c 2011-05-19 00:06:34.000000000 -0400
23693+++ linux-2.6.39/arch/x86/vdso/vclock_gettime.c 2011-05-22 19:36:30.000000000 -0400
23694@@ -22,24 +22,48 @@
23695 #include <asm/hpet.h>
23696 #include <asm/unistd.h>
23697 #include <asm/io.h>
23698+#include <asm/fixmap.h>
23699 #include "vextern.h"
23700
23701 #define gtod vdso_vsyscall_gtod_data
23702
23703+notrace noinline long __vdso_fallback_time(long *t)
23704+{
23705+ long secs;
23706+ asm volatile("syscall"
23707+ : "=a" (secs)
23708+ : "0" (__NR_time),"D" (t) : "r11", "cx", "memory");
23709+ return secs;
23710+}
23711+
23712 notrace static long vdso_fallback_gettime(long clock, struct timespec *ts)
23713 {
23714 long ret;
23715 asm("syscall" : "=a" (ret) :
23716- "0" (__NR_clock_gettime),"D" (clock), "S" (ts) : "memory");
23717+ "0" (__NR_clock_gettime),"D" (clock), "S" (ts) : "r11", "cx", "memory");
23718 return ret;
23719 }
23720
23721+notrace static inline cycle_t __vdso_vread_hpet(void)
23722+{
23723+ return readl((const void __iomem *)fix_to_virt(VSYSCALL_HPET) + 0xf0);
23724+}
23725+
23726+notrace static inline cycle_t __vdso_vread_tsc(void)
23727+{
23728+ cycle_t ret = (cycle_t)vget_cycles();
23729+
23730+ return ret >= gtod->clock.cycle_last ? ret : gtod->clock.cycle_last;
23731+}
23732+
23733 notrace static inline long vgetns(void)
23734 {
23735 long v;
23736- cycles_t (*vread)(void);
23737- vread = gtod->clock.vread;
23738- v = (vread() - gtod->clock.cycle_last) & gtod->clock.mask;
23739+ if (gtod->clock.name[0] == 't' && gtod->clock.name[1] == 's' && gtod->clock.name[2] == 'c' && !gtod->clock.name[3])
23740+ v = __vdso_vread_tsc();
23741+ else
23742+ v = __vdso_vread_hpet();
23743+ v = (v - gtod->clock.cycle_last) & gtod->clock.mask;
23744 return (v * gtod->clock.mult) >> gtod->clock.shift;
23745 }
23746
23747@@ -113,7 +137,9 @@ notrace static noinline int do_monotonic
23748
23749 notrace int __vdso_clock_gettime(clockid_t clock, struct timespec *ts)
23750 {
23751- if (likely(gtod->sysctl_enabled))
23752+ if (likely(gtod->sysctl_enabled &&
23753+ ((gtod->clock.name[0] == 'h' && gtod->clock.name[1] == 'p' && gtod->clock.name[2] == 'e' && gtod->clock.name[3] == 't' && !gtod->clock.name[4]) ||
23754+ (gtod->clock.name[0] == 't' && gtod->clock.name[1] == 's' && gtod->clock.name[2] == 'c' && !gtod->clock.name[3]))))
23755 switch (clock) {
23756 case CLOCK_REALTIME:
23757 if (likely(gtod->clock.vread))
23758@@ -133,10 +159,20 @@ notrace int __vdso_clock_gettime(clockid
23759 int clock_gettime(clockid_t, struct timespec *)
23760 __attribute__((weak, alias("__vdso_clock_gettime")));
23761
23762-notrace int __vdso_gettimeofday(struct timeval *tv, struct timezone *tz)
23763+notrace noinline int __vdso_fallback_gettimeofday(struct timeval *tv, struct timezone *tz)
23764 {
23765 long ret;
23766- if (likely(gtod->sysctl_enabled && gtod->clock.vread)) {
23767+ asm("syscall" : "=a" (ret) :
23768+ "0" (__NR_gettimeofday), "D" (tv), "S" (tz) : "r11", "cx", "memory");
23769+ return ret;
23770+}
23771+
23772+notrace int __vdso_gettimeofday(struct timeval *tv, struct timezone *tz)
23773+{
23774+ if (likely(gtod->sysctl_enabled &&
23775+ ((gtod->clock.name[0] == 'h' && gtod->clock.name[1] == 'p' && gtod->clock.name[2] == 'e' && gtod->clock.name[3] == 't' && !gtod->clock.name[4]) ||
23776+ (gtod->clock.name[0] == 't' && gtod->clock.name[1] == 's' && gtod->clock.name[2] == 'c' && !gtod->clock.name[3]))))
23777+ {
23778 if (likely(tv != NULL)) {
23779 BUILD_BUG_ON(offsetof(struct timeval, tv_usec) !=
23780 offsetof(struct timespec, tv_nsec) ||
23781@@ -151,9 +187,7 @@ notrace int __vdso_gettimeofday(struct t
23782 }
23783 return 0;
23784 }
23785- asm("syscall" : "=a" (ret) :
23786- "0" (__NR_gettimeofday), "D" (tv), "S" (tz) : "memory");
23787- return ret;
23788+ return __vdso_fallback_gettimeofday(tv, tz);
23789 }
23790 int gettimeofday(struct timeval *, struct timezone *)
23791 __attribute__((weak, alias("__vdso_gettimeofday")));
23792diff -urNp linux-2.6.39/arch/x86/vdso/vdso32-setup.c linux-2.6.39/arch/x86/vdso/vdso32-setup.c
23793--- linux-2.6.39/arch/x86/vdso/vdso32-setup.c 2011-05-19 00:06:34.000000000 -0400
23794+++ linux-2.6.39/arch/x86/vdso/vdso32-setup.c 2011-05-22 19:36:30.000000000 -0400
23795@@ -25,6 +25,7 @@
23796 #include <asm/tlbflush.h>
23797 #include <asm/vdso.h>
23798 #include <asm/proto.h>
23799+#include <asm/mman.h>
23800
23801 enum {
23802 VDSO_DISABLED = 0,
23803@@ -226,7 +227,7 @@ static inline void map_compat_vdso(int m
23804 void enable_sep_cpu(void)
23805 {
23806 int cpu = get_cpu();
23807- struct tss_struct *tss = &per_cpu(init_tss, cpu);
23808+ struct tss_struct *tss = init_tss + cpu;
23809
23810 if (!boot_cpu_has(X86_FEATURE_SEP)) {
23811 put_cpu();
23812@@ -249,7 +250,7 @@ static int __init gate_vma_init(void)
23813 gate_vma.vm_start = FIXADDR_USER_START;
23814 gate_vma.vm_end = FIXADDR_USER_END;
23815 gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
23816- gate_vma.vm_page_prot = __P101;
23817+ gate_vma.vm_page_prot = vm_get_page_prot(gate_vma.vm_flags);
23818 /*
23819 * Make sure the vDSO gets into every core dump.
23820 * Dumping its contents makes post-mortem fully interpretable later
23821@@ -331,14 +332,14 @@ int arch_setup_additional_pages(struct l
23822 if (compat)
23823 addr = VDSO_HIGH_BASE;
23824 else {
23825- addr = get_unmapped_area(NULL, 0, PAGE_SIZE, 0, 0);
23826+ addr = get_unmapped_area(NULL, 0, PAGE_SIZE, 0, MAP_EXECUTABLE);
23827 if (IS_ERR_VALUE(addr)) {
23828 ret = addr;
23829 goto up_fail;
23830 }
23831 }
23832
23833- current->mm->context.vdso = (void *)addr;
23834+ current->mm->context.vdso = addr;
23835
23836 if (compat_uses_vma || !compat) {
23837 /*
23838@@ -361,11 +362,11 @@ int arch_setup_additional_pages(struct l
23839 }
23840
23841 current_thread_info()->sysenter_return =
23842- VDSO32_SYMBOL(addr, SYSENTER_RETURN);
23843+ (__force void __user *)VDSO32_SYMBOL(addr, SYSENTER_RETURN);
23844
23845 up_fail:
23846 if (ret)
23847- current->mm->context.vdso = NULL;
23848+ current->mm->context.vdso = 0;
23849
23850 up_write(&mm->mmap_sem);
23851
23852@@ -412,8 +413,14 @@ __initcall(ia32_binfmt_init);
23853
23854 const char *arch_vma_name(struct vm_area_struct *vma)
23855 {
23856- if (vma->vm_mm && vma->vm_start == (long)vma->vm_mm->context.vdso)
23857+ if (vma->vm_mm && vma->vm_start == vma->vm_mm->context.vdso)
23858 return "[vdso]";
23859+
23860+#ifdef CONFIG_PAX_SEGMEXEC
23861+ if (vma->vm_mm && vma->vm_mirror && vma->vm_mirror->vm_start == vma->vm_mm->context.vdso)
23862+ return "[vdso]";
23863+#endif
23864+
23865 return NULL;
23866 }
23867
23868@@ -423,7 +430,7 @@ struct vm_area_struct *get_gate_vma(stru
23869 * Check to see if the corresponding task was created in compat vdso
23870 * mode.
23871 */
23872- if (mm && mm->context.vdso == (void *)VDSO_HIGH_BASE)
23873+ if (mm && mm->context.vdso == VDSO_HIGH_BASE)
23874 return &gate_vma;
23875 return NULL;
23876 }
23877diff -urNp linux-2.6.39/arch/x86/vdso/vdso.lds.S linux-2.6.39/arch/x86/vdso/vdso.lds.S
23878--- linux-2.6.39/arch/x86/vdso/vdso.lds.S 2011-05-19 00:06:34.000000000 -0400
23879+++ linux-2.6.39/arch/x86/vdso/vdso.lds.S 2011-05-22 19:36:30.000000000 -0400
23880@@ -35,3 +35,9 @@ VDSO64_PRELINK = VDSO_PRELINK;
23881 #define VEXTERN(x) VDSO64_ ## x = vdso_ ## x;
23882 #include "vextern.h"
23883 #undef VEXTERN
23884+
23885+#define VEXTERN(x) VDSO64_ ## x = __vdso_ ## x;
23886+VEXTERN(fallback_gettimeofday)
23887+VEXTERN(fallback_time)
23888+VEXTERN(getcpu)
23889+#undef VEXTERN
23890diff -urNp linux-2.6.39/arch/x86/vdso/vextern.h linux-2.6.39/arch/x86/vdso/vextern.h
23891--- linux-2.6.39/arch/x86/vdso/vextern.h 2011-05-19 00:06:34.000000000 -0400
23892+++ linux-2.6.39/arch/x86/vdso/vextern.h 2011-05-22 19:36:30.000000000 -0400
23893@@ -11,6 +11,5 @@
23894 put into vextern.h and be referenced as a pointer with vdso prefix.
23895 The main kernel later fills in the values. */
23896
23897-VEXTERN(jiffies)
23898 VEXTERN(vgetcpu_mode)
23899 VEXTERN(vsyscall_gtod_data)
23900diff -urNp linux-2.6.39/arch/x86/vdso/vma.c linux-2.6.39/arch/x86/vdso/vma.c
23901--- linux-2.6.39/arch/x86/vdso/vma.c 2011-05-19 00:06:34.000000000 -0400
23902+++ linux-2.6.39/arch/x86/vdso/vma.c 2011-05-22 19:36:30.000000000 -0400
23903@@ -58,7 +58,7 @@ static int __init init_vdso_vars(void)
23904 if (!vbase)
23905 goto oom;
23906
23907- if (memcmp(vbase, "\177ELF", 4)) {
23908+ if (memcmp(vbase, ELFMAG, SELFMAG)) {
23909 printk("VDSO: I'm broken; not ELF\n");
23910 vdso_enabled = 0;
23911 }
23912@@ -118,7 +118,7 @@ int arch_setup_additional_pages(struct l
23913 goto up_fail;
23914 }
23915
23916- current->mm->context.vdso = (void *)addr;
23917+ current->mm->context.vdso = addr;
23918
23919 ret = install_special_mapping(mm, addr, vdso_size,
23920 VM_READ|VM_EXEC|
23921@@ -126,7 +126,7 @@ int arch_setup_additional_pages(struct l
23922 VM_ALWAYSDUMP,
23923 vdso_pages);
23924 if (ret) {
23925- current->mm->context.vdso = NULL;
23926+ current->mm->context.vdso = 0;
23927 goto up_fail;
23928 }
23929
23930@@ -134,10 +134,3 @@ up_fail:
23931 up_write(&mm->mmap_sem);
23932 return ret;
23933 }
23934-
23935-static __init int vdso_setup(char *s)
23936-{
23937- vdso_enabled = simple_strtoul(s, NULL, 0);
23938- return 0;
23939-}
23940-__setup("vdso=", vdso_setup);
23941diff -urNp linux-2.6.39/arch/x86/xen/enlighten.c linux-2.6.39/arch/x86/xen/enlighten.c
23942--- linux-2.6.39/arch/x86/xen/enlighten.c 2011-05-19 00:06:34.000000000 -0400
23943+++ linux-2.6.39/arch/x86/xen/enlighten.c 2011-05-22 19:36:30.000000000 -0400
23944@@ -85,8 +85,6 @@ EXPORT_SYMBOL_GPL(xen_start_info);
23945
23946 struct shared_info xen_dummy_shared_info;
23947
23948-void *xen_initial_gdt;
23949-
23950 RESERVE_BRK(shared_info_page_brk, PAGE_SIZE);
23951 __read_mostly int xen_have_vector_callback;
23952 EXPORT_SYMBOL_GPL(xen_have_vector_callback);
23953@@ -1010,7 +1008,7 @@ static const struct pv_apic_ops xen_apic
23954 #endif
23955 };
23956
23957-static void xen_reboot(int reason)
23958+static __noreturn void xen_reboot(int reason)
23959 {
23960 struct sched_shutdown r = { .reason = reason };
23961
23962@@ -1018,17 +1016,17 @@ static void xen_reboot(int reason)
23963 BUG();
23964 }
23965
23966-static void xen_restart(char *msg)
23967+static __noreturn void xen_restart(char *msg)
23968 {
23969 xen_reboot(SHUTDOWN_reboot);
23970 }
23971
23972-static void xen_emergency_restart(void)
23973+static __noreturn void xen_emergency_restart(void)
23974 {
23975 xen_reboot(SHUTDOWN_reboot);
23976 }
23977
23978-static void xen_machine_halt(void)
23979+static __noreturn void xen_machine_halt(void)
23980 {
23981 xen_reboot(SHUTDOWN_poweroff);
23982 }
23983@@ -1127,7 +1125,17 @@ asmlinkage void __init xen_start_kernel(
23984 __userpte_alloc_gfp &= ~__GFP_HIGHMEM;
23985
23986 /* Work out if we support NX */
23987- x86_configure_nx();
23988+#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
23989+ if ((cpuid_eax(0x80000000) & 0xffff0000) == 0x80000000 &&
23990+ (cpuid_edx(0x80000001) & (1U << (X86_FEATURE_NX & 31)))) {
23991+ unsigned l, h;
23992+
23993+ __supported_pte_mask |= _PAGE_NX;
23994+ rdmsr(MSR_EFER, l, h);
23995+ l |= EFER_NX;
23996+ wrmsr(MSR_EFER, l, h);
23997+ }
23998+#endif
23999
24000 xen_setup_features();
24001
24002@@ -1158,13 +1166,6 @@ asmlinkage void __init xen_start_kernel(
24003
24004 machine_ops = xen_machine_ops;
24005
24006- /*
24007- * The only reliable way to retain the initial address of the
24008- * percpu gdt_page is to remember it here, so we can go and
24009- * mark it RW later, when the initial percpu area is freed.
24010- */
24011- xen_initial_gdt = &per_cpu(gdt_page, 0);
24012-
24013 xen_smp_init();
24014
24015 #ifdef CONFIG_ACPI_NUMA
24016diff -urNp linux-2.6.39/arch/x86/xen/mmu.c linux-2.6.39/arch/x86/xen/mmu.c
24017--- linux-2.6.39/arch/x86/xen/mmu.c 2011-05-19 00:06:34.000000000 -0400
24018+++ linux-2.6.39/arch/x86/xen/mmu.c 2011-05-22 19:36:30.000000000 -0400
24019@@ -1791,6 +1791,8 @@ __init pgd_t *xen_setup_kernel_pagetable
24020 convert_pfn_mfn(init_level4_pgt);
24021 convert_pfn_mfn(level3_ident_pgt);
24022 convert_pfn_mfn(level3_kernel_pgt);
24023+ convert_pfn_mfn(level3_vmalloc_pgt);
24024+ convert_pfn_mfn(level3_vmemmap_pgt);
24025
24026 l3 = m2v(pgd[pgd_index(__START_KERNEL_map)].pgd);
24027 l2 = m2v(l3[pud_index(__START_KERNEL_map)].pud);
24028@@ -1809,7 +1811,10 @@ __init pgd_t *xen_setup_kernel_pagetable
24029 set_page_prot(init_level4_pgt, PAGE_KERNEL_RO);
24030 set_page_prot(level3_ident_pgt, PAGE_KERNEL_RO);
24031 set_page_prot(level3_kernel_pgt, PAGE_KERNEL_RO);
24032+ set_page_prot(level3_vmalloc_pgt, PAGE_KERNEL_RO);
24033+ set_page_prot(level3_vmemmap_pgt, PAGE_KERNEL_RO);
24034 set_page_prot(level3_user_vsyscall, PAGE_KERNEL_RO);
24035+ set_page_prot(level2_vmemmap_pgt, PAGE_KERNEL_RO);
24036 set_page_prot(level2_kernel_pgt, PAGE_KERNEL_RO);
24037 set_page_prot(level2_fixmap_pgt, PAGE_KERNEL_RO);
24038
24039diff -urNp linux-2.6.39/arch/x86/xen/pci-swiotlb-xen.c linux-2.6.39/arch/x86/xen/pci-swiotlb-xen.c
24040--- linux-2.6.39/arch/x86/xen/pci-swiotlb-xen.c 2011-05-19 00:06:34.000000000 -0400
24041+++ linux-2.6.39/arch/x86/xen/pci-swiotlb-xen.c 2011-05-22 19:36:30.000000000 -0400
24042@@ -10,7 +10,7 @@
24043
24044 int xen_swiotlb __read_mostly;
24045
24046-static struct dma_map_ops xen_swiotlb_dma_ops = {
24047+static const struct dma_map_ops xen_swiotlb_dma_ops = {
24048 .mapping_error = xen_swiotlb_dma_mapping_error,
24049 .alloc_coherent = xen_swiotlb_alloc_coherent,
24050 .free_coherent = xen_swiotlb_free_coherent,
24051diff -urNp linux-2.6.39/arch/x86/xen/smp.c linux-2.6.39/arch/x86/xen/smp.c
24052--- linux-2.6.39/arch/x86/xen/smp.c 2011-05-19 00:06:34.000000000 -0400
24053+++ linux-2.6.39/arch/x86/xen/smp.c 2011-05-22 19:36:30.000000000 -0400
24054@@ -194,11 +194,6 @@ static void __init xen_smp_prepare_boot_
24055 {
24056 BUG_ON(smp_processor_id() != 0);
24057 native_smp_prepare_boot_cpu();
24058-
24059- /* We've switched to the "real" per-cpu gdt, so make sure the
24060- old memory can be recycled */
24061- make_lowmem_page_readwrite(xen_initial_gdt);
24062-
24063 xen_filter_cpu_maps();
24064 xen_setup_vcpu_info_placement();
24065 }
24066@@ -259,12 +254,12 @@ cpu_initialize_context(unsigned int cpu,
24067 gdt = get_cpu_gdt_table(cpu);
24068
24069 ctxt->flags = VGCF_IN_KERNEL;
24070- ctxt->user_regs.ds = __USER_DS;
24071- ctxt->user_regs.es = __USER_DS;
24072+ ctxt->user_regs.ds = __KERNEL_DS;
24073+ ctxt->user_regs.es = __KERNEL_DS;
24074 ctxt->user_regs.ss = __KERNEL_DS;
24075 #ifdef CONFIG_X86_32
24076 ctxt->user_regs.fs = __KERNEL_PERCPU;
24077- ctxt->user_regs.gs = __KERNEL_STACK_CANARY;
24078+ savesegment(gs, ctxt->user_regs.gs);
24079 #else
24080 ctxt->gs_base_kernel = per_cpu_offset(cpu);
24081 #endif
24082@@ -315,13 +310,12 @@ static int __cpuinit xen_cpu_up(unsigned
24083 int rc;
24084
24085 per_cpu(current_task, cpu) = idle;
24086+ per_cpu(current_tinfo, cpu) = &idle->tinfo;
24087 #ifdef CONFIG_X86_32
24088 irq_ctx_init(cpu);
24089 #else
24090 clear_tsk_thread_flag(idle, TIF_FORK);
24091- per_cpu(kernel_stack, cpu) =
24092- (unsigned long)task_stack_page(idle) -
24093- KERNEL_STACK_OFFSET + THREAD_SIZE;
24094+ per_cpu(kernel_stack, cpu) = (unsigned long)task_stack_page(idle) - 16 + THREAD_SIZE;
24095 #endif
24096 xen_setup_runstate_info(cpu);
24097 xen_setup_timer(cpu);
24098diff -urNp linux-2.6.39/arch/x86/xen/xen-asm_32.S linux-2.6.39/arch/x86/xen/xen-asm_32.S
24099--- linux-2.6.39/arch/x86/xen/xen-asm_32.S 2011-05-19 00:06:34.000000000 -0400
24100+++ linux-2.6.39/arch/x86/xen/xen-asm_32.S 2011-05-22 19:36:30.000000000 -0400
24101@@ -83,14 +83,14 @@ ENTRY(xen_iret)
24102 ESP_OFFSET=4 # bytes pushed onto stack
24103
24104 /*
24105- * Store vcpu_info pointer for easy access. Do it this way to
24106- * avoid having to reload %fs
24107+ * Store vcpu_info pointer for easy access.
24108 */
24109 #ifdef CONFIG_SMP
24110- GET_THREAD_INFO(%eax)
24111- movl TI_cpu(%eax), %eax
24112- movl __per_cpu_offset(,%eax,4), %eax
24113- mov xen_vcpu(%eax), %eax
24114+ push %fs
24115+ mov $(__KERNEL_PERCPU), %eax
24116+ mov %eax, %fs
24117+ mov PER_CPU_VAR(xen_vcpu), %eax
24118+ pop %fs
24119 #else
24120 movl xen_vcpu, %eax
24121 #endif
24122diff -urNp linux-2.6.39/arch/x86/xen/xen-head.S linux-2.6.39/arch/x86/xen/xen-head.S
24123--- linux-2.6.39/arch/x86/xen/xen-head.S 2011-05-19 00:06:34.000000000 -0400
24124+++ linux-2.6.39/arch/x86/xen/xen-head.S 2011-05-22 19:36:30.000000000 -0400
24125@@ -19,6 +19,17 @@ ENTRY(startup_xen)
24126 #ifdef CONFIG_X86_32
24127 mov %esi,xen_start_info
24128 mov $init_thread_union+THREAD_SIZE,%esp
24129+#ifdef CONFIG_SMP
24130+ movl $cpu_gdt_table,%edi
24131+ movl $__per_cpu_load,%eax
24132+ movw %ax,__KERNEL_PERCPU + 2(%edi)
24133+ rorl $16,%eax
24134+ movb %al,__KERNEL_PERCPU + 4(%edi)
24135+ movb %ah,__KERNEL_PERCPU + 7(%edi)
24136+ movl $__per_cpu_end - 1,%eax
24137+ subl $__per_cpu_start,%eax
24138+ movw %ax,__KERNEL_PERCPU + 0(%edi)
24139+#endif
24140 #else
24141 mov %rsi,xen_start_info
24142 mov $init_thread_union+THREAD_SIZE,%rsp
24143diff -urNp linux-2.6.39/arch/x86/xen/xen-ops.h linux-2.6.39/arch/x86/xen/xen-ops.h
24144--- linux-2.6.39/arch/x86/xen/xen-ops.h 2011-05-19 00:06:34.000000000 -0400
24145+++ linux-2.6.39/arch/x86/xen/xen-ops.h 2011-05-22 19:36:30.000000000 -0400
24146@@ -10,8 +10,6 @@
24147 extern const char xen_hypervisor_callback[];
24148 extern const char xen_failsafe_callback[];
24149
24150-extern void *xen_initial_gdt;
24151-
24152 struct trap_info;
24153 void xen_copy_trap_info(struct trap_info *traps);
24154
24155diff -urNp linux-2.6.39/block/blk-iopoll.c linux-2.6.39/block/blk-iopoll.c
24156--- linux-2.6.39/block/blk-iopoll.c 2011-05-19 00:06:34.000000000 -0400
24157+++ linux-2.6.39/block/blk-iopoll.c 2011-05-22 19:36:30.000000000 -0400
24158@@ -77,7 +77,7 @@ void blk_iopoll_complete(struct blk_iopo
24159 }
24160 EXPORT_SYMBOL(blk_iopoll_complete);
24161
24162-static void blk_iopoll_softirq(struct softirq_action *h)
24163+static void blk_iopoll_softirq(void)
24164 {
24165 struct list_head *list = &__get_cpu_var(blk_cpu_iopoll);
24166 int rearm = 0, budget = blk_iopoll_budget;
24167diff -urNp linux-2.6.39/block/blk-map.c linux-2.6.39/block/blk-map.c
24168--- linux-2.6.39/block/blk-map.c 2011-05-19 00:06:34.000000000 -0400
24169+++ linux-2.6.39/block/blk-map.c 2011-05-22 19:36:30.000000000 -0400
24170@@ -301,7 +301,7 @@ int blk_rq_map_kern(struct request_queue
24171 if (!len || !kbuf)
24172 return -EINVAL;
24173
24174- do_copy = !blk_rq_aligned(q, addr, len) || object_is_on_stack(kbuf);
24175+ do_copy = !blk_rq_aligned(q, addr, len) || object_starts_on_stack(kbuf);
24176 if (do_copy)
24177 bio = bio_copy_kern(q, kbuf, len, gfp_mask, reading);
24178 else
24179diff -urNp linux-2.6.39/block/blk-softirq.c linux-2.6.39/block/blk-softirq.c
24180--- linux-2.6.39/block/blk-softirq.c 2011-05-19 00:06:34.000000000 -0400
24181+++ linux-2.6.39/block/blk-softirq.c 2011-05-22 19:36:30.000000000 -0400
24182@@ -17,7 +17,7 @@ static DEFINE_PER_CPU(struct list_head,
24183 * Softirq action handler - move entries to local list and loop over them
24184 * while passing them to the queue registered handler.
24185 */
24186-static void blk_done_softirq(struct softirq_action *h)
24187+static void blk_done_softirq(void)
24188 {
24189 struct list_head *cpu_list, local_list;
24190
24191diff -urNp linux-2.6.39/block/bsg.c linux-2.6.39/block/bsg.c
24192--- linux-2.6.39/block/bsg.c 2011-05-19 00:06:34.000000000 -0400
24193+++ linux-2.6.39/block/bsg.c 2011-05-22 19:36:30.000000000 -0400
24194@@ -176,16 +176,24 @@ static int blk_fill_sgv4_hdr_rq(struct r
24195 struct sg_io_v4 *hdr, struct bsg_device *bd,
24196 fmode_t has_write_perm)
24197 {
24198+ unsigned char tmpcmd[sizeof(rq->__cmd)];
24199+ unsigned char *cmdptr;
24200+
24201 if (hdr->request_len > BLK_MAX_CDB) {
24202 rq->cmd = kzalloc(hdr->request_len, GFP_KERNEL);
24203 if (!rq->cmd)
24204 return -ENOMEM;
24205- }
24206+ cmdptr = rq->cmd;
24207+ } else
24208+ cmdptr = tmpcmd;
24209
24210- if (copy_from_user(rq->cmd, (void *)(unsigned long)hdr->request,
24211+ if (copy_from_user(cmdptr, (void *)(unsigned long)hdr->request,
24212 hdr->request_len))
24213 return -EFAULT;
24214
24215+ if (cmdptr != rq->cmd)
24216+ memcpy(rq->cmd, cmdptr, hdr->request_len);
24217+
24218 if (hdr->subprotocol == BSG_SUB_PROTOCOL_SCSI_CMD) {
24219 if (blk_verify_command(rq->cmd, has_write_perm))
24220 return -EPERM;
24221diff -urNp linux-2.6.39/block/scsi_ioctl.c linux-2.6.39/block/scsi_ioctl.c
24222--- linux-2.6.39/block/scsi_ioctl.c 2011-05-19 00:06:34.000000000 -0400
24223+++ linux-2.6.39/block/scsi_ioctl.c 2011-05-22 19:36:30.000000000 -0400
24224@@ -222,8 +222,20 @@ EXPORT_SYMBOL(blk_verify_command);
24225 static int blk_fill_sghdr_rq(struct request_queue *q, struct request *rq,
24226 struct sg_io_hdr *hdr, fmode_t mode)
24227 {
24228- if (copy_from_user(rq->cmd, hdr->cmdp, hdr->cmd_len))
24229+ unsigned char tmpcmd[sizeof(rq->__cmd)];
24230+ unsigned char *cmdptr;
24231+
24232+ if (rq->cmd != rq->__cmd)
24233+ cmdptr = rq->cmd;
24234+ else
24235+ cmdptr = tmpcmd;
24236+
24237+ if (copy_from_user(cmdptr, hdr->cmdp, hdr->cmd_len))
24238 return -EFAULT;
24239+
24240+ if (cmdptr != rq->cmd)
24241+ memcpy(rq->cmd, cmdptr, hdr->cmd_len);
24242+
24243 if (blk_verify_command(rq->cmd, mode & FMODE_WRITE))
24244 return -EPERM;
24245
24246@@ -432,6 +444,8 @@ int sg_scsi_ioctl(struct request_queue *
24247 int err;
24248 unsigned int in_len, out_len, bytes, opcode, cmdlen;
24249 char *buffer = NULL, sense[SCSI_SENSE_BUFFERSIZE];
24250+ unsigned char tmpcmd[sizeof(rq->__cmd)];
24251+ unsigned char *cmdptr;
24252
24253 if (!sic)
24254 return -EINVAL;
24255@@ -465,9 +479,18 @@ int sg_scsi_ioctl(struct request_queue *
24256 */
24257 err = -EFAULT;
24258 rq->cmd_len = cmdlen;
24259- if (copy_from_user(rq->cmd, sic->data, cmdlen))
24260+
24261+ if (rq->cmd != rq->__cmd)
24262+ cmdptr = rq->cmd;
24263+ else
24264+ cmdptr = tmpcmd;
24265+
24266+ if (copy_from_user(cmdptr, sic->data, cmdlen))
24267 goto error;
24268
24269+ if (rq->cmd != cmdptr)
24270+ memcpy(rq->cmd, cmdptr, cmdlen);
24271+
24272 if (in_len && copy_from_user(buffer, sic->data + cmdlen, in_len))
24273 goto error;
24274
24275diff -urNp linux-2.6.39/crypto/serpent.c linux-2.6.39/crypto/serpent.c
24276--- linux-2.6.39/crypto/serpent.c 2011-05-19 00:06:34.000000000 -0400
24277+++ linux-2.6.39/crypto/serpent.c 2011-05-22 19:36:30.000000000 -0400
24278@@ -224,6 +224,8 @@ static int serpent_setkey(struct crypto_
24279 u32 r0,r1,r2,r3,r4;
24280 int i;
24281
24282+ pax_track_stack();
24283+
24284 /* Copy key, add padding */
24285
24286 for (i = 0; i < keylen; ++i)
24287diff -urNp linux-2.6.39/Documentation/dontdiff linux-2.6.39/Documentation/dontdiff
24288--- linux-2.6.39/Documentation/dontdiff 2011-05-19 00:06:34.000000000 -0400
24289+++ linux-2.6.39/Documentation/dontdiff 2011-05-22 19:36:30.000000000 -0400
24290@@ -1,13 +1,16 @@
24291 *.a
24292 *.aux
24293 *.bin
24294+*.cis
24295 *.cpio
24296 *.csp
24297+*.dbg
24298 *.dsp
24299 *.dvi
24300 *.elf
24301 *.eps
24302 *.fw
24303+*.gcno
24304 *.gen.S
24305 *.gif
24306 *.grep
24307@@ -38,8 +41,10 @@
24308 *.tab.h
24309 *.tex
24310 *.ver
24311+*.vim
24312 *.xml
24313 *_MODULES
24314+*_reg_safe.h
24315 *_vga16.c
24316 *~
24317 *.9
24318@@ -49,11 +54,16 @@
24319 53c700_d.h
24320 CVS
24321 ChangeSet
24322+GPATH
24323+GRTAGS
24324+GSYMS
24325+GTAGS
24326 Image
24327 Kerntypes
24328 Module.markers
24329 Module.symvers
24330 PENDING
24331+PERF*
24332 SCCS
24333 System.map*
24334 TAGS
24335@@ -80,8 +90,11 @@ btfixupprep
24336 build
24337 bvmlinux
24338 bzImage*
24339+capability_names.h
24340 capflags.c
24341 classlist.h*
24342+clut_vga16.c
24343+common-cmds.h
24344 comp*.log
24345 compile.h*
24346 conf
24347@@ -106,16 +119,19 @@ fore200e_mkfirm
24348 fore200e_pca_fw.c*
24349 gconf
24350 gen-devlist
24351+gen-kdb_cmds.c
24352 gen_crc32table
24353 gen_init_cpio
24354 generated
24355 genheaders
24356 genksyms
24357 *_gray256.c
24358+hash
24359 ihex2fw
24360 ikconfig.h*
24361 inat-tables.c
24362 initramfs_data.cpio
24363+initramfs_data.cpio.bz2
24364 initramfs_data.cpio.gz
24365 initramfs_list
24366 int16.c
24367@@ -125,7 +141,6 @@ int32.c
24368 int4.c
24369 int8.c
24370 kallsyms
24371-kconfig
24372 keywords.c
24373 ksym.c*
24374 ksym.h*
24375@@ -149,7 +164,9 @@ mkboot
24376 mkbugboot
24377 mkcpustr
24378 mkdep
24379+mkpiggy
24380 mkprep
24381+mkregtable
24382 mktables
24383 mktree
24384 modpost
24385@@ -165,6 +182,7 @@ parse.h
24386 patches*
24387 pca200e.bin
24388 pca200e_ecd.bin2
24389+perf-archive
24390 piggy.gz
24391 piggyback
24392 piggy.S
24393@@ -180,7 +198,9 @@ r600_reg_safe.h
24394 raid6altivec*.c
24395 raid6int*.c
24396 raid6tables.c
24397+regdb.c
24398 relocs
24399+rlim_names.h
24400 rn50_reg_safe.h
24401 rs600_reg_safe.h
24402 rv515_reg_safe.h
24403@@ -189,6 +209,7 @@ setup
24404 setup.bin
24405 setup.elf
24406 sImage
24407+slabinfo
24408 sm_tbl*
24409 split-include
24410 syscalltab.h
24411@@ -213,13 +234,17 @@ version.h*
24412 vmlinux
24413 vmlinux-*
24414 vmlinux.aout
24415+vmlinux.bin.all
24416+vmlinux.bin.bz2
24417 vmlinux.lds
24418+vmlinux.relocs
24419 voffset.h
24420 vsyscall.lds
24421 vsyscall_32.lds
24422 wanxlfw.inc
24423 uImage
24424 unifdef
24425+utsrelease.h
24426 wakeup.bin
24427 wakeup.elf
24428 wakeup.lds
24429diff -urNp linux-2.6.39/Documentation/filesystems/configfs/configfs_example_macros.c linux-2.6.39/Documentation/filesystems/configfs/configfs_example_macros.c
24430--- linux-2.6.39/Documentation/filesystems/configfs/configfs_example_macros.c 2011-05-19 00:06:34.000000000 -0400
24431+++ linux-2.6.39/Documentation/filesystems/configfs/configfs_example_macros.c 2011-05-22 19:36:30.000000000 -0400
24432@@ -368,7 +368,7 @@ static struct configfs_item_operations g
24433 * Note that, since no extra work is required on ->drop_item(),
24434 * no ->drop_item() is provided.
24435 */
24436-static struct configfs_group_operations group_children_group_ops = {
24437+static const struct configfs_group_operations group_children_group_ops = {
24438 .make_group = group_children_make_group,
24439 };
24440
24441diff -urNp linux-2.6.39/Documentation/filesystems/sysfs.txt linux-2.6.39/Documentation/filesystems/sysfs.txt
24442--- linux-2.6.39/Documentation/filesystems/sysfs.txt 2011-05-19 00:06:34.000000000 -0400
24443+++ linux-2.6.39/Documentation/filesystems/sysfs.txt 2011-05-22 19:36:30.000000000 -0400
24444@@ -125,8 +125,8 @@ set of sysfs operations for forwarding r
24445 show and store methods of the attribute owners.
24446
24447 struct sysfs_ops {
24448- ssize_t (*show)(struct kobject *, struct attribute *, char *);
24449- ssize_t (*store)(struct kobject *, struct attribute *, const char *, size_t);
24450+ ssize_t (* const show)(struct kobject *, struct attribute *, char *);
24451+ ssize_t (* const store)(struct kobject *, struct attribute *, const char *, size_t);
24452 };
24453
24454 [ Subsystems should have already defined a struct kobj_type as a
24455diff -urNp linux-2.6.39/Documentation/kernel-parameters.txt linux-2.6.39/Documentation/kernel-parameters.txt
24456--- linux-2.6.39/Documentation/kernel-parameters.txt 2011-05-19 00:06:34.000000000 -0400
24457+++ linux-2.6.39/Documentation/kernel-parameters.txt 2011-05-22 19:36:30.000000000 -0400
24458@@ -1879,6 +1879,13 @@ bytes respectively. Such letter suffixes
24459 the specified number of seconds. This is to be used if
24460 your oopses keep scrolling off the screen.
24461
24462+ pax_nouderef [X86] disables UDEREF. Most likely needed under certain
24463+ virtualization environments that don't cope well with the
24464+ expand down segment used by UDEREF on X86-32 or the frequent
24465+ page table updates on X86-64.
24466+
24467+ pax_softmode= 0/1 to disable/enable PaX softmode on boot already.
24468+
24469 pcbit= [HW,ISDN]
24470
24471 pcd. [PARIDE]
24472diff -urNp linux-2.6.39/drivers/acpi/acpi_ipmi.c linux-2.6.39/drivers/acpi/acpi_ipmi.c
24473--- linux-2.6.39/drivers/acpi/acpi_ipmi.c 2011-05-19 00:06:34.000000000 -0400
24474+++ linux-2.6.39/drivers/acpi/acpi_ipmi.c 2011-05-22 19:36:30.000000000 -0400
24475@@ -70,7 +70,7 @@ struct acpi_ipmi_device {
24476 struct ipmi_driver_data {
24477 struct list_head ipmi_devices;
24478 struct ipmi_smi_watcher bmc_events;
24479- struct ipmi_user_hndl ipmi_hndlrs;
24480+ const struct ipmi_user_hndl ipmi_hndlrs;
24481 struct mutex ipmi_lock;
24482 };
24483
24484diff -urNp linux-2.6.39/drivers/acpi/apei/cper.c linux-2.6.39/drivers/acpi/apei/cper.c
24485--- linux-2.6.39/drivers/acpi/apei/cper.c 2011-05-19 00:06:34.000000000 -0400
24486+++ linux-2.6.39/drivers/acpi/apei/cper.c 2011-05-22 19:36:30.000000000 -0400
24487@@ -38,12 +38,12 @@
24488 */
24489 u64 cper_next_record_id(void)
24490 {
24491- static atomic64_t seq;
24492+ static atomic64_unchecked_t seq;
24493
24494- if (!atomic64_read(&seq))
24495- atomic64_set(&seq, ((u64)get_seconds()) << 32);
24496+ if (!atomic64_read_unchecked(&seq))
24497+ atomic64_set_unchecked(&seq, ((u64)get_seconds()) << 32);
24498
24499- return atomic64_inc_return(&seq);
24500+ return atomic64_inc_return_unchecked(&seq);
24501 }
24502 EXPORT_SYMBOL_GPL(cper_next_record_id);
24503
24504diff -urNp linux-2.6.39/drivers/acpi/battery.c linux-2.6.39/drivers/acpi/battery.c
24505--- linux-2.6.39/drivers/acpi/battery.c 2011-05-19 00:06:34.000000000 -0400
24506+++ linux-2.6.39/drivers/acpi/battery.c 2011-05-22 19:36:30.000000000 -0400
24507@@ -864,7 +864,7 @@ DECLARE_FILE_FUNCTIONS(alarm);
24508 }
24509
24510 static struct battery_file {
24511- struct file_operations ops;
24512+ const struct file_operations ops;
24513 mode_t mode;
24514 const char *name;
24515 } acpi_battery_file[] = {
24516diff -urNp linux-2.6.39/drivers/acpi/dock.c linux-2.6.39/drivers/acpi/dock.c
24517--- linux-2.6.39/drivers/acpi/dock.c 2011-05-19 00:06:34.000000000 -0400
24518+++ linux-2.6.39/drivers/acpi/dock.c 2011-05-22 19:36:30.000000000 -0400
24519@@ -77,7 +77,7 @@ struct dock_dependent_device {
24520 struct list_head list;
24521 struct list_head hotplug_list;
24522 acpi_handle handle;
24523- struct acpi_dock_ops *ops;
24524+ const struct acpi_dock_ops *ops;
24525 void *context;
24526 };
24527
24528@@ -589,7 +589,7 @@ EXPORT_SYMBOL_GPL(unregister_dock_notifi
24529 * the dock driver after _DCK is executed.
24530 */
24531 int
24532-register_hotplug_dock_device(acpi_handle handle, struct acpi_dock_ops *ops,
24533+register_hotplug_dock_device(acpi_handle handle, const struct acpi_dock_ops *ops,
24534 void *context)
24535 {
24536 struct dock_dependent_device *dd;
24537diff -urNp linux-2.6.39/drivers/acpi/ec_sys.c linux-2.6.39/drivers/acpi/ec_sys.c
24538--- linux-2.6.39/drivers/acpi/ec_sys.c 2011-05-19 00:06:34.000000000 -0400
24539+++ linux-2.6.39/drivers/acpi/ec_sys.c 2011-05-22 19:36:30.000000000 -0400
24540@@ -92,7 +92,7 @@ static ssize_t acpi_ec_write_io(struct f
24541 return count;
24542 }
24543
24544-static struct file_operations acpi_ec_io_ops = {
24545+static const struct file_operations acpi_ec_io_ops = {
24546 .owner = THIS_MODULE,
24547 .open = acpi_ec_open_io,
24548 .read = acpi_ec_read_io,
24549diff -urNp linux-2.6.39/drivers/acpi/fan.c linux-2.6.39/drivers/acpi/fan.c
24550--- linux-2.6.39/drivers/acpi/fan.c 2011-05-19 00:06:34.000000000 -0400
24551+++ linux-2.6.39/drivers/acpi/fan.c 2011-05-22 19:36:30.000000000 -0400
24552@@ -110,7 +110,7 @@ fan_set_cur_state(struct thermal_cooling
24553 return result;
24554 }
24555
24556-static struct thermal_cooling_device_ops fan_cooling_ops = {
24557+static const struct thermal_cooling_device_ops fan_cooling_ops = {
24558 .get_max_state = fan_get_max_state,
24559 .get_cur_state = fan_get_cur_state,
24560 .set_cur_state = fan_set_cur_state,
24561diff -urNp linux-2.6.39/drivers/acpi/power_meter.c linux-2.6.39/drivers/acpi/power_meter.c
24562--- linux-2.6.39/drivers/acpi/power_meter.c 2011-05-19 00:06:34.000000000 -0400
24563+++ linux-2.6.39/drivers/acpi/power_meter.c 2011-05-22 19:36:30.000000000 -0400
24564@@ -316,8 +316,6 @@ static ssize_t set_trip(struct device *d
24565 return res;
24566
24567 temp /= 1000;
24568- if (temp < 0)
24569- return -EINVAL;
24570
24571 mutex_lock(&resource->lock);
24572 resource->trip[attr->index - 7] = temp;
24573diff -urNp linux-2.6.39/drivers/acpi/proc.c linux-2.6.39/drivers/acpi/proc.c
24574--- linux-2.6.39/drivers/acpi/proc.c 2011-05-19 00:06:34.000000000 -0400
24575+++ linux-2.6.39/drivers/acpi/proc.c 2011-05-22 19:36:30.000000000 -0400
24576@@ -342,19 +342,13 @@ acpi_system_write_wakeup_device(struct f
24577 size_t count, loff_t * ppos)
24578 {
24579 struct list_head *node, *next;
24580- char strbuf[5];
24581- char str[5] = "";
24582- unsigned int len = count;
24583-
24584- if (len > 4)
24585- len = 4;
24586- if (len < 0)
24587- return -EFAULT;
24588+ char strbuf[5] = {0};
24589
24590- if (copy_from_user(strbuf, buffer, len))
24591+ if (count > 4)
24592+ count = 4;
24593+ if (copy_from_user(strbuf, buffer, count))
24594 return -EFAULT;
24595- strbuf[len] = '\0';
24596- sscanf(strbuf, "%s", str);
24597+ strbuf[count] = '\0';
24598
24599 mutex_lock(&acpi_device_lock);
24600 list_for_each_safe(node, next, &acpi_wakeup_device_list) {
24601@@ -363,7 +357,7 @@ acpi_system_write_wakeup_device(struct f
24602 if (!dev->wakeup.flags.valid)
24603 continue;
24604
24605- if (!strncmp(dev->pnp.bus_id, str, 4)) {
24606+ if (!strncmp(dev->pnp.bus_id, strbuf, 4)) {
24607 if (device_can_wakeup(&dev->dev)) {
24608 bool enable = !device_may_wakeup(&dev->dev);
24609 device_set_wakeup_enable(&dev->dev, enable);
24610diff -urNp linux-2.6.39/drivers/acpi/processor_driver.c linux-2.6.39/drivers/acpi/processor_driver.c
24611--- linux-2.6.39/drivers/acpi/processor_driver.c 2011-05-19 00:06:34.000000000 -0400
24612+++ linux-2.6.39/drivers/acpi/processor_driver.c 2011-05-22 19:36:30.000000000 -0400
24613@@ -473,7 +473,7 @@ static int __cpuinit acpi_processor_add(
24614 return 0;
24615 #endif
24616
24617- BUG_ON((pr->id >= nr_cpu_ids) || (pr->id < 0));
24618+ BUG_ON(pr->id >= nr_cpu_ids);
24619
24620 /*
24621 * Buggy BIOS check
24622diff -urNp linux-2.6.39/drivers/acpi/processor_idle.c linux-2.6.39/drivers/acpi/processor_idle.c
24623--- linux-2.6.39/drivers/acpi/processor_idle.c 2011-05-19 00:06:34.000000000 -0400
24624+++ linux-2.6.39/drivers/acpi/processor_idle.c 2011-05-22 19:36:30.000000000 -0400
24625@@ -121,7 +121,7 @@ static struct dmi_system_id __cpuinitdat
24626 DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK Computer Inc."),
24627 DMI_MATCH(DMI_PRODUCT_NAME,"L8400B series Notebook PC")},
24628 (void *)1},
24629- {},
24630+ {}
24631 };
24632
24633
24634diff -urNp linux-2.6.39/drivers/acpi/processor_thermal.c linux-2.6.39/drivers/acpi/processor_thermal.c
24635--- linux-2.6.39/drivers/acpi/processor_thermal.c 2011-05-19 00:06:34.000000000 -0400
24636+++ linux-2.6.39/drivers/acpi/processor_thermal.c 2011-05-22 19:36:30.000000000 -0400
24637@@ -244,7 +244,7 @@ processor_set_cur_state(struct thermal_c
24638 return result;
24639 }
24640
24641-struct thermal_cooling_device_ops processor_cooling_ops = {
24642+const struct thermal_cooling_device_ops processor_cooling_ops = {
24643 .get_max_state = processor_get_max_state,
24644 .get_cur_state = processor_get_cur_state,
24645 .set_cur_state = processor_set_cur_state,
24646diff -urNp linux-2.6.39/drivers/acpi/sysfs.c linux-2.6.39/drivers/acpi/sysfs.c
24647--- linux-2.6.39/drivers/acpi/sysfs.c 2011-05-19 00:06:34.000000000 -0400
24648+++ linux-2.6.39/drivers/acpi/sysfs.c 2011-05-22 19:36:30.000000000 -0400
24649@@ -149,12 +149,12 @@ static int param_get_debug_level(char *b
24650 return result;
24651 }
24652
24653-static struct kernel_param_ops param_ops_debug_layer = {
24654+static const struct kernel_param_ops param_ops_debug_layer = {
24655 .set = param_set_uint,
24656 .get = param_get_debug_layer,
24657 };
24658
24659-static struct kernel_param_ops param_ops_debug_level = {
24660+static const struct kernel_param_ops param_ops_debug_level = {
24661 .set = param_set_uint,
24662 .get = param_get_debug_level,
24663 };
24664diff -urNp linux-2.6.39/drivers/acpi/thermal.c linux-2.6.39/drivers/acpi/thermal.c
24665--- linux-2.6.39/drivers/acpi/thermal.c 2011-05-19 00:06:34.000000000 -0400
24666+++ linux-2.6.39/drivers/acpi/thermal.c 2011-05-22 19:36:30.000000000 -0400
24667@@ -812,7 +812,7 @@ acpi_thermal_unbind_cooling_device(struc
24668 thermal_zone_unbind_cooling_device);
24669 }
24670
24671-static struct thermal_zone_device_ops acpi_thermal_zone_ops = {
24672+static const struct thermal_zone_device_ops acpi_thermal_zone_ops = {
24673 .bind = acpi_thermal_bind_cooling_device,
24674 .unbind = acpi_thermal_unbind_cooling_device,
24675 .get_temp = thermal_get_temp,
24676diff -urNp linux-2.6.39/drivers/acpi/video.c linux-2.6.39/drivers/acpi/video.c
24677--- linux-2.6.39/drivers/acpi/video.c 2011-05-19 00:06:34.000000000 -0400
24678+++ linux-2.6.39/drivers/acpi/video.c 2011-05-22 19:36:30.000000000 -0400
24679@@ -308,7 +308,7 @@ video_set_cur_state(struct thermal_cooli
24680 return acpi_video_device_lcd_set_level(video, level);
24681 }
24682
24683-static struct thermal_cooling_device_ops video_cooling_ops = {
24684+static const struct thermal_cooling_device_ops video_cooling_ops = {
24685 .get_max_state = video_get_max_state,
24686 .get_cur_state = video_get_cur_state,
24687 .set_cur_state = video_set_cur_state,
24688diff -urNp linux-2.6.39/drivers/ata/acard-ahci.c linux-2.6.39/drivers/ata/acard-ahci.c
24689--- linux-2.6.39/drivers/ata/acard-ahci.c 2011-05-19 00:06:34.000000000 -0400
24690+++ linux-2.6.39/drivers/ata/acard-ahci.c 2011-05-22 19:36:30.000000000 -0400
24691@@ -87,7 +87,7 @@ static struct scsi_host_template acard_a
24692 AHCI_SHT("acard-ahci"),
24693 };
24694
24695-static struct ata_port_operations acard_ops = {
24696+static const struct ata_port_operations acard_ops = {
24697 .inherits = &ahci_ops,
24698 .qc_prep = acard_ahci_qc_prep,
24699 .qc_fill_rtf = acard_ahci_qc_fill_rtf,
24700diff -urNp linux-2.6.39/drivers/ata/ahci.c linux-2.6.39/drivers/ata/ahci.c
24701--- linux-2.6.39/drivers/ata/ahci.c 2011-05-19 00:06:34.000000000 -0400
24702+++ linux-2.6.39/drivers/ata/ahci.c 2011-05-22 19:36:30.000000000 -0400
24703@@ -94,17 +94,17 @@ static struct scsi_host_template ahci_sh
24704 AHCI_SHT("ahci"),
24705 };
24706
24707-static struct ata_port_operations ahci_vt8251_ops = {
24708+static const struct ata_port_operations ahci_vt8251_ops = {
24709 .inherits = &ahci_ops,
24710 .hardreset = ahci_vt8251_hardreset,
24711 };
24712
24713-static struct ata_port_operations ahci_p5wdh_ops = {
24714+static const struct ata_port_operations ahci_p5wdh_ops = {
24715 .inherits = &ahci_ops,
24716 .hardreset = ahci_p5wdh_hardreset,
24717 };
24718
24719-static struct ata_port_operations ahci_sb600_ops = {
24720+static const struct ata_port_operations ahci_sb600_ops = {
24721 .inherits = &ahci_ops,
24722 .softreset = ahci_sb600_softreset,
24723 .pmp_softreset = ahci_sb600_softreset,
24724diff -urNp linux-2.6.39/drivers/ata/ahci.h linux-2.6.39/drivers/ata/ahci.h
24725--- linux-2.6.39/drivers/ata/ahci.h 2011-05-19 00:06:34.000000000 -0400
24726+++ linux-2.6.39/drivers/ata/ahci.h 2011-05-22 19:36:30.000000000 -0400
24727@@ -311,7 +311,7 @@ extern struct device_attribute *ahci_sde
24728 .shost_attrs = ahci_shost_attrs, \
24729 .sdev_attrs = ahci_sdev_attrs
24730
24731-extern struct ata_port_operations ahci_ops;
24732+extern const struct ata_port_operations ahci_ops;
24733
24734 void ahci_fill_cmd_slot(struct ahci_port_priv *pp, unsigned int tag,
24735 u32 opts);
24736diff -urNp linux-2.6.39/drivers/ata/ata_generic.c linux-2.6.39/drivers/ata/ata_generic.c
24737--- linux-2.6.39/drivers/ata/ata_generic.c 2011-05-19 00:06:34.000000000 -0400
24738+++ linux-2.6.39/drivers/ata/ata_generic.c 2011-05-22 19:36:30.000000000 -0400
24739@@ -101,7 +101,7 @@ static struct scsi_host_template generic
24740 ATA_BMDMA_SHT(DRV_NAME),
24741 };
24742
24743-static struct ata_port_operations generic_port_ops = {
24744+static const struct ata_port_operations generic_port_ops = {
24745 .inherits = &ata_bmdma_port_ops,
24746 .cable_detect = ata_cable_unknown,
24747 .set_mode = generic_set_mode,
24748diff -urNp linux-2.6.39/drivers/ata/ata_piix.c linux-2.6.39/drivers/ata/ata_piix.c
24749--- linux-2.6.39/drivers/ata/ata_piix.c 2011-05-19 00:06:34.000000000 -0400
24750+++ linux-2.6.39/drivers/ata/ata_piix.c 2011-05-22 19:36:30.000000000 -0400
24751@@ -335,12 +335,12 @@ static struct scsi_host_template piix_sh
24752 ATA_BMDMA_SHT(DRV_NAME),
24753 };
24754
24755-static struct ata_port_operations piix_sata_ops = {
24756+static const struct ata_port_operations piix_sata_ops = {
24757 .inherits = &ata_bmdma32_port_ops,
24758 .sff_irq_check = piix_irq_check,
24759 };
24760
24761-static struct ata_port_operations piix_pata_ops = {
24762+static const struct ata_port_operations piix_pata_ops = {
24763 .inherits = &piix_sata_ops,
24764 .cable_detect = ata_cable_40wire,
24765 .set_piomode = piix_set_piomode,
24766@@ -348,12 +348,12 @@ static struct ata_port_operations piix_p
24767 .prereset = piix_pata_prereset,
24768 };
24769
24770-static struct ata_port_operations piix_vmw_ops = {
24771+static const struct ata_port_operations piix_vmw_ops = {
24772 .inherits = &piix_pata_ops,
24773 .bmdma_status = piix_vmw_bmdma_status,
24774 };
24775
24776-static struct ata_port_operations ich_pata_ops = {
24777+static const struct ata_port_operations ich_pata_ops = {
24778 .inherits = &piix_pata_ops,
24779 .cable_detect = ich_pata_cable_detect,
24780 .set_dmamode = ich_set_dmamode,
24781@@ -369,7 +369,7 @@ static struct scsi_host_template piix_si
24782 .shost_attrs = piix_sidpr_shost_attrs,
24783 };
24784
24785-static struct ata_port_operations piix_sidpr_sata_ops = {
24786+static const struct ata_port_operations piix_sidpr_sata_ops = {
24787 .inherits = &piix_sata_ops,
24788 .hardreset = sata_std_hardreset,
24789 .scr_read = piix_sidpr_scr_read,
24790diff -urNp linux-2.6.39/drivers/ata/libahci.c linux-2.6.39/drivers/ata/libahci.c
24791--- linux-2.6.39/drivers/ata/libahci.c 2011-05-19 00:06:34.000000000 -0400
24792+++ linux-2.6.39/drivers/ata/libahci.c 2011-05-22 19:36:30.000000000 -0400
24793@@ -141,7 +141,7 @@ struct device_attribute *ahci_sdev_attrs
24794 };
24795 EXPORT_SYMBOL_GPL(ahci_sdev_attrs);
24796
24797-struct ata_port_operations ahci_ops = {
24798+const struct ata_port_operations ahci_ops = {
24799 .inherits = &sata_pmp_port_ops,
24800
24801 .qc_defer = ahci_pmp_qc_defer,
24802diff -urNp linux-2.6.39/drivers/ata/libata-acpi.c linux-2.6.39/drivers/ata/libata-acpi.c
24803--- linux-2.6.39/drivers/ata/libata-acpi.c 2011-05-19 00:06:34.000000000 -0400
24804+++ linux-2.6.39/drivers/ata/libata-acpi.c 2011-05-22 19:36:30.000000000 -0400
24805@@ -218,12 +218,12 @@ static void ata_acpi_dev_uevent(acpi_han
24806 ata_acpi_uevent(dev->link->ap, dev, event);
24807 }
24808
24809-static struct acpi_dock_ops ata_acpi_dev_dock_ops = {
24810+static const struct acpi_dock_ops ata_acpi_dev_dock_ops = {
24811 .handler = ata_acpi_dev_notify_dock,
24812 .uevent = ata_acpi_dev_uevent,
24813 };
24814
24815-static struct acpi_dock_ops ata_acpi_ap_dock_ops = {
24816+static const struct acpi_dock_ops ata_acpi_ap_dock_ops = {
24817 .handler = ata_acpi_ap_notify_dock,
24818 .uevent = ata_acpi_ap_uevent,
24819 };
24820diff -urNp linux-2.6.39/drivers/ata/libata-core.c linux-2.6.39/drivers/ata/libata-core.c
24821--- linux-2.6.39/drivers/ata/libata-core.c 2011-05-19 00:06:34.000000000 -0400
24822+++ linux-2.6.39/drivers/ata/libata-core.c 2011-05-22 19:36:30.000000000 -0400
24823@@ -4747,7 +4747,7 @@ void ata_qc_free(struct ata_queued_cmd *
24824 struct ata_port *ap;
24825 unsigned int tag;
24826
24827- WARN_ON_ONCE(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
24828+ BUG_ON(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
24829 ap = qc->ap;
24830
24831 qc->flags = 0;
24832@@ -4763,7 +4763,7 @@ void __ata_qc_complete(struct ata_queued
24833 struct ata_port *ap;
24834 struct ata_link *link;
24835
24836- WARN_ON_ONCE(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
24837+ BUG_ON(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
24838 WARN_ON_ONCE(!(qc->flags & ATA_QCFLAG_ACTIVE));
24839 ap = qc->ap;
24840 link = qc->dev->link;
24841@@ -5756,7 +5756,7 @@ static void ata_host_stop(struct device
24842 * LOCKING:
24843 * None.
24844 */
24845-static void ata_finalize_port_ops(struct ata_port_operations *ops)
24846+static void ata_finalize_port_ops(const struct ata_port_operations *ops)
24847 {
24848 static DEFINE_SPINLOCK(lock);
24849 const struct ata_port_operations *cur;
24850@@ -5768,6 +5768,7 @@ static void ata_finalize_port_ops(struct
24851 return;
24852
24853 spin_lock(&lock);
24854+ pax_open_kernel();
24855
24856 for (cur = ops->inherits; cur; cur = cur->inherits) {
24857 void **inherit = (void **)cur;
24858@@ -5781,8 +5782,9 @@ static void ata_finalize_port_ops(struct
24859 if (IS_ERR(*pp))
24860 *pp = NULL;
24861
24862- ops->inherits = NULL;
24863+ ((struct ata_port_operations *)ops)->inherits = NULL;
24864
24865+ pax_close_kernel();
24866 spin_unlock(&lock);
24867 }
24868
24869@@ -5879,7 +5881,7 @@ int ata_host_start(struct ata_host *host
24870 */
24871 /* KILLME - the only user left is ipr */
24872 void ata_host_init(struct ata_host *host, struct device *dev,
24873- unsigned long flags, struct ata_port_operations *ops)
24874+ unsigned long flags, const struct ata_port_operations *ops)
24875 {
24876 spin_lock_init(&host->lock);
24877 mutex_init(&host->eh_mutex);
24878@@ -6583,7 +6585,7 @@ static void ata_dummy_error_handler(stru
24879 /* truly dummy */
24880 }
24881
24882-struct ata_port_operations ata_dummy_port_ops = {
24883+const struct ata_port_operations ata_dummy_port_ops = {
24884 .qc_prep = ata_noop_qc_prep,
24885 .qc_issue = ata_dummy_qc_issue,
24886 .error_handler = ata_dummy_error_handler,
24887diff -urNp linux-2.6.39/drivers/ata/libata-eh.c linux-2.6.39/drivers/ata/libata-eh.c
24888--- linux-2.6.39/drivers/ata/libata-eh.c 2011-05-19 00:06:34.000000000 -0400
24889+++ linux-2.6.39/drivers/ata/libata-eh.c 2011-05-22 19:36:30.000000000 -0400
24890@@ -2518,6 +2518,8 @@ void ata_eh_report(struct ata_port *ap)
24891 {
24892 struct ata_link *link;
24893
24894+ pax_track_stack();
24895+
24896 ata_for_each_link(link, ap, HOST_FIRST)
24897 ata_eh_link_report(link);
24898 }
24899@@ -3922,7 +3924,7 @@ void ata_do_eh(struct ata_port *ap, ata_
24900 */
24901 void ata_std_error_handler(struct ata_port *ap)
24902 {
24903- struct ata_port_operations *ops = ap->ops;
24904+ const struct ata_port_operations *ops = ap->ops;
24905 ata_reset_fn_t hardreset = ops->hardreset;
24906
24907 /* ignore built-in hardreset if SCR access is not available */
24908diff -urNp linux-2.6.39/drivers/ata/libata-pmp.c linux-2.6.39/drivers/ata/libata-pmp.c
24909--- linux-2.6.39/drivers/ata/libata-pmp.c 2011-05-19 00:06:34.000000000 -0400
24910+++ linux-2.6.39/drivers/ata/libata-pmp.c 2011-05-22 19:36:30.000000000 -0400
24911@@ -912,7 +912,7 @@ static int sata_pmp_handle_link_fail(str
24912 */
24913 static int sata_pmp_eh_recover(struct ata_port *ap)
24914 {
24915- struct ata_port_operations *ops = ap->ops;
24916+ const struct ata_port_operations *ops = ap->ops;
24917 int pmp_tries, link_tries[SATA_PMP_MAX_PORTS];
24918 struct ata_link *pmp_link = &ap->link;
24919 struct ata_device *pmp_dev = pmp_link->device;
24920diff -urNp linux-2.6.39/drivers/ata/pata_acpi.c linux-2.6.39/drivers/ata/pata_acpi.c
24921--- linux-2.6.39/drivers/ata/pata_acpi.c 2011-05-19 00:06:34.000000000 -0400
24922+++ linux-2.6.39/drivers/ata/pata_acpi.c 2011-05-22 19:36:30.000000000 -0400
24923@@ -216,7 +216,7 @@ static struct scsi_host_template pacpi_s
24924 ATA_BMDMA_SHT(DRV_NAME),
24925 };
24926
24927-static struct ata_port_operations pacpi_ops = {
24928+static const struct ata_port_operations pacpi_ops = {
24929 .inherits = &ata_bmdma_port_ops,
24930 .qc_issue = pacpi_qc_issue,
24931 .cable_detect = pacpi_cable_detect,
24932diff -urNp linux-2.6.39/drivers/ata/pata_ali.c linux-2.6.39/drivers/ata/pata_ali.c
24933--- linux-2.6.39/drivers/ata/pata_ali.c 2011-05-19 00:06:34.000000000 -0400
24934+++ linux-2.6.39/drivers/ata/pata_ali.c 2011-05-22 19:36:30.000000000 -0400
24935@@ -363,7 +363,7 @@ static struct scsi_host_template ali_sht
24936 * Port operations for PIO only ALi
24937 */
24938
24939-static struct ata_port_operations ali_early_port_ops = {
24940+static const struct ata_port_operations ali_early_port_ops = {
24941 .inherits = &ata_sff_port_ops,
24942 .cable_detect = ata_cable_40wire,
24943 .set_piomode = ali_set_piomode,
24944@@ -380,7 +380,7 @@ static const struct ata_port_operations
24945 * Port operations for DMA capable ALi without cable
24946 * detect
24947 */
24948-static struct ata_port_operations ali_20_port_ops = {
24949+static const struct ata_port_operations ali_20_port_ops = {
24950 .inherits = &ali_dma_base_ops,
24951 .cable_detect = ata_cable_40wire,
24952 .mode_filter = ali_20_filter,
24953@@ -391,7 +391,7 @@ static struct ata_port_operations ali_20
24954 /*
24955 * Port operations for DMA capable ALi with cable detect
24956 */
24957-static struct ata_port_operations ali_c2_port_ops = {
24958+static const struct ata_port_operations ali_c2_port_ops = {
24959 .inherits = &ali_dma_base_ops,
24960 .check_atapi_dma = ali_check_atapi_dma,
24961 .cable_detect = ali_c2_cable_detect,
24962@@ -402,7 +402,7 @@ static struct ata_port_operations ali_c2
24963 /*
24964 * Port operations for DMA capable ALi with cable detect
24965 */
24966-static struct ata_port_operations ali_c4_port_ops = {
24967+static const struct ata_port_operations ali_c4_port_ops = {
24968 .inherits = &ali_dma_base_ops,
24969 .check_atapi_dma = ali_check_atapi_dma,
24970 .cable_detect = ali_c2_cable_detect,
24971@@ -412,7 +412,7 @@ static struct ata_port_operations ali_c4
24972 /*
24973 * Port operations for DMA capable ALi with cable detect and LBA48
24974 */
24975-static struct ata_port_operations ali_c5_port_ops = {
24976+static const struct ata_port_operations ali_c5_port_ops = {
24977 .inherits = &ali_dma_base_ops,
24978 .check_atapi_dma = ali_check_atapi_dma,
24979 .dev_config = ali_warn_atapi_dma,
24980diff -urNp linux-2.6.39/drivers/ata/pata_amd.c linux-2.6.39/drivers/ata/pata_amd.c
24981--- linux-2.6.39/drivers/ata/pata_amd.c 2011-05-19 00:06:34.000000000 -0400
24982+++ linux-2.6.39/drivers/ata/pata_amd.c 2011-05-22 19:36:31.000000000 -0400
24983@@ -397,28 +397,28 @@ static const struct ata_port_operations
24984 .prereset = amd_pre_reset,
24985 };
24986
24987-static struct ata_port_operations amd33_port_ops = {
24988+static const struct ata_port_operations amd33_port_ops = {
24989 .inherits = &amd_base_port_ops,
24990 .cable_detect = ata_cable_40wire,
24991 .set_piomode = amd33_set_piomode,
24992 .set_dmamode = amd33_set_dmamode,
24993 };
24994
24995-static struct ata_port_operations amd66_port_ops = {
24996+static const struct ata_port_operations amd66_port_ops = {
24997 .inherits = &amd_base_port_ops,
24998 .cable_detect = ata_cable_unknown,
24999 .set_piomode = amd66_set_piomode,
25000 .set_dmamode = amd66_set_dmamode,
25001 };
25002
25003-static struct ata_port_operations amd100_port_ops = {
25004+static const struct ata_port_operations amd100_port_ops = {
25005 .inherits = &amd_base_port_ops,
25006 .cable_detect = ata_cable_unknown,
25007 .set_piomode = amd100_set_piomode,
25008 .set_dmamode = amd100_set_dmamode,
25009 };
25010
25011-static struct ata_port_operations amd133_port_ops = {
25012+static const struct ata_port_operations amd133_port_ops = {
25013 .inherits = &amd_base_port_ops,
25014 .cable_detect = amd_cable_detect,
25015 .set_piomode = amd133_set_piomode,
25016@@ -433,13 +433,13 @@ static const struct ata_port_operations
25017 .host_stop = nv_host_stop,
25018 };
25019
25020-static struct ata_port_operations nv100_port_ops = {
25021+static const struct ata_port_operations nv100_port_ops = {
25022 .inherits = &nv_base_port_ops,
25023 .set_piomode = nv100_set_piomode,
25024 .set_dmamode = nv100_set_dmamode,
25025 };
25026
25027-static struct ata_port_operations nv133_port_ops = {
25028+static const struct ata_port_operations nv133_port_ops = {
25029 .inherits = &nv_base_port_ops,
25030 .set_piomode = nv133_set_piomode,
25031 .set_dmamode = nv133_set_dmamode,
25032diff -urNp linux-2.6.39/drivers/ata/pata_arasan_cf.c linux-2.6.39/drivers/ata/pata_arasan_cf.c
25033--- linux-2.6.39/drivers/ata/pata_arasan_cf.c 2011-05-19 00:06:34.000000000 -0400
25034+++ linux-2.6.39/drivers/ata/pata_arasan_cf.c 2011-05-22 19:36:31.000000000 -0400
25035@@ -862,7 +862,9 @@ static int __devinit arasan_cf_probe(str
25036 /* Handle platform specific quirks */
25037 if (pdata->quirk) {
25038 if (pdata->quirk & CF_BROKEN_PIO) {
25039- ap->ops->set_piomode = NULL;
25040+ pax_open_kernel();
25041+ *(void**)&ap->ops->set_piomode = NULL;
25042+ pax_close_kernel();
25043 ap->pio_mask = 0;
25044 }
25045 if (pdata->quirk & CF_BROKEN_MWDMA)
25046diff -urNp linux-2.6.39/drivers/ata/pata_artop.c linux-2.6.39/drivers/ata/pata_artop.c
25047--- linux-2.6.39/drivers/ata/pata_artop.c 2011-05-19 00:06:34.000000000 -0400
25048+++ linux-2.6.39/drivers/ata/pata_artop.c 2011-05-22 19:36:31.000000000 -0400
25049@@ -312,7 +312,7 @@ static struct scsi_host_template artop_s
25050 ATA_BMDMA_SHT(DRV_NAME),
25051 };
25052
25053-static struct ata_port_operations artop6210_ops = {
25054+static const struct ata_port_operations artop6210_ops = {
25055 .inherits = &ata_bmdma_port_ops,
25056 .cable_detect = ata_cable_40wire,
25057 .set_piomode = artop6210_set_piomode,
25058@@ -321,7 +321,7 @@ static struct ata_port_operations artop6
25059 .qc_defer = artop6210_qc_defer,
25060 };
25061
25062-static struct ata_port_operations artop6260_ops = {
25063+static const struct ata_port_operations artop6260_ops = {
25064 .inherits = &ata_bmdma_port_ops,
25065 .cable_detect = artop6260_cable_detect,
25066 .set_piomode = artop6260_set_piomode,
25067diff -urNp linux-2.6.39/drivers/ata/pata_at32.c linux-2.6.39/drivers/ata/pata_at32.c
25068--- linux-2.6.39/drivers/ata/pata_at32.c 2011-05-19 00:06:34.000000000 -0400
25069+++ linux-2.6.39/drivers/ata/pata_at32.c 2011-05-22 19:36:31.000000000 -0400
25070@@ -173,7 +173,7 @@ static struct scsi_host_template at32_sh
25071 ATA_PIO_SHT(DRV_NAME),
25072 };
25073
25074-static struct ata_port_operations at32_port_ops = {
25075+static const struct ata_port_operations at32_port_ops = {
25076 .inherits = &ata_sff_port_ops,
25077 .cable_detect = ata_cable_40wire,
25078 .set_piomode = pata_at32_set_piomode,
25079diff -urNp linux-2.6.39/drivers/ata/pata_at91.c linux-2.6.39/drivers/ata/pata_at91.c
25080--- linux-2.6.39/drivers/ata/pata_at91.c 2011-05-19 00:06:34.000000000 -0400
25081+++ linux-2.6.39/drivers/ata/pata_at91.c 2011-05-22 19:36:31.000000000 -0400
25082@@ -212,7 +212,7 @@ static struct scsi_host_template pata_at
25083 ATA_PIO_SHT(DRV_NAME),
25084 };
25085
25086-static struct ata_port_operations pata_at91_port_ops = {
25087+static const struct ata_port_operations pata_at91_port_ops = {
25088 .inherits = &ata_sff_port_ops,
25089
25090 .sff_data_xfer = pata_at91_data_xfer_noirq,
25091diff -urNp linux-2.6.39/drivers/ata/pata_atiixp.c linux-2.6.39/drivers/ata/pata_atiixp.c
25092--- linux-2.6.39/drivers/ata/pata_atiixp.c 2011-05-19 00:06:34.000000000 -0400
25093+++ linux-2.6.39/drivers/ata/pata_atiixp.c 2011-05-22 19:36:31.000000000 -0400
25094@@ -214,7 +214,7 @@ static struct scsi_host_template atiixp_
25095 .sg_tablesize = LIBATA_DUMB_MAX_PRD,
25096 };
25097
25098-static struct ata_port_operations atiixp_port_ops = {
25099+static const struct ata_port_operations atiixp_port_ops = {
25100 .inherits = &ata_bmdma_port_ops,
25101
25102 .qc_prep = ata_bmdma_dumb_qc_prep,
25103diff -urNp linux-2.6.39/drivers/ata/pata_atp867x.c linux-2.6.39/drivers/ata/pata_atp867x.c
25104--- linux-2.6.39/drivers/ata/pata_atp867x.c 2011-05-19 00:06:34.000000000 -0400
25105+++ linux-2.6.39/drivers/ata/pata_atp867x.c 2011-05-22 19:36:31.000000000 -0400
25106@@ -275,7 +275,7 @@ static struct scsi_host_template atp867x
25107 ATA_BMDMA_SHT(DRV_NAME),
25108 };
25109
25110-static struct ata_port_operations atp867x_ops = {
25111+static const struct ata_port_operations atp867x_ops = {
25112 .inherits = &ata_bmdma_port_ops,
25113 .cable_detect = atp867x_cable_detect,
25114 .set_piomode = atp867x_set_piomode,
25115diff -urNp linux-2.6.39/drivers/ata/pata_bf54x.c linux-2.6.39/drivers/ata/pata_bf54x.c
25116--- linux-2.6.39/drivers/ata/pata_bf54x.c 2011-05-19 00:06:34.000000000 -0400
25117+++ linux-2.6.39/drivers/ata/pata_bf54x.c 2011-05-22 19:36:31.000000000 -0400
25118@@ -1420,7 +1420,7 @@ static struct scsi_host_template bfin_sh
25119 .dma_boundary = ATA_DMA_BOUNDARY,
25120 };
25121
25122-static struct ata_port_operations bfin_pata_ops = {
25123+static const struct ata_port_operations bfin_pata_ops = {
25124 .inherits = &ata_bmdma_port_ops,
25125
25126 .set_piomode = bfin_set_piomode,
25127diff -urNp linux-2.6.39/drivers/ata/pata_cmd640.c linux-2.6.39/drivers/ata/pata_cmd640.c
25128--- linux-2.6.39/drivers/ata/pata_cmd640.c 2011-05-19 00:06:34.000000000 -0400
25129+++ linux-2.6.39/drivers/ata/pata_cmd640.c 2011-05-22 19:36:31.000000000 -0400
25130@@ -176,7 +176,7 @@ static struct scsi_host_template cmd640_
25131 ATA_PIO_SHT(DRV_NAME),
25132 };
25133
25134-static struct ata_port_operations cmd640_port_ops = {
25135+static const struct ata_port_operations cmd640_port_ops = {
25136 .inherits = &ata_sff_port_ops,
25137 /* In theory xfer_noirq is not needed once we kill the prefetcher */
25138 .sff_data_xfer = ata_sff_data_xfer_noirq,
25139diff -urNp linux-2.6.39/drivers/ata/pata_cmd64x.c linux-2.6.39/drivers/ata/pata_cmd64x.c
25140--- linux-2.6.39/drivers/ata/pata_cmd64x.c 2011-05-19 00:06:34.000000000 -0400
25141+++ linux-2.6.39/drivers/ata/pata_cmd64x.c 2011-05-22 19:36:31.000000000 -0400
25142@@ -268,18 +268,18 @@ static const struct ata_port_operations
25143 .set_dmamode = cmd64x_set_dmamode,
25144 };
25145
25146-static struct ata_port_operations cmd64x_port_ops = {
25147+static const struct ata_port_operations cmd64x_port_ops = {
25148 .inherits = &cmd64x_base_ops,
25149 .cable_detect = ata_cable_40wire,
25150 };
25151
25152-static struct ata_port_operations cmd646r1_port_ops = {
25153+static const struct ata_port_operations cmd646r1_port_ops = {
25154 .inherits = &cmd64x_base_ops,
25155 .bmdma_stop = cmd646r1_bmdma_stop,
25156 .cable_detect = ata_cable_40wire,
25157 };
25158
25159-static struct ata_port_operations cmd648_port_ops = {
25160+static const struct ata_port_operations cmd648_port_ops = {
25161 .inherits = &cmd64x_base_ops,
25162 .bmdma_stop = cmd648_bmdma_stop,
25163 .cable_detect = cmd648_cable_detect,
25164diff -urNp linux-2.6.39/drivers/ata/pata_cs5520.c linux-2.6.39/drivers/ata/pata_cs5520.c
25165--- linux-2.6.39/drivers/ata/pata_cs5520.c 2011-05-19 00:06:34.000000000 -0400
25166+++ linux-2.6.39/drivers/ata/pata_cs5520.c 2011-05-22 19:36:31.000000000 -0400
25167@@ -108,7 +108,7 @@ static struct scsi_host_template cs5520_
25168 .sg_tablesize = LIBATA_DUMB_MAX_PRD,
25169 };
25170
25171-static struct ata_port_operations cs5520_port_ops = {
25172+static const struct ata_port_operations cs5520_port_ops = {
25173 .inherits = &ata_bmdma_port_ops,
25174 .qc_prep = ata_bmdma_dumb_qc_prep,
25175 .cable_detect = ata_cable_40wire,
25176diff -urNp linux-2.6.39/drivers/ata/pata_cs5530.c linux-2.6.39/drivers/ata/pata_cs5530.c
25177--- linux-2.6.39/drivers/ata/pata_cs5530.c 2011-05-19 00:06:34.000000000 -0400
25178+++ linux-2.6.39/drivers/ata/pata_cs5530.c 2011-05-22 19:36:31.000000000 -0400
25179@@ -164,7 +164,7 @@ static struct scsi_host_template cs5530_
25180 .sg_tablesize = LIBATA_DUMB_MAX_PRD,
25181 };
25182
25183-static struct ata_port_operations cs5530_port_ops = {
25184+static const struct ata_port_operations cs5530_port_ops = {
25185 .inherits = &ata_bmdma_port_ops,
25186
25187 .qc_prep = ata_bmdma_dumb_qc_prep,
25188diff -urNp linux-2.6.39/drivers/ata/pata_cs5535.c linux-2.6.39/drivers/ata/pata_cs5535.c
25189--- linux-2.6.39/drivers/ata/pata_cs5535.c 2011-05-19 00:06:34.000000000 -0400
25190+++ linux-2.6.39/drivers/ata/pata_cs5535.c 2011-05-22 19:36:31.000000000 -0400
25191@@ -160,7 +160,7 @@ static struct scsi_host_template cs5535_
25192 ATA_BMDMA_SHT(DRV_NAME),
25193 };
25194
25195-static struct ata_port_operations cs5535_port_ops = {
25196+static const struct ata_port_operations cs5535_port_ops = {
25197 .inherits = &ata_bmdma_port_ops,
25198 .cable_detect = cs5535_cable_detect,
25199 .set_piomode = cs5535_set_piomode,
25200diff -urNp linux-2.6.39/drivers/ata/pata_cs5536.c linux-2.6.39/drivers/ata/pata_cs5536.c
25201--- linux-2.6.39/drivers/ata/pata_cs5536.c 2011-05-19 00:06:34.000000000 -0400
25202+++ linux-2.6.39/drivers/ata/pata_cs5536.c 2011-05-22 19:36:31.000000000 -0400
25203@@ -233,7 +233,7 @@ static struct scsi_host_template cs5536_
25204 ATA_BMDMA_SHT(DRV_NAME),
25205 };
25206
25207-static struct ata_port_operations cs5536_port_ops = {
25208+static const struct ata_port_operations cs5536_port_ops = {
25209 .inherits = &ata_bmdma32_port_ops,
25210 .cable_detect = cs5536_cable_detect,
25211 .set_piomode = cs5536_set_piomode,
25212diff -urNp linux-2.6.39/drivers/ata/pata_cypress.c linux-2.6.39/drivers/ata/pata_cypress.c
25213--- linux-2.6.39/drivers/ata/pata_cypress.c 2011-05-19 00:06:34.000000000 -0400
25214+++ linux-2.6.39/drivers/ata/pata_cypress.c 2011-05-22 19:36:31.000000000 -0400
25215@@ -115,7 +115,7 @@ static struct scsi_host_template cy82c69
25216 ATA_BMDMA_SHT(DRV_NAME),
25217 };
25218
25219-static struct ata_port_operations cy82c693_port_ops = {
25220+static const struct ata_port_operations cy82c693_port_ops = {
25221 .inherits = &ata_bmdma_port_ops,
25222 .cable_detect = ata_cable_40wire,
25223 .set_piomode = cy82c693_set_piomode,
25224diff -urNp linux-2.6.39/drivers/ata/pata_efar.c linux-2.6.39/drivers/ata/pata_efar.c
25225--- linux-2.6.39/drivers/ata/pata_efar.c 2011-05-19 00:06:34.000000000 -0400
25226+++ linux-2.6.39/drivers/ata/pata_efar.c 2011-05-22 19:36:31.000000000 -0400
25227@@ -238,7 +238,7 @@ static struct scsi_host_template efar_sh
25228 ATA_BMDMA_SHT(DRV_NAME),
25229 };
25230
25231-static struct ata_port_operations efar_ops = {
25232+static const struct ata_port_operations efar_ops = {
25233 .inherits = &ata_bmdma_port_ops,
25234 .cable_detect = efar_cable_detect,
25235 .set_piomode = efar_set_piomode,
25236diff -urNp linux-2.6.39/drivers/ata/pata_hpt366.c linux-2.6.39/drivers/ata/pata_hpt366.c
25237--- linux-2.6.39/drivers/ata/pata_hpt366.c 2011-05-19 00:06:34.000000000 -0400
25238+++ linux-2.6.39/drivers/ata/pata_hpt366.c 2011-05-22 19:36:31.000000000 -0400
25239@@ -276,7 +276,7 @@ static struct scsi_host_template hpt36x_
25240 * Configuration for HPT366/68
25241 */
25242
25243-static struct ata_port_operations hpt366_port_ops = {
25244+static const struct ata_port_operations hpt366_port_ops = {
25245 .inherits = &ata_bmdma_port_ops,
25246 .cable_detect = hpt36x_cable_detect,
25247 .mode_filter = hpt366_filter,
25248diff -urNp linux-2.6.39/drivers/ata/pata_hpt37x.c linux-2.6.39/drivers/ata/pata_hpt37x.c
25249--- linux-2.6.39/drivers/ata/pata_hpt37x.c 2011-05-19 00:06:34.000000000 -0400
25250+++ linux-2.6.39/drivers/ata/pata_hpt37x.c 2011-05-22 19:36:31.000000000 -0400
25251@@ -589,7 +589,7 @@ static struct scsi_host_template hpt37x_
25252 * Configuration for HPT370
25253 */
25254
25255-static struct ata_port_operations hpt370_port_ops = {
25256+static const struct ata_port_operations hpt370_port_ops = {
25257 .inherits = &ata_bmdma_port_ops,
25258
25259 .bmdma_stop = hpt370_bmdma_stop,
25260@@ -605,7 +605,7 @@ static struct ata_port_operations hpt370
25261 * Configuration for HPT370A. Close to 370 but less filters
25262 */
25263
25264-static struct ata_port_operations hpt370a_port_ops = {
25265+static const struct ata_port_operations hpt370a_port_ops = {
25266 .inherits = &hpt370_port_ops,
25267 .mode_filter = hpt370a_filter,
25268 };
25269@@ -615,7 +615,7 @@ static struct ata_port_operations hpt370
25270 * mode setting functionality.
25271 */
25272
25273-static struct ata_port_operations hpt302_port_ops = {
25274+static const struct ata_port_operations hpt302_port_ops = {
25275 .inherits = &ata_bmdma_port_ops,
25276
25277 .bmdma_stop = hpt37x_bmdma_stop,
25278@@ -631,7 +631,7 @@ static struct ata_port_operations hpt302
25279 * but we have a mode filter.
25280 */
25281
25282-static struct ata_port_operations hpt372_port_ops = {
25283+static const struct ata_port_operations hpt372_port_ops = {
25284 .inherits = &hpt302_port_ops,
25285 .mode_filter = hpt372_filter,
25286 };
25287@@ -641,7 +641,7 @@ static struct ata_port_operations hpt372
25288 * but we have a different cable detection procedure for function 1.
25289 */
25290
25291-static struct ata_port_operations hpt374_fn1_port_ops = {
25292+static const struct ata_port_operations hpt374_fn1_port_ops = {
25293 .inherits = &hpt372_port_ops,
25294 .cable_detect = hpt374_fn1_cable_detect,
25295 };
25296diff -urNp linux-2.6.39/drivers/ata/pata_hpt3x2n.c linux-2.6.39/drivers/ata/pata_hpt3x2n.c
25297--- linux-2.6.39/drivers/ata/pata_hpt3x2n.c 2011-05-19 00:06:34.000000000 -0400
25298+++ linux-2.6.39/drivers/ata/pata_hpt3x2n.c 2011-05-22 19:36:31.000000000 -0400
25299@@ -350,7 +350,7 @@ static struct scsi_host_template hpt3x2n
25300 * Configuration for HPT302N/371N.
25301 */
25302
25303-static struct ata_port_operations hpt3xxn_port_ops = {
25304+static const struct ata_port_operations hpt3xxn_port_ops = {
25305 .inherits = &ata_bmdma_port_ops,
25306
25307 .bmdma_stop = hpt3x2n_bmdma_stop,
25308@@ -368,7 +368,7 @@ static struct ata_port_operations hpt3xx
25309 * Configuration for HPT372N. Same as 302N/371N but we have a mode filter.
25310 */
25311
25312-static struct ata_port_operations hpt372n_port_ops = {
25313+static const struct ata_port_operations hpt372n_port_ops = {
25314 .inherits = &hpt3xxn_port_ops,
25315 .mode_filter = &hpt372n_filter,
25316 };
25317diff -urNp linux-2.6.39/drivers/ata/pata_hpt3x3.c linux-2.6.39/drivers/ata/pata_hpt3x3.c
25318--- linux-2.6.39/drivers/ata/pata_hpt3x3.c 2011-05-19 00:06:34.000000000 -0400
25319+++ linux-2.6.39/drivers/ata/pata_hpt3x3.c 2011-05-22 19:36:31.000000000 -0400
25320@@ -141,7 +141,7 @@ static struct scsi_host_template hpt3x3_
25321 ATA_BMDMA_SHT(DRV_NAME),
25322 };
25323
25324-static struct ata_port_operations hpt3x3_port_ops = {
25325+static const struct ata_port_operations hpt3x3_port_ops = {
25326 .inherits = &ata_bmdma_port_ops,
25327 .cable_detect = ata_cable_40wire,
25328 .set_piomode = hpt3x3_set_piomode,
25329diff -urNp linux-2.6.39/drivers/ata/pata_icside.c linux-2.6.39/drivers/ata/pata_icside.c
25330--- linux-2.6.39/drivers/ata/pata_icside.c 2011-05-19 00:06:34.000000000 -0400
25331+++ linux-2.6.39/drivers/ata/pata_icside.c 2011-05-22 19:36:31.000000000 -0400
25332@@ -320,7 +320,7 @@ static void pata_icside_postreset(struct
25333 }
25334 }
25335
25336-static struct ata_port_operations pata_icside_port_ops = {
25337+static const struct ata_port_operations pata_icside_port_ops = {
25338 .inherits = &ata_bmdma_port_ops,
25339 /* no need to build any PRD tables for DMA */
25340 .qc_prep = ata_noop_qc_prep,
25341diff -urNp linux-2.6.39/drivers/ata/pata_isapnp.c linux-2.6.39/drivers/ata/pata_isapnp.c
25342--- linux-2.6.39/drivers/ata/pata_isapnp.c 2011-05-19 00:06:34.000000000 -0400
25343+++ linux-2.6.39/drivers/ata/pata_isapnp.c 2011-05-22 19:36:31.000000000 -0400
25344@@ -23,12 +23,12 @@ static struct scsi_host_template isapnp_
25345 ATA_PIO_SHT(DRV_NAME),
25346 };
25347
25348-static struct ata_port_operations isapnp_port_ops = {
25349+static const struct ata_port_operations isapnp_port_ops = {
25350 .inherits = &ata_sff_port_ops,
25351 .cable_detect = ata_cable_40wire,
25352 };
25353
25354-static struct ata_port_operations isapnp_noalt_port_ops = {
25355+static const struct ata_port_operations isapnp_noalt_port_ops = {
25356 .inherits = &ata_sff_port_ops,
25357 .cable_detect = ata_cable_40wire,
25358 /* No altstatus so we don't want to use the lost interrupt poll */
25359diff -urNp linux-2.6.39/drivers/ata/pata_it8213.c linux-2.6.39/drivers/ata/pata_it8213.c
25360--- linux-2.6.39/drivers/ata/pata_it8213.c 2011-05-19 00:06:34.000000000 -0400
25361+++ linux-2.6.39/drivers/ata/pata_it8213.c 2011-05-22 19:36:31.000000000 -0400
25362@@ -233,7 +233,7 @@ static struct scsi_host_template it8213_
25363 };
25364
25365
25366-static struct ata_port_operations it8213_ops = {
25367+static const struct ata_port_operations it8213_ops = {
25368 .inherits = &ata_bmdma_port_ops,
25369 .cable_detect = it8213_cable_detect,
25370 .set_piomode = it8213_set_piomode,
25371diff -urNp linux-2.6.39/drivers/ata/pata_it821x.c linux-2.6.39/drivers/ata/pata_it821x.c
25372--- linux-2.6.39/drivers/ata/pata_it821x.c 2011-05-19 00:06:34.000000000 -0400
25373+++ linux-2.6.39/drivers/ata/pata_it821x.c 2011-05-22 19:36:31.000000000 -0400
25374@@ -801,7 +801,7 @@ static struct scsi_host_template it821x_
25375 ATA_BMDMA_SHT(DRV_NAME),
25376 };
25377
25378-static struct ata_port_operations it821x_smart_port_ops = {
25379+static const struct ata_port_operations it821x_smart_port_ops = {
25380 .inherits = &ata_bmdma_port_ops,
25381
25382 .check_atapi_dma= it821x_check_atapi_dma,
25383@@ -815,7 +815,7 @@ static struct ata_port_operations it821x
25384 .port_start = it821x_port_start,
25385 };
25386
25387-static struct ata_port_operations it821x_passthru_port_ops = {
25388+static const struct ata_port_operations it821x_passthru_port_ops = {
25389 .inherits = &ata_bmdma_port_ops,
25390
25391 .check_atapi_dma= it821x_check_atapi_dma,
25392@@ -831,7 +831,7 @@ static struct ata_port_operations it821x
25393 .port_start = it821x_port_start,
25394 };
25395
25396-static struct ata_port_operations it821x_rdc_port_ops = {
25397+static const struct ata_port_operations it821x_rdc_port_ops = {
25398 .inherits = &ata_bmdma_port_ops,
25399
25400 .check_atapi_dma= it821x_check_atapi_dma,
25401diff -urNp linux-2.6.39/drivers/ata/pata_ixp4xx_cf.c linux-2.6.39/drivers/ata/pata_ixp4xx_cf.c
25402--- linux-2.6.39/drivers/ata/pata_ixp4xx_cf.c 2011-05-19 00:06:34.000000000 -0400
25403+++ linux-2.6.39/drivers/ata/pata_ixp4xx_cf.c 2011-05-22 19:36:31.000000000 -0400
25404@@ -89,7 +89,7 @@ static struct scsi_host_template ixp4xx_
25405 ATA_PIO_SHT(DRV_NAME),
25406 };
25407
25408-static struct ata_port_operations ixp4xx_port_ops = {
25409+static const struct ata_port_operations ixp4xx_port_ops = {
25410 .inherits = &ata_sff_port_ops,
25411 .sff_data_xfer = ixp4xx_mmio_data_xfer,
25412 .cable_detect = ata_cable_40wire,
25413diff -urNp linux-2.6.39/drivers/ata/pata_jmicron.c linux-2.6.39/drivers/ata/pata_jmicron.c
25414--- linux-2.6.39/drivers/ata/pata_jmicron.c 2011-05-19 00:06:34.000000000 -0400
25415+++ linux-2.6.39/drivers/ata/pata_jmicron.c 2011-05-22 19:36:31.000000000 -0400
25416@@ -111,7 +111,7 @@ static struct scsi_host_template jmicron
25417 ATA_BMDMA_SHT(DRV_NAME),
25418 };
25419
25420-static struct ata_port_operations jmicron_ops = {
25421+static const struct ata_port_operations jmicron_ops = {
25422 .inherits = &ata_bmdma_port_ops,
25423 .prereset = jmicron_pre_reset,
25424 };
25425diff -urNp linux-2.6.39/drivers/ata/pata_legacy.c linux-2.6.39/drivers/ata/pata_legacy.c
25426--- linux-2.6.39/drivers/ata/pata_legacy.c 2011-05-19 00:06:34.000000000 -0400
25427+++ linux-2.6.39/drivers/ata/pata_legacy.c 2011-05-22 19:36:31.000000000 -0400
25428@@ -116,7 +116,7 @@ struct legacy_probe {
25429
25430 struct legacy_controller {
25431 const char *name;
25432- struct ata_port_operations *ops;
25433+ const struct ata_port_operations *ops;
25434 unsigned int pio_mask;
25435 unsigned int flags;
25436 unsigned int pflags;
25437@@ -239,12 +239,12 @@ static const struct ata_port_operations
25438 * pio_mask as well.
25439 */
25440
25441-static struct ata_port_operations simple_port_ops = {
25442+static const struct ata_port_operations simple_port_ops = {
25443 .inherits = &legacy_base_port_ops,
25444 .sff_data_xfer = ata_sff_data_xfer_noirq,
25445 };
25446
25447-static struct ata_port_operations legacy_port_ops = {
25448+static const struct ata_port_operations legacy_port_ops = {
25449 .inherits = &legacy_base_port_ops,
25450 .sff_data_xfer = ata_sff_data_xfer_noirq,
25451 .set_mode = legacy_set_mode,
25452@@ -340,7 +340,7 @@ static unsigned int pdc_data_xfer_vlb(st
25453 return buflen;
25454 }
25455
25456-static struct ata_port_operations pdc20230_port_ops = {
25457+static const struct ata_port_operations pdc20230_port_ops = {
25458 .inherits = &legacy_base_port_ops,
25459 .set_piomode = pdc20230_set_piomode,
25460 .sff_data_xfer = pdc_data_xfer_vlb,
25461@@ -373,7 +373,7 @@ static void ht6560a_set_piomode(struct a
25462 ioread8(ap->ioaddr.status_addr);
25463 }
25464
25465-static struct ata_port_operations ht6560a_port_ops = {
25466+static const struct ata_port_operations ht6560a_port_ops = {
25467 .inherits = &legacy_base_port_ops,
25468 .set_piomode = ht6560a_set_piomode,
25469 };
25470@@ -416,7 +416,7 @@ static void ht6560b_set_piomode(struct a
25471 ioread8(ap->ioaddr.status_addr);
25472 }
25473
25474-static struct ata_port_operations ht6560b_port_ops = {
25475+static const struct ata_port_operations ht6560b_port_ops = {
25476 .inherits = &legacy_base_port_ops,
25477 .set_piomode = ht6560b_set_piomode,
25478 };
25479@@ -515,7 +515,7 @@ static void opti82c611a_set_piomode(stru
25480 }
25481
25482
25483-static struct ata_port_operations opti82c611a_port_ops = {
25484+static const struct ata_port_operations opti82c611a_port_ops = {
25485 .inherits = &legacy_base_port_ops,
25486 .set_piomode = opti82c611a_set_piomode,
25487 };
25488@@ -625,7 +625,7 @@ static unsigned int opti82c46x_qc_issue(
25489 return ata_sff_qc_issue(qc);
25490 }
25491
25492-static struct ata_port_operations opti82c46x_port_ops = {
25493+static const struct ata_port_operations opti82c46x_port_ops = {
25494 .inherits = &legacy_base_port_ops,
25495 .set_piomode = opti82c46x_set_piomode,
25496 .qc_issue = opti82c46x_qc_issue,
25497@@ -787,20 +787,20 @@ static int qdi_port(struct platform_devi
25498 return 0;
25499 }
25500
25501-static struct ata_port_operations qdi6500_port_ops = {
25502+static const struct ata_port_operations qdi6500_port_ops = {
25503 .inherits = &legacy_base_port_ops,
25504 .set_piomode = qdi6500_set_piomode,
25505 .qc_issue = qdi_qc_issue,
25506 .sff_data_xfer = vlb32_data_xfer,
25507 };
25508
25509-static struct ata_port_operations qdi6580_port_ops = {
25510+static const struct ata_port_operations qdi6580_port_ops = {
25511 .inherits = &legacy_base_port_ops,
25512 .set_piomode = qdi6580_set_piomode,
25513 .sff_data_xfer = vlb32_data_xfer,
25514 };
25515
25516-static struct ata_port_operations qdi6580dp_port_ops = {
25517+static const struct ata_port_operations qdi6580dp_port_ops = {
25518 .inherits = &legacy_base_port_ops,
25519 .set_piomode = qdi6580dp_set_piomode,
25520 .qc_issue = qdi_qc_issue,
25521@@ -872,7 +872,7 @@ static int winbond_port(struct platform_
25522 return 0;
25523 }
25524
25525-static struct ata_port_operations winbond_port_ops = {
25526+static const struct ata_port_operations winbond_port_ops = {
25527 .inherits = &legacy_base_port_ops,
25528 .set_piomode = winbond_set_piomode,
25529 .sff_data_xfer = vlb32_data_xfer,
25530@@ -995,7 +995,7 @@ static __init int legacy_init_one(struct
25531 int pio_modes = controller->pio_mask;
25532 unsigned long io = probe->port;
25533 u32 mask = (1 << probe->slot);
25534- struct ata_port_operations *ops = controller->ops;
25535+ const struct ata_port_operations *ops = controller->ops;
25536 struct legacy_data *ld = &legacy_data[probe->slot];
25537 struct ata_host *host = NULL;
25538 struct ata_port *ap;
25539diff -urNp linux-2.6.39/drivers/ata/pata_macio.c linux-2.6.39/drivers/ata/pata_macio.c
25540--- linux-2.6.39/drivers/ata/pata_macio.c 2011-05-19 00:06:34.000000000 -0400
25541+++ linux-2.6.39/drivers/ata/pata_macio.c 2011-05-22 19:36:31.000000000 -0400
25542@@ -918,9 +918,8 @@ static struct scsi_host_template pata_ma
25543 .slave_configure = pata_macio_slave_config,
25544 };
25545
25546-static struct ata_port_operations pata_macio_ops = {
25547+static const struct ata_port_operations pata_macio_ops = {
25548 .inherits = &ata_bmdma_port_ops,
25549-
25550 .freeze = pata_macio_freeze,
25551 .set_piomode = pata_macio_set_timings,
25552 .set_dmamode = pata_macio_set_timings,
25553diff -urNp linux-2.6.39/drivers/ata/pata_marvell.c linux-2.6.39/drivers/ata/pata_marvell.c
25554--- linux-2.6.39/drivers/ata/pata_marvell.c 2011-05-19 00:06:34.000000000 -0400
25555+++ linux-2.6.39/drivers/ata/pata_marvell.c 2011-05-22 19:36:31.000000000 -0400
25556@@ -100,7 +100,7 @@ static struct scsi_host_template marvell
25557 ATA_BMDMA_SHT(DRV_NAME),
25558 };
25559
25560-static struct ata_port_operations marvell_ops = {
25561+static const struct ata_port_operations marvell_ops = {
25562 .inherits = &ata_bmdma_port_ops,
25563 .cable_detect = marvell_cable_detect,
25564 .prereset = marvell_pre_reset,
25565diff -urNp linux-2.6.39/drivers/ata/pata_mpc52xx.c linux-2.6.39/drivers/ata/pata_mpc52xx.c
25566--- linux-2.6.39/drivers/ata/pata_mpc52xx.c 2011-05-19 00:06:34.000000000 -0400
25567+++ linux-2.6.39/drivers/ata/pata_mpc52xx.c 2011-05-22 19:36:31.000000000 -0400
25568@@ -609,7 +609,7 @@ static struct scsi_host_template mpc52xx
25569 ATA_PIO_SHT(DRV_NAME),
25570 };
25571
25572-static struct ata_port_operations mpc52xx_ata_port_ops = {
25573+static const struct ata_port_operations mpc52xx_ata_port_ops = {
25574 .inherits = &ata_bmdma_port_ops,
25575 .sff_dev_select = mpc52xx_ata_dev_select,
25576 .set_piomode = mpc52xx_ata_set_piomode,
25577diff -urNp linux-2.6.39/drivers/ata/pata_mpiix.c linux-2.6.39/drivers/ata/pata_mpiix.c
25578--- linux-2.6.39/drivers/ata/pata_mpiix.c 2011-05-19 00:06:34.000000000 -0400
25579+++ linux-2.6.39/drivers/ata/pata_mpiix.c 2011-05-22 19:36:31.000000000 -0400
25580@@ -140,7 +140,7 @@ static struct scsi_host_template mpiix_s
25581 ATA_PIO_SHT(DRV_NAME),
25582 };
25583
25584-static struct ata_port_operations mpiix_port_ops = {
25585+static const struct ata_port_operations mpiix_port_ops = {
25586 .inherits = &ata_sff_port_ops,
25587 .qc_issue = mpiix_qc_issue,
25588 .cable_detect = ata_cable_40wire,
25589diff -urNp linux-2.6.39/drivers/ata/pata_netcell.c linux-2.6.39/drivers/ata/pata_netcell.c
25590--- linux-2.6.39/drivers/ata/pata_netcell.c 2011-05-19 00:06:34.000000000 -0400
25591+++ linux-2.6.39/drivers/ata/pata_netcell.c 2011-05-22 19:36:31.000000000 -0400
25592@@ -34,7 +34,7 @@ static struct scsi_host_template netcell
25593 ATA_BMDMA_SHT(DRV_NAME),
25594 };
25595
25596-static struct ata_port_operations netcell_ops = {
25597+static const struct ata_port_operations netcell_ops = {
25598 .inherits = &ata_bmdma_port_ops,
25599 .cable_detect = ata_cable_80wire,
25600 .read_id = netcell_read_id,
25601diff -urNp linux-2.6.39/drivers/ata/pata_ninja32.c linux-2.6.39/drivers/ata/pata_ninja32.c
25602--- linux-2.6.39/drivers/ata/pata_ninja32.c 2011-05-19 00:06:34.000000000 -0400
25603+++ linux-2.6.39/drivers/ata/pata_ninja32.c 2011-05-22 19:36:31.000000000 -0400
25604@@ -81,7 +81,7 @@ static struct scsi_host_template ninja32
25605 ATA_BMDMA_SHT(DRV_NAME),
25606 };
25607
25608-static struct ata_port_operations ninja32_port_ops = {
25609+static const struct ata_port_operations ninja32_port_ops = {
25610 .inherits = &ata_bmdma_port_ops,
25611 .sff_dev_select = ninja32_dev_select,
25612 .cable_detect = ata_cable_40wire,
25613diff -urNp linux-2.6.39/drivers/ata/pata_ns87410.c linux-2.6.39/drivers/ata/pata_ns87410.c
25614--- linux-2.6.39/drivers/ata/pata_ns87410.c 2011-05-19 00:06:34.000000000 -0400
25615+++ linux-2.6.39/drivers/ata/pata_ns87410.c 2011-05-22 19:36:31.000000000 -0400
25616@@ -132,7 +132,7 @@ static struct scsi_host_template ns87410
25617 ATA_PIO_SHT(DRV_NAME),
25618 };
25619
25620-static struct ata_port_operations ns87410_port_ops = {
25621+static const struct ata_port_operations ns87410_port_ops = {
25622 .inherits = &ata_sff_port_ops,
25623 .qc_issue = ns87410_qc_issue,
25624 .cable_detect = ata_cable_40wire,
25625diff -urNp linux-2.6.39/drivers/ata/pata_ns87415.c linux-2.6.39/drivers/ata/pata_ns87415.c
25626--- linux-2.6.39/drivers/ata/pata_ns87415.c 2011-05-19 00:06:34.000000000 -0400
25627+++ linux-2.6.39/drivers/ata/pata_ns87415.c 2011-05-22 19:36:31.000000000 -0400
25628@@ -299,7 +299,7 @@ static u8 ns87560_bmdma_status(struct at
25629 }
25630 #endif /* 87560 SuperIO Support */
25631
25632-static struct ata_port_operations ns87415_pata_ops = {
25633+static const struct ata_port_operations ns87415_pata_ops = {
25634 .inherits = &ata_bmdma_port_ops,
25635
25636 .check_atapi_dma = ns87415_check_atapi_dma,
25637@@ -313,7 +313,7 @@ static struct ata_port_operations ns8741
25638 };
25639
25640 #if defined(CONFIG_SUPERIO)
25641-static struct ata_port_operations ns87560_pata_ops = {
25642+static const struct ata_port_operations ns87560_pata_ops = {
25643 .inherits = &ns87415_pata_ops,
25644 .sff_tf_read = ns87560_tf_read,
25645 .sff_check_status = ns87560_check_status,
25646diff -urNp linux-2.6.39/drivers/ata/pata_octeon_cf.c linux-2.6.39/drivers/ata/pata_octeon_cf.c
25647--- linux-2.6.39/drivers/ata/pata_octeon_cf.c 2011-05-19 00:06:34.000000000 -0400
25648+++ linux-2.6.39/drivers/ata/pata_octeon_cf.c 2011-05-22 19:36:31.000000000 -0400
25649@@ -780,7 +780,7 @@ static unsigned int octeon_cf_qc_issue(s
25650 return 0;
25651 }
25652
25653-static struct ata_port_operations octeon_cf_ops = {
25654+static struct ata_port_operations octeon_cf_ops = { /* cannot be const */
25655 .inherits = &ata_sff_port_ops,
25656 .check_atapi_dma = octeon_cf_check_atapi_dma,
25657 .qc_prep = ata_noop_qc_prep,
25658diff -urNp linux-2.6.39/drivers/ata/pata_oldpiix.c linux-2.6.39/drivers/ata/pata_oldpiix.c
25659--- linux-2.6.39/drivers/ata/pata_oldpiix.c 2011-05-19 00:06:34.000000000 -0400
25660+++ linux-2.6.39/drivers/ata/pata_oldpiix.c 2011-05-22 19:36:31.000000000 -0400
25661@@ -208,7 +208,7 @@ static struct scsi_host_template oldpiix
25662 ATA_BMDMA_SHT(DRV_NAME),
25663 };
25664
25665-static struct ata_port_operations oldpiix_pata_ops = {
25666+static const struct ata_port_operations oldpiix_pata_ops = {
25667 .inherits = &ata_bmdma_port_ops,
25668 .qc_issue = oldpiix_qc_issue,
25669 .cable_detect = ata_cable_40wire,
25670diff -urNp linux-2.6.39/drivers/ata/pata_opti.c linux-2.6.39/drivers/ata/pata_opti.c
25671--- linux-2.6.39/drivers/ata/pata_opti.c 2011-05-19 00:06:34.000000000 -0400
25672+++ linux-2.6.39/drivers/ata/pata_opti.c 2011-05-22 19:36:31.000000000 -0400
25673@@ -152,7 +152,7 @@ static struct scsi_host_template opti_sh
25674 ATA_PIO_SHT(DRV_NAME),
25675 };
25676
25677-static struct ata_port_operations opti_port_ops = {
25678+static const struct ata_port_operations opti_port_ops = {
25679 .inherits = &ata_sff_port_ops,
25680 .cable_detect = ata_cable_40wire,
25681 .set_piomode = opti_set_piomode,
25682diff -urNp linux-2.6.39/drivers/ata/pata_optidma.c linux-2.6.39/drivers/ata/pata_optidma.c
25683--- linux-2.6.39/drivers/ata/pata_optidma.c 2011-05-19 00:06:34.000000000 -0400
25684+++ linux-2.6.39/drivers/ata/pata_optidma.c 2011-05-22 19:36:31.000000000 -0400
25685@@ -337,7 +337,7 @@ static struct scsi_host_template optidma
25686 ATA_BMDMA_SHT(DRV_NAME),
25687 };
25688
25689-static struct ata_port_operations optidma_port_ops = {
25690+static const struct ata_port_operations optidma_port_ops = {
25691 .inherits = &ata_bmdma_port_ops,
25692 .cable_detect = ata_cable_40wire,
25693 .set_piomode = optidma_set_pio_mode,
25694@@ -346,7 +346,7 @@ static struct ata_port_operations optidm
25695 .prereset = optidma_pre_reset,
25696 };
25697
25698-static struct ata_port_operations optiplus_port_ops = {
25699+static const struct ata_port_operations optiplus_port_ops = {
25700 .inherits = &optidma_port_ops,
25701 .set_piomode = optiplus_set_pio_mode,
25702 .set_dmamode = optiplus_set_dma_mode,
25703diff -urNp linux-2.6.39/drivers/ata/pata_palmld.c linux-2.6.39/drivers/ata/pata_palmld.c
25704--- linux-2.6.39/drivers/ata/pata_palmld.c 2011-05-19 00:06:34.000000000 -0400
25705+++ linux-2.6.39/drivers/ata/pata_palmld.c 2011-05-22 19:36:31.000000000 -0400
25706@@ -42,7 +42,7 @@ static struct scsi_host_template palmld_
25707 ATA_PIO_SHT(DRV_NAME),
25708 };
25709
25710-static struct ata_port_operations palmld_port_ops = {
25711+static const struct ata_port_operations palmld_port_ops = {
25712 .inherits = &ata_sff_port_ops,
25713 .sff_data_xfer = ata_sff_data_xfer_noirq,
25714 .cable_detect = ata_cable_40wire,
25715diff -urNp linux-2.6.39/drivers/ata/pata_pcmcia.c linux-2.6.39/drivers/ata/pata_pcmcia.c
25716--- linux-2.6.39/drivers/ata/pata_pcmcia.c 2011-05-19 00:06:34.000000000 -0400
25717+++ linux-2.6.39/drivers/ata/pata_pcmcia.c 2011-05-22 19:36:31.000000000 -0400
25718@@ -151,14 +151,14 @@ static struct scsi_host_template pcmcia_
25719 ATA_PIO_SHT(DRV_NAME),
25720 };
25721
25722-static struct ata_port_operations pcmcia_port_ops = {
25723+static const struct ata_port_operations pcmcia_port_ops = {
25724 .inherits = &ata_sff_port_ops,
25725 .sff_data_xfer = ata_sff_data_xfer_noirq,
25726 .cable_detect = ata_cable_40wire,
25727 .set_mode = pcmcia_set_mode,
25728 };
25729
25730-static struct ata_port_operations pcmcia_8bit_port_ops = {
25731+static const struct ata_port_operations pcmcia_8bit_port_ops = {
25732 .inherits = &ata_sff_port_ops,
25733 .sff_data_xfer = ata_data_xfer_8bit,
25734 .cable_detect = ata_cable_40wire,
25735@@ -205,7 +205,7 @@ static int pcmcia_init_one(struct pcmcia
25736 unsigned long io_base, ctl_base;
25737 void __iomem *io_addr, *ctl_addr;
25738 int n_ports = 1;
25739- struct ata_port_operations *ops = &pcmcia_port_ops;
25740+ const struct ata_port_operations *ops = &pcmcia_port_ops;
25741
25742 /* Set up attributes in order to probe card and get resources */
25743 pdev->config_flags |= CONF_ENABLE_IRQ | CONF_AUTO_SET_IO |
25744diff -urNp linux-2.6.39/drivers/ata/pata_pdc2027x.c linux-2.6.39/drivers/ata/pata_pdc2027x.c
25745--- linux-2.6.39/drivers/ata/pata_pdc2027x.c 2011-05-19 00:06:34.000000000 -0400
25746+++ linux-2.6.39/drivers/ata/pata_pdc2027x.c 2011-05-22 19:36:31.000000000 -0400
25747@@ -132,14 +132,14 @@ static struct scsi_host_template pdc2027
25748 ATA_BMDMA_SHT(DRV_NAME),
25749 };
25750
25751-static struct ata_port_operations pdc2027x_pata100_ops = {
25752+static const struct ata_port_operations pdc2027x_pata100_ops = {
25753 .inherits = &ata_bmdma_port_ops,
25754 .check_atapi_dma = pdc2027x_check_atapi_dma,
25755 .cable_detect = pdc2027x_cable_detect,
25756 .prereset = pdc2027x_prereset,
25757 };
25758
25759-static struct ata_port_operations pdc2027x_pata133_ops = {
25760+static const struct ata_port_operations pdc2027x_pata133_ops = {
25761 .inherits = &pdc2027x_pata100_ops,
25762 .mode_filter = pdc2027x_mode_filter,
25763 .set_piomode = pdc2027x_set_piomode,
25764diff -urNp linux-2.6.39/drivers/ata/pata_pdc202xx_old.c linux-2.6.39/drivers/ata/pata_pdc202xx_old.c
25765--- linux-2.6.39/drivers/ata/pata_pdc202xx_old.c 2011-05-19 00:06:34.000000000 -0400
25766+++ linux-2.6.39/drivers/ata/pata_pdc202xx_old.c 2011-05-22 19:36:31.000000000 -0400
25767@@ -295,7 +295,7 @@ static struct scsi_host_template pdc202x
25768 ATA_BMDMA_SHT(DRV_NAME),
25769 };
25770
25771-static struct ata_port_operations pdc2024x_port_ops = {
25772+static const struct ata_port_operations pdc2024x_port_ops = {
25773 .inherits = &ata_bmdma_port_ops,
25774
25775 .cable_detect = ata_cable_40wire,
25776@@ -306,7 +306,7 @@ static struct ata_port_operations pdc202
25777 .sff_irq_check = pdc202xx_irq_check,
25778 };
25779
25780-static struct ata_port_operations pdc2026x_port_ops = {
25781+static const struct ata_port_operations pdc2026x_port_ops = {
25782 .inherits = &pdc2024x_port_ops,
25783
25784 .check_atapi_dma = pdc2026x_check_atapi_dma,
25785diff -urNp linux-2.6.39/drivers/ata/pata_piccolo.c linux-2.6.39/drivers/ata/pata_piccolo.c
25786--- linux-2.6.39/drivers/ata/pata_piccolo.c 2011-05-19 00:06:34.000000000 -0400
25787+++ linux-2.6.39/drivers/ata/pata_piccolo.c 2011-05-22 19:36:31.000000000 -0400
25788@@ -67,7 +67,7 @@ static struct scsi_host_template tosh_sh
25789 ATA_BMDMA_SHT(DRV_NAME),
25790 };
25791
25792-static struct ata_port_operations tosh_port_ops = {
25793+static const struct ata_port_operations tosh_port_ops = {
25794 .inherits = &ata_bmdma_port_ops,
25795 .cable_detect = ata_cable_unknown,
25796 .set_piomode = tosh_set_piomode,
25797diff -urNp linux-2.6.39/drivers/ata/pata_platform.c linux-2.6.39/drivers/ata/pata_platform.c
25798--- linux-2.6.39/drivers/ata/pata_platform.c 2011-05-19 00:06:34.000000000 -0400
25799+++ linux-2.6.39/drivers/ata/pata_platform.c 2011-05-22 19:36:31.000000000 -0400
25800@@ -48,7 +48,7 @@ static struct scsi_host_template pata_pl
25801 ATA_PIO_SHT(DRV_NAME),
25802 };
25803
25804-static struct ata_port_operations pata_platform_port_ops = {
25805+static const struct ata_port_operations pata_platform_port_ops = {
25806 .inherits = &ata_sff_port_ops,
25807 .sff_data_xfer = ata_sff_data_xfer_noirq,
25808 .cable_detect = ata_cable_unknown,
25809diff -urNp linux-2.6.39/drivers/ata/pata_pxa.c linux-2.6.39/drivers/ata/pata_pxa.c
25810--- linux-2.6.39/drivers/ata/pata_pxa.c 2011-05-19 00:06:34.000000000 -0400
25811+++ linux-2.6.39/drivers/ata/pata_pxa.c 2011-05-22 19:36:31.000000000 -0400
25812@@ -198,7 +198,7 @@ static struct scsi_host_template pxa_ata
25813 ATA_BMDMA_SHT(DRV_NAME),
25814 };
25815
25816-static struct ata_port_operations pxa_ata_port_ops = {
25817+static const struct ata_port_operations pxa_ata_port_ops = {
25818 .inherits = &ata_bmdma_port_ops,
25819 .cable_detect = ata_cable_40wire,
25820
25821diff -urNp linux-2.6.39/drivers/ata/pata_qdi.c linux-2.6.39/drivers/ata/pata_qdi.c
25822--- linux-2.6.39/drivers/ata/pata_qdi.c 2011-05-19 00:06:34.000000000 -0400
25823+++ linux-2.6.39/drivers/ata/pata_qdi.c 2011-05-22 19:36:31.000000000 -0400
25824@@ -157,7 +157,7 @@ static struct scsi_host_template qdi_sht
25825 ATA_PIO_SHT(DRV_NAME),
25826 };
25827
25828-static struct ata_port_operations qdi6500_port_ops = {
25829+static const struct ata_port_operations qdi6500_port_ops = {
25830 .inherits = &ata_sff_port_ops,
25831 .qc_issue = qdi_qc_issue,
25832 .sff_data_xfer = qdi_data_xfer,
25833@@ -165,7 +165,7 @@ static struct ata_port_operations qdi650
25834 .set_piomode = qdi6500_set_piomode,
25835 };
25836
25837-static struct ata_port_operations qdi6580_port_ops = {
25838+static const struct ata_port_operations qdi6580_port_ops = {
25839 .inherits = &qdi6500_port_ops,
25840 .set_piomode = qdi6580_set_piomode,
25841 };
25842diff -urNp linux-2.6.39/drivers/ata/pata_radisys.c linux-2.6.39/drivers/ata/pata_radisys.c
25843--- linux-2.6.39/drivers/ata/pata_radisys.c 2011-05-19 00:06:34.000000000 -0400
25844+++ linux-2.6.39/drivers/ata/pata_radisys.c 2011-05-22 19:36:31.000000000 -0400
25845@@ -187,7 +187,7 @@ static struct scsi_host_template radisys
25846 ATA_BMDMA_SHT(DRV_NAME),
25847 };
25848
25849-static struct ata_port_operations radisys_pata_ops = {
25850+static const struct ata_port_operations radisys_pata_ops = {
25851 .inherits = &ata_bmdma_port_ops,
25852 .qc_issue = radisys_qc_issue,
25853 .cable_detect = ata_cable_unknown,
25854diff -urNp linux-2.6.39/drivers/ata/pata_rb532_cf.c linux-2.6.39/drivers/ata/pata_rb532_cf.c
25855--- linux-2.6.39/drivers/ata/pata_rb532_cf.c 2011-05-19 00:06:34.000000000 -0400
25856+++ linux-2.6.39/drivers/ata/pata_rb532_cf.c 2011-05-22 19:36:31.000000000 -0400
25857@@ -69,7 +69,7 @@ static irqreturn_t rb532_pata_irq_handle
25858 return IRQ_HANDLED;
25859 }
25860
25861-static struct ata_port_operations rb532_pata_port_ops = {
25862+static const struct ata_port_operations rb532_pata_port_ops = {
25863 .inherits = &ata_sff_port_ops,
25864 .sff_data_xfer = ata_sff_data_xfer32,
25865 };
25866diff -urNp linux-2.6.39/drivers/ata/pata_rdc.c linux-2.6.39/drivers/ata/pata_rdc.c
25867--- linux-2.6.39/drivers/ata/pata_rdc.c 2011-05-19 00:06:34.000000000 -0400
25868+++ linux-2.6.39/drivers/ata/pata_rdc.c 2011-05-22 19:36:31.000000000 -0400
25869@@ -273,7 +273,7 @@ static void rdc_set_dmamode(struct ata_p
25870 pci_write_config_byte(dev, 0x48, udma_enable);
25871 }
25872
25873-static struct ata_port_operations rdc_pata_ops = {
25874+static const struct ata_port_operations rdc_pata_ops = {
25875 .inherits = &ata_bmdma32_port_ops,
25876 .cable_detect = rdc_pata_cable_detect,
25877 .set_piomode = rdc_set_piomode,
25878diff -urNp linux-2.6.39/drivers/ata/pata_rz1000.c linux-2.6.39/drivers/ata/pata_rz1000.c
25879--- linux-2.6.39/drivers/ata/pata_rz1000.c 2011-05-19 00:06:34.000000000 -0400
25880+++ linux-2.6.39/drivers/ata/pata_rz1000.c 2011-05-22 19:36:31.000000000 -0400
25881@@ -54,7 +54,7 @@ static struct scsi_host_template rz1000_
25882 ATA_PIO_SHT(DRV_NAME),
25883 };
25884
25885-static struct ata_port_operations rz1000_port_ops = {
25886+static const struct ata_port_operations rz1000_port_ops = {
25887 .inherits = &ata_sff_port_ops,
25888 .cable_detect = ata_cable_40wire,
25889 .set_mode = rz1000_set_mode,
25890diff -urNp linux-2.6.39/drivers/ata/pata_samsung_cf.c linux-2.6.39/drivers/ata/pata_samsung_cf.c
25891--- linux-2.6.39/drivers/ata/pata_samsung_cf.c 2011-05-19 00:06:34.000000000 -0400
25892+++ linux-2.6.39/drivers/ata/pata_samsung_cf.c 2011-05-22 19:36:31.000000000 -0400
25893@@ -399,7 +399,7 @@ static struct scsi_host_template pata_s3
25894 ATA_PIO_SHT(DRV_NAME),
25895 };
25896
25897-static struct ata_port_operations pata_s3c_port_ops = {
25898+static const struct ata_port_operations pata_s3c_port_ops = {
25899 .inherits = &ata_sff_port_ops,
25900 .sff_check_status = pata_s3c_check_status,
25901 .sff_check_altstatus = pata_s3c_check_altstatus,
25902@@ -413,7 +413,7 @@ static struct ata_port_operations pata_s
25903 .set_piomode = pata_s3c_set_piomode,
25904 };
25905
25906-static struct ata_port_operations pata_s5p_port_ops = {
25907+static const struct ata_port_operations pata_s5p_port_ops = {
25908 .inherits = &ata_sff_port_ops,
25909 .set_piomode = pata_s3c_set_piomode,
25910 };
25911diff -urNp linux-2.6.39/drivers/ata/pata_sc1200.c linux-2.6.39/drivers/ata/pata_sc1200.c
25912--- linux-2.6.39/drivers/ata/pata_sc1200.c 2011-05-19 00:06:34.000000000 -0400
25913+++ linux-2.6.39/drivers/ata/pata_sc1200.c 2011-05-22 19:36:31.000000000 -0400
25914@@ -207,7 +207,7 @@ static struct scsi_host_template sc1200_
25915 .sg_tablesize = LIBATA_DUMB_MAX_PRD,
25916 };
25917
25918-static struct ata_port_operations sc1200_port_ops = {
25919+static const struct ata_port_operations sc1200_port_ops = {
25920 .inherits = &ata_bmdma_port_ops,
25921 .qc_prep = ata_bmdma_dumb_qc_prep,
25922 .qc_issue = sc1200_qc_issue,
25923diff -urNp linux-2.6.39/drivers/ata/pata_scc.c linux-2.6.39/drivers/ata/pata_scc.c
25924--- linux-2.6.39/drivers/ata/pata_scc.c 2011-05-19 00:06:34.000000000 -0400
25925+++ linux-2.6.39/drivers/ata/pata_scc.c 2011-05-22 19:36:31.000000000 -0400
25926@@ -926,7 +926,7 @@ static struct scsi_host_template scc_sht
25927 ATA_BMDMA_SHT(DRV_NAME),
25928 };
25929
25930-static struct ata_port_operations scc_pata_ops = {
25931+static const struct ata_port_operations scc_pata_ops = {
25932 .inherits = &ata_bmdma_port_ops,
25933
25934 .set_piomode = scc_set_piomode,
25935diff -urNp linux-2.6.39/drivers/ata/pata_sch.c linux-2.6.39/drivers/ata/pata_sch.c
25936--- linux-2.6.39/drivers/ata/pata_sch.c 2011-05-19 00:06:34.000000000 -0400
25937+++ linux-2.6.39/drivers/ata/pata_sch.c 2011-05-22 19:36:31.000000000 -0400
25938@@ -75,7 +75,7 @@ static struct scsi_host_template sch_sht
25939 ATA_BMDMA_SHT(DRV_NAME),
25940 };
25941
25942-static struct ata_port_operations sch_pata_ops = {
25943+static const struct ata_port_operations sch_pata_ops = {
25944 .inherits = &ata_bmdma_port_ops,
25945 .cable_detect = ata_cable_unknown,
25946 .set_piomode = sch_set_piomode,
25947diff -urNp linux-2.6.39/drivers/ata/pata_serverworks.c linux-2.6.39/drivers/ata/pata_serverworks.c
25948--- linux-2.6.39/drivers/ata/pata_serverworks.c 2011-05-19 00:06:34.000000000 -0400
25949+++ linux-2.6.39/drivers/ata/pata_serverworks.c 2011-05-22 19:36:31.000000000 -0400
25950@@ -300,7 +300,7 @@ static struct scsi_host_template serverw
25951 ATA_BMDMA_SHT(DRV_NAME),
25952 };
25953
25954-static struct ata_port_operations serverworks_osb4_port_ops = {
25955+static const struct ata_port_operations serverworks_osb4_port_ops = {
25956 .inherits = &ata_bmdma_port_ops,
25957 .cable_detect = serverworks_cable_detect,
25958 .mode_filter = serverworks_osb4_filter,
25959@@ -308,7 +308,7 @@ static struct ata_port_operations server
25960 .set_dmamode = serverworks_set_dmamode,
25961 };
25962
25963-static struct ata_port_operations serverworks_csb_port_ops = {
25964+static const struct ata_port_operations serverworks_csb_port_ops = {
25965 .inherits = &serverworks_osb4_port_ops,
25966 .mode_filter = serverworks_csb_filter,
25967 };
25968diff -urNp linux-2.6.39/drivers/ata/pata_sil680.c linux-2.6.39/drivers/ata/pata_sil680.c
25969--- linux-2.6.39/drivers/ata/pata_sil680.c 2011-05-19 00:06:34.000000000 -0400
25970+++ linux-2.6.39/drivers/ata/pata_sil680.c 2011-05-22 19:36:31.000000000 -0400
25971@@ -225,8 +225,7 @@ static struct scsi_host_template sil680_
25972 ATA_BMDMA_SHT(DRV_NAME),
25973 };
25974
25975-
25976-static struct ata_port_operations sil680_port_ops = {
25977+static const struct ata_port_operations sil680_port_ops = {
25978 .inherits = &ata_bmdma32_port_ops,
25979 .sff_exec_command = sil680_sff_exec_command,
25980 .sff_irq_check = sil680_sff_irq_check,
25981diff -urNp linux-2.6.39/drivers/ata/pata_sis.c linux-2.6.39/drivers/ata/pata_sis.c
25982--- linux-2.6.39/drivers/ata/pata_sis.c 2011-05-19 00:06:34.000000000 -0400
25983+++ linux-2.6.39/drivers/ata/pata_sis.c 2011-05-22 19:36:31.000000000 -0400
25984@@ -503,47 +503,47 @@ static struct scsi_host_template sis_sht
25985 ATA_BMDMA_SHT(DRV_NAME),
25986 };
25987
25988-static struct ata_port_operations sis_133_for_sata_ops = {
25989+static const struct ata_port_operations sis_133_for_sata_ops = {
25990 .inherits = &ata_bmdma_port_ops,
25991 .set_piomode = sis_133_set_piomode,
25992 .set_dmamode = sis_133_set_dmamode,
25993 .cable_detect = sis_133_cable_detect,
25994 };
25995
25996-static struct ata_port_operations sis_base_ops = {
25997+static const struct ata_port_operations sis_base_ops = {
25998 .inherits = &ata_bmdma_port_ops,
25999 .prereset = sis_pre_reset,
26000 };
26001
26002-static struct ata_port_operations sis_133_ops = {
26003+static const struct ata_port_operations sis_133_ops = {
26004 .inherits = &sis_base_ops,
26005 .set_piomode = sis_133_set_piomode,
26006 .set_dmamode = sis_133_set_dmamode,
26007 .cable_detect = sis_133_cable_detect,
26008 };
26009
26010-static struct ata_port_operations sis_133_early_ops = {
26011+static const struct ata_port_operations sis_133_early_ops = {
26012 .inherits = &sis_base_ops,
26013 .set_piomode = sis_100_set_piomode,
26014 .set_dmamode = sis_133_early_set_dmamode,
26015 .cable_detect = sis_66_cable_detect,
26016 };
26017
26018-static struct ata_port_operations sis_100_ops = {
26019+static const struct ata_port_operations sis_100_ops = {
26020 .inherits = &sis_base_ops,
26021 .set_piomode = sis_100_set_piomode,
26022 .set_dmamode = sis_100_set_dmamode,
26023 .cable_detect = sis_66_cable_detect,
26024 };
26025
26026-static struct ata_port_operations sis_66_ops = {
26027+static const struct ata_port_operations sis_66_ops = {
26028 .inherits = &sis_base_ops,
26029 .set_piomode = sis_old_set_piomode,
26030 .set_dmamode = sis_66_set_dmamode,
26031 .cable_detect = sis_66_cable_detect,
26032 };
26033
26034-static struct ata_port_operations sis_old_ops = {
26035+static const struct ata_port_operations sis_old_ops = {
26036 .inherits = &sis_base_ops,
26037 .set_piomode = sis_old_set_piomode,
26038 .set_dmamode = sis_old_set_dmamode,
26039diff -urNp linux-2.6.39/drivers/ata/pata_sl82c105.c linux-2.6.39/drivers/ata/pata_sl82c105.c
26040--- linux-2.6.39/drivers/ata/pata_sl82c105.c 2011-05-19 00:06:34.000000000 -0400
26041+++ linux-2.6.39/drivers/ata/pata_sl82c105.c 2011-05-22 19:36:31.000000000 -0400
26042@@ -241,7 +241,7 @@ static struct scsi_host_template sl82c10
26043 ATA_BMDMA_SHT(DRV_NAME),
26044 };
26045
26046-static struct ata_port_operations sl82c105_port_ops = {
26047+static const struct ata_port_operations sl82c105_port_ops = {
26048 .inherits = &ata_bmdma_port_ops,
26049 .qc_defer = sl82c105_qc_defer,
26050 .bmdma_start = sl82c105_bmdma_start,
26051diff -urNp linux-2.6.39/drivers/ata/pata_triflex.c linux-2.6.39/drivers/ata/pata_triflex.c
26052--- linux-2.6.39/drivers/ata/pata_triflex.c 2011-05-19 00:06:34.000000000 -0400
26053+++ linux-2.6.39/drivers/ata/pata_triflex.c 2011-05-22 19:36:31.000000000 -0400
26054@@ -178,7 +178,7 @@ static struct scsi_host_template triflex
26055 ATA_BMDMA_SHT(DRV_NAME),
26056 };
26057
26058-static struct ata_port_operations triflex_port_ops = {
26059+static const struct ata_port_operations triflex_port_ops = {
26060 .inherits = &ata_bmdma_port_ops,
26061 .bmdma_start = triflex_bmdma_start,
26062 .bmdma_stop = triflex_bmdma_stop,
26063diff -urNp linux-2.6.39/drivers/ata/pata_via.c linux-2.6.39/drivers/ata/pata_via.c
26064--- linux-2.6.39/drivers/ata/pata_via.c 2011-05-19 00:06:34.000000000 -0400
26065+++ linux-2.6.39/drivers/ata/pata_via.c 2011-05-22 19:36:31.000000000 -0400
26066@@ -441,7 +441,7 @@ static struct scsi_host_template via_sht
26067 ATA_BMDMA_SHT(DRV_NAME),
26068 };
26069
26070-static struct ata_port_operations via_port_ops = {
26071+static const struct ata_port_operations via_port_ops = {
26072 .inherits = &ata_bmdma_port_ops,
26073 .cable_detect = via_cable_detect,
26074 .set_piomode = via_set_piomode,
26075@@ -452,7 +452,7 @@ static struct ata_port_operations via_po
26076 .mode_filter = via_mode_filter,
26077 };
26078
26079-static struct ata_port_operations via_port_ops_noirq = {
26080+static const struct ata_port_operations via_port_ops_noirq = {
26081 .inherits = &via_port_ops,
26082 .sff_data_xfer = ata_sff_data_xfer_noirq,
26083 };
26084diff -urNp linux-2.6.39/drivers/ata/pdc_adma.c linux-2.6.39/drivers/ata/pdc_adma.c
26085--- linux-2.6.39/drivers/ata/pdc_adma.c 2011-05-19 00:06:34.000000000 -0400
26086+++ linux-2.6.39/drivers/ata/pdc_adma.c 2011-05-22 19:36:31.000000000 -0400
26087@@ -146,7 +146,7 @@ static struct scsi_host_template adma_at
26088 .dma_boundary = ADMA_DMA_BOUNDARY,
26089 };
26090
26091-static struct ata_port_operations adma_ata_ops = {
26092+static const struct ata_port_operations adma_ata_ops = {
26093 .inherits = &ata_sff_port_ops,
26094
26095 .lost_interrupt = ATA_OP_NULL,
26096diff -urNp linux-2.6.39/drivers/ata/sata_dwc_460ex.c linux-2.6.39/drivers/ata/sata_dwc_460ex.c
26097--- linux-2.6.39/drivers/ata/sata_dwc_460ex.c 2011-05-19 00:06:34.000000000 -0400
26098+++ linux-2.6.39/drivers/ata/sata_dwc_460ex.c 2011-05-22 19:36:31.000000000 -0400
26099@@ -1598,7 +1598,7 @@ static struct scsi_host_template sata_dw
26100 .dma_boundary = ATA_DMA_BOUNDARY,
26101 };
26102
26103-static struct ata_port_operations sata_dwc_ops = {
26104+static const struct ata_port_operations sata_dwc_ops = {
26105 .inherits = &ata_sff_port_ops,
26106
26107 .error_handler = sata_dwc_error_handler,
26108diff -urNp linux-2.6.39/drivers/ata/sata_fsl.c linux-2.6.39/drivers/ata/sata_fsl.c
26109--- linux-2.6.39/drivers/ata/sata_fsl.c 2011-05-19 00:06:34.000000000 -0400
26110+++ linux-2.6.39/drivers/ata/sata_fsl.c 2011-05-22 19:36:31.000000000 -0400
26111@@ -1268,7 +1268,7 @@ static struct scsi_host_template sata_fs
26112 .dma_boundary = ATA_DMA_BOUNDARY,
26113 };
26114
26115-static struct ata_port_operations sata_fsl_ops = {
26116+static const struct ata_port_operations sata_fsl_ops = {
26117 .inherits = &sata_pmp_port_ops,
26118
26119 .qc_defer = ata_std_qc_defer,
26120diff -urNp linux-2.6.39/drivers/ata/sata_inic162x.c linux-2.6.39/drivers/ata/sata_inic162x.c
26121--- linux-2.6.39/drivers/ata/sata_inic162x.c 2011-05-19 00:06:34.000000000 -0400
26122+++ linux-2.6.39/drivers/ata/sata_inic162x.c 2011-05-22 19:36:31.000000000 -0400
26123@@ -705,7 +705,7 @@ static int inic_port_start(struct ata_po
26124 return 0;
26125 }
26126
26127-static struct ata_port_operations inic_port_ops = {
26128+static const struct ata_port_operations inic_port_ops = {
26129 .inherits = &sata_port_ops,
26130
26131 .check_atapi_dma = inic_check_atapi_dma,
26132diff -urNp linux-2.6.39/drivers/ata/sata_mv.c linux-2.6.39/drivers/ata/sata_mv.c
26133--- linux-2.6.39/drivers/ata/sata_mv.c 2011-05-19 00:06:34.000000000 -0400
26134+++ linux-2.6.39/drivers/ata/sata_mv.c 2011-05-22 19:36:31.000000000 -0400
26135@@ -662,7 +662,7 @@ static struct scsi_host_template mv6_sht
26136 .dma_boundary = MV_DMA_BOUNDARY,
26137 };
26138
26139-static struct ata_port_operations mv5_ops = {
26140+static const struct ata_port_operations mv5_ops = {
26141 .inherits = &ata_sff_port_ops,
26142
26143 .lost_interrupt = ATA_OP_NULL,
26144@@ -682,7 +682,7 @@ static struct ata_port_operations mv5_op
26145 .port_stop = mv_port_stop,
26146 };
26147
26148-static struct ata_port_operations mv6_ops = {
26149+static const struct ata_port_operations mv6_ops = {
26150 .inherits = &ata_bmdma_port_ops,
26151
26152 .lost_interrupt = ATA_OP_NULL,
26153@@ -716,7 +716,7 @@ static struct ata_port_operations mv6_op
26154 .port_stop = mv_port_stop,
26155 };
26156
26157-static struct ata_port_operations mv_iie_ops = {
26158+static const struct ata_port_operations mv_iie_ops = {
26159 .inherits = &mv6_ops,
26160 .dev_config = ATA_OP_NULL,
26161 .qc_prep = mv_qc_prep_iie,
26162diff -urNp linux-2.6.39/drivers/ata/sata_nv.c linux-2.6.39/drivers/ata/sata_nv.c
26163--- linux-2.6.39/drivers/ata/sata_nv.c 2011-05-19 00:06:34.000000000 -0400
26164+++ linux-2.6.39/drivers/ata/sata_nv.c 2011-05-22 19:36:31.000000000 -0400
26165@@ -465,7 +465,7 @@ static struct scsi_host_template nv_swnc
26166 * cases. Define nv_hardreset() which only kicks in for post-boot
26167 * probing and use it for all variants.
26168 */
26169-static struct ata_port_operations nv_generic_ops = {
26170+static const struct ata_port_operations nv_generic_ops = {
26171 .inherits = &ata_bmdma_port_ops,
26172 .lost_interrupt = ATA_OP_NULL,
26173 .scr_read = nv_scr_read,
26174@@ -473,20 +473,20 @@ static struct ata_port_operations nv_gen
26175 .hardreset = nv_hardreset,
26176 };
26177
26178-static struct ata_port_operations nv_nf2_ops = {
26179+static const struct ata_port_operations nv_nf2_ops = {
26180 .inherits = &nv_generic_ops,
26181 .freeze = nv_nf2_freeze,
26182 .thaw = nv_nf2_thaw,
26183 };
26184
26185-static struct ata_port_operations nv_ck804_ops = {
26186+static const struct ata_port_operations nv_ck804_ops = {
26187 .inherits = &nv_generic_ops,
26188 .freeze = nv_ck804_freeze,
26189 .thaw = nv_ck804_thaw,
26190 .host_stop = nv_ck804_host_stop,
26191 };
26192
26193-static struct ata_port_operations nv_adma_ops = {
26194+static const struct ata_port_operations nv_adma_ops = {
26195 .inherits = &nv_ck804_ops,
26196
26197 .check_atapi_dma = nv_adma_check_atapi_dma,
26198@@ -510,7 +510,7 @@ static struct ata_port_operations nv_adm
26199 .host_stop = nv_adma_host_stop,
26200 };
26201
26202-static struct ata_port_operations nv_swncq_ops = {
26203+static const struct ata_port_operations nv_swncq_ops = {
26204 .inherits = &nv_generic_ops,
26205
26206 .qc_defer = ata_std_qc_defer,
26207diff -urNp linux-2.6.39/drivers/ata/sata_promise.c linux-2.6.39/drivers/ata/sata_promise.c
26208--- linux-2.6.39/drivers/ata/sata_promise.c 2011-05-19 00:06:34.000000000 -0400
26209+++ linux-2.6.39/drivers/ata/sata_promise.c 2011-05-22 19:36:31.000000000 -0400
26210@@ -194,7 +194,7 @@ static const struct ata_port_operations
26211 .error_handler = pdc_error_handler,
26212 };
26213
26214-static struct ata_port_operations pdc_sata_ops = {
26215+static const struct ata_port_operations pdc_sata_ops = {
26216 .inherits = &pdc_common_ops,
26217 .cable_detect = pdc_sata_cable_detect,
26218 .freeze = pdc_sata_freeze,
26219@@ -207,14 +207,14 @@ static struct ata_port_operations pdc_sa
26220
26221 /* First-generation chips need a more restrictive ->check_atapi_dma op,
26222 and ->freeze/thaw that ignore the hotplug controls. */
26223-static struct ata_port_operations pdc_old_sata_ops = {
26224+static const struct ata_port_operations pdc_old_sata_ops = {
26225 .inherits = &pdc_sata_ops,
26226 .freeze = pdc_freeze,
26227 .thaw = pdc_thaw,
26228 .check_atapi_dma = pdc_old_sata_check_atapi_dma,
26229 };
26230
26231-static struct ata_port_operations pdc_pata_ops = {
26232+static const struct ata_port_operations pdc_pata_ops = {
26233 .inherits = &pdc_common_ops,
26234 .cable_detect = pdc_pata_cable_detect,
26235 .freeze = pdc_freeze,
26236diff -urNp linux-2.6.39/drivers/ata/sata_qstor.c linux-2.6.39/drivers/ata/sata_qstor.c
26237--- linux-2.6.39/drivers/ata/sata_qstor.c 2011-05-19 00:06:34.000000000 -0400
26238+++ linux-2.6.39/drivers/ata/sata_qstor.c 2011-05-22 19:36:31.000000000 -0400
26239@@ -131,7 +131,7 @@ static struct scsi_host_template qs_ata_
26240 .dma_boundary = QS_DMA_BOUNDARY,
26241 };
26242
26243-static struct ata_port_operations qs_ata_ops = {
26244+static const struct ata_port_operations qs_ata_ops = {
26245 .inherits = &ata_sff_port_ops,
26246
26247 .check_atapi_dma = qs_check_atapi_dma,
26248diff -urNp linux-2.6.39/drivers/ata/sata_sil24.c linux-2.6.39/drivers/ata/sata_sil24.c
26249--- linux-2.6.39/drivers/ata/sata_sil24.c 2011-05-19 00:06:34.000000000 -0400
26250+++ linux-2.6.39/drivers/ata/sata_sil24.c 2011-05-22 19:36:31.000000000 -0400
26251@@ -388,7 +388,7 @@ static struct scsi_host_template sil24_s
26252 .dma_boundary = ATA_DMA_BOUNDARY,
26253 };
26254
26255-static struct ata_port_operations sil24_ops = {
26256+static const struct ata_port_operations sil24_ops = {
26257 .inherits = &sata_pmp_port_ops,
26258
26259 .qc_defer = sil24_qc_defer,
26260diff -urNp linux-2.6.39/drivers/ata/sata_sil.c linux-2.6.39/drivers/ata/sata_sil.c
26261--- linux-2.6.39/drivers/ata/sata_sil.c 2011-05-19 00:06:34.000000000 -0400
26262+++ linux-2.6.39/drivers/ata/sata_sil.c 2011-05-22 19:36:31.000000000 -0400
26263@@ -181,7 +181,7 @@ static struct scsi_host_template sil_sht
26264 .sg_tablesize = ATA_MAX_PRD
26265 };
26266
26267-static struct ata_port_operations sil_ops = {
26268+static const struct ata_port_operations sil_ops = {
26269 .inherits = &ata_bmdma32_port_ops,
26270 .dev_config = sil_dev_config,
26271 .set_mode = sil_set_mode,
26272diff -urNp linux-2.6.39/drivers/ata/sata_sis.c linux-2.6.39/drivers/ata/sata_sis.c
26273--- linux-2.6.39/drivers/ata/sata_sis.c 2011-05-19 00:06:34.000000000 -0400
26274+++ linux-2.6.39/drivers/ata/sata_sis.c 2011-05-22 19:36:31.000000000 -0400
26275@@ -89,7 +89,7 @@ static struct scsi_host_template sis_sht
26276 ATA_BMDMA_SHT(DRV_NAME),
26277 };
26278
26279-static struct ata_port_operations sis_ops = {
26280+static const struct ata_port_operations sis_ops = {
26281 .inherits = &ata_bmdma_port_ops,
26282 .scr_read = sis_scr_read,
26283 .scr_write = sis_scr_write,
26284diff -urNp linux-2.6.39/drivers/ata/sata_svw.c linux-2.6.39/drivers/ata/sata_svw.c
26285--- linux-2.6.39/drivers/ata/sata_svw.c 2011-05-19 00:06:34.000000000 -0400
26286+++ linux-2.6.39/drivers/ata/sata_svw.c 2011-05-22 19:36:31.000000000 -0400
26287@@ -344,7 +344,7 @@ static struct scsi_host_template k2_sata
26288 };
26289
26290
26291-static struct ata_port_operations k2_sata_ops = {
26292+static const struct ata_port_operations k2_sata_ops = {
26293 .inherits = &ata_bmdma_port_ops,
26294 .sff_tf_load = k2_sata_tf_load,
26295 .sff_tf_read = k2_sata_tf_read,
26296diff -urNp linux-2.6.39/drivers/ata/sata_sx4.c linux-2.6.39/drivers/ata/sata_sx4.c
26297--- linux-2.6.39/drivers/ata/sata_sx4.c 2011-05-19 00:06:34.000000000 -0400
26298+++ linux-2.6.39/drivers/ata/sata_sx4.c 2011-05-22 19:36:31.000000000 -0400
26299@@ -249,7 +249,7 @@ static struct scsi_host_template pdc_sat
26300 };
26301
26302 /* TODO: inherit from base port_ops after converting to new EH */
26303-static struct ata_port_operations pdc_20621_ops = {
26304+static const struct ata_port_operations pdc_20621_ops = {
26305 .inherits = &ata_sff_port_ops,
26306
26307 .check_atapi_dma = pdc_check_atapi_dma,
26308diff -urNp linux-2.6.39/drivers/ata/sata_uli.c linux-2.6.39/drivers/ata/sata_uli.c
26309--- linux-2.6.39/drivers/ata/sata_uli.c 2011-05-19 00:06:34.000000000 -0400
26310+++ linux-2.6.39/drivers/ata/sata_uli.c 2011-05-22 19:36:31.000000000 -0400
26311@@ -80,7 +80,7 @@ static struct scsi_host_template uli_sht
26312 ATA_BMDMA_SHT(DRV_NAME),
26313 };
26314
26315-static struct ata_port_operations uli_ops = {
26316+static const struct ata_port_operations uli_ops = {
26317 .inherits = &ata_bmdma_port_ops,
26318 .scr_read = uli_scr_read,
26319 .scr_write = uli_scr_write,
26320diff -urNp linux-2.6.39/drivers/ata/sata_via.c linux-2.6.39/drivers/ata/sata_via.c
26321--- linux-2.6.39/drivers/ata/sata_via.c 2011-05-19 00:06:34.000000000 -0400
26322+++ linux-2.6.39/drivers/ata/sata_via.c 2011-05-22 19:36:31.000000000 -0400
26323@@ -115,32 +115,32 @@ static struct scsi_host_template svia_sh
26324 ATA_BMDMA_SHT(DRV_NAME),
26325 };
26326
26327-static struct ata_port_operations svia_base_ops = {
26328+static const struct ata_port_operations svia_base_ops = {
26329 .inherits = &ata_bmdma_port_ops,
26330 .sff_tf_load = svia_tf_load,
26331 };
26332
26333-static struct ata_port_operations vt6420_sata_ops = {
26334+static const struct ata_port_operations vt6420_sata_ops = {
26335 .inherits = &svia_base_ops,
26336 .freeze = svia_noop_freeze,
26337 .prereset = vt6420_prereset,
26338 .bmdma_start = vt6420_bmdma_start,
26339 };
26340
26341-static struct ata_port_operations vt6421_pata_ops = {
26342+static const struct ata_port_operations vt6421_pata_ops = {
26343 .inherits = &svia_base_ops,
26344 .cable_detect = vt6421_pata_cable_detect,
26345 .set_piomode = vt6421_set_pio_mode,
26346 .set_dmamode = vt6421_set_dma_mode,
26347 };
26348
26349-static struct ata_port_operations vt6421_sata_ops = {
26350+static const struct ata_port_operations vt6421_sata_ops = {
26351 .inherits = &svia_base_ops,
26352 .scr_read = svia_scr_read,
26353 .scr_write = svia_scr_write,
26354 };
26355
26356-static struct ata_port_operations vt8251_ops = {
26357+static const struct ata_port_operations vt8251_ops = {
26358 .inherits = &svia_base_ops,
26359 .hardreset = sata_std_hardreset,
26360 .scr_read = vt8251_scr_read,
26361diff -urNp linux-2.6.39/drivers/ata/sata_vsc.c linux-2.6.39/drivers/ata/sata_vsc.c
26362--- linux-2.6.39/drivers/ata/sata_vsc.c 2011-05-19 00:06:34.000000000 -0400
26363+++ linux-2.6.39/drivers/ata/sata_vsc.c 2011-05-22 19:36:31.000000000 -0400
26364@@ -300,7 +300,7 @@ static struct scsi_host_template vsc_sat
26365 };
26366
26367
26368-static struct ata_port_operations vsc_sata_ops = {
26369+static const struct ata_port_operations vsc_sata_ops = {
26370 .inherits = &ata_bmdma_port_ops,
26371 /* The IRQ handling is not quite standard SFF behaviour so we
26372 cannot use the default lost interrupt handler */
26373diff -urNp linux-2.6.39/drivers/atm/adummy.c linux-2.6.39/drivers/atm/adummy.c
26374--- linux-2.6.39/drivers/atm/adummy.c 2011-05-19 00:06:34.000000000 -0400
26375+++ linux-2.6.39/drivers/atm/adummy.c 2011-05-22 19:36:31.000000000 -0400
26376@@ -114,7 +114,7 @@ adummy_send(struct atm_vcc *vcc, struct
26377 vcc->pop(vcc, skb);
26378 else
26379 dev_kfree_skb_any(skb);
26380- atomic_inc(&vcc->stats->tx);
26381+ atomic_inc_unchecked(&vcc->stats->tx);
26382
26383 return 0;
26384 }
26385diff -urNp linux-2.6.39/drivers/atm/ambassador.c linux-2.6.39/drivers/atm/ambassador.c
26386--- linux-2.6.39/drivers/atm/ambassador.c 2011-05-19 00:06:34.000000000 -0400
26387+++ linux-2.6.39/drivers/atm/ambassador.c 2011-05-22 19:36:31.000000000 -0400
26388@@ -454,7 +454,7 @@ static void tx_complete (amb_dev * dev,
26389 PRINTD (DBG_FLOW|DBG_TX, "tx_complete %p %p", dev, tx);
26390
26391 // VC layer stats
26392- atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
26393+ atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
26394
26395 // free the descriptor
26396 kfree (tx_descr);
26397@@ -495,7 +495,7 @@ static void rx_complete (amb_dev * dev,
26398 dump_skb ("<<<", vc, skb);
26399
26400 // VC layer stats
26401- atomic_inc(&atm_vcc->stats->rx);
26402+ atomic_inc_unchecked(&atm_vcc->stats->rx);
26403 __net_timestamp(skb);
26404 // end of our responsibility
26405 atm_vcc->push (atm_vcc, skb);
26406@@ -510,7 +510,7 @@ static void rx_complete (amb_dev * dev,
26407 } else {
26408 PRINTK (KERN_INFO, "dropped over-size frame");
26409 // should we count this?
26410- atomic_inc(&atm_vcc->stats->rx_drop);
26411+ atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
26412 }
26413
26414 } else {
26415@@ -1342,7 +1342,7 @@ static int amb_send (struct atm_vcc * at
26416 }
26417
26418 if (check_area (skb->data, skb->len)) {
26419- atomic_inc(&atm_vcc->stats->tx_err);
26420+ atomic_inc_unchecked(&atm_vcc->stats->tx_err);
26421 return -ENOMEM; // ?
26422 }
26423
26424diff -urNp linux-2.6.39/drivers/atm/atmtcp.c linux-2.6.39/drivers/atm/atmtcp.c
26425--- linux-2.6.39/drivers/atm/atmtcp.c 2011-05-19 00:06:34.000000000 -0400
26426+++ linux-2.6.39/drivers/atm/atmtcp.c 2011-05-22 19:36:31.000000000 -0400
26427@@ -207,7 +207,7 @@ static int atmtcp_v_send(struct atm_vcc
26428 if (vcc->pop) vcc->pop(vcc,skb);
26429 else dev_kfree_skb(skb);
26430 if (dev_data) return 0;
26431- atomic_inc(&vcc->stats->tx_err);
26432+ atomic_inc_unchecked(&vcc->stats->tx_err);
26433 return -ENOLINK;
26434 }
26435 size = skb->len+sizeof(struct atmtcp_hdr);
26436@@ -215,7 +215,7 @@ static int atmtcp_v_send(struct atm_vcc
26437 if (!new_skb) {
26438 if (vcc->pop) vcc->pop(vcc,skb);
26439 else dev_kfree_skb(skb);
26440- atomic_inc(&vcc->stats->tx_err);
26441+ atomic_inc_unchecked(&vcc->stats->tx_err);
26442 return -ENOBUFS;
26443 }
26444 hdr = (void *) skb_put(new_skb,sizeof(struct atmtcp_hdr));
26445@@ -226,8 +226,8 @@ static int atmtcp_v_send(struct atm_vcc
26446 if (vcc->pop) vcc->pop(vcc,skb);
26447 else dev_kfree_skb(skb);
26448 out_vcc->push(out_vcc,new_skb);
26449- atomic_inc(&vcc->stats->tx);
26450- atomic_inc(&out_vcc->stats->rx);
26451+ atomic_inc_unchecked(&vcc->stats->tx);
26452+ atomic_inc_unchecked(&out_vcc->stats->rx);
26453 return 0;
26454 }
26455
26456@@ -301,7 +301,7 @@ static int atmtcp_c_send(struct atm_vcc
26457 out_vcc = find_vcc(dev, ntohs(hdr->vpi), ntohs(hdr->vci));
26458 read_unlock(&vcc_sklist_lock);
26459 if (!out_vcc) {
26460- atomic_inc(&vcc->stats->tx_err);
26461+ atomic_inc_unchecked(&vcc->stats->tx_err);
26462 goto done;
26463 }
26464 skb_pull(skb,sizeof(struct atmtcp_hdr));
26465@@ -313,8 +313,8 @@ static int atmtcp_c_send(struct atm_vcc
26466 __net_timestamp(new_skb);
26467 skb_copy_from_linear_data(skb, skb_put(new_skb, skb->len), skb->len);
26468 out_vcc->push(out_vcc,new_skb);
26469- atomic_inc(&vcc->stats->tx);
26470- atomic_inc(&out_vcc->stats->rx);
26471+ atomic_inc_unchecked(&vcc->stats->tx);
26472+ atomic_inc_unchecked(&out_vcc->stats->rx);
26473 done:
26474 if (vcc->pop) vcc->pop(vcc,skb);
26475 else dev_kfree_skb(skb);
26476diff -urNp linux-2.6.39/drivers/atm/eni.c linux-2.6.39/drivers/atm/eni.c
26477--- linux-2.6.39/drivers/atm/eni.c 2011-05-19 00:06:34.000000000 -0400
26478+++ linux-2.6.39/drivers/atm/eni.c 2011-05-22 19:36:31.000000000 -0400
26479@@ -526,7 +526,7 @@ static int rx_aal0(struct atm_vcc *vcc)
26480 DPRINTK(DEV_LABEL "(itf %d): trashing empty cell\n",
26481 vcc->dev->number);
26482 length = 0;
26483- atomic_inc(&vcc->stats->rx_err);
26484+ atomic_inc_unchecked(&vcc->stats->rx_err);
26485 }
26486 else {
26487 length = ATM_CELL_SIZE-1; /* no HEC */
26488@@ -581,7 +581,7 @@ static int rx_aal5(struct atm_vcc *vcc)
26489 size);
26490 }
26491 eff = length = 0;
26492- atomic_inc(&vcc->stats->rx_err);
26493+ atomic_inc_unchecked(&vcc->stats->rx_err);
26494 }
26495 else {
26496 size = (descr & MID_RED_COUNT)*(ATM_CELL_PAYLOAD >> 2);
26497@@ -598,7 +598,7 @@ static int rx_aal5(struct atm_vcc *vcc)
26498 "(VCI=%d,length=%ld,size=%ld (descr 0x%lx))\n",
26499 vcc->dev->number,vcc->vci,length,size << 2,descr);
26500 length = eff = 0;
26501- atomic_inc(&vcc->stats->rx_err);
26502+ atomic_inc_unchecked(&vcc->stats->rx_err);
26503 }
26504 }
26505 skb = eff ? atm_alloc_charge(vcc,eff << 2,GFP_ATOMIC) : NULL;
26506@@ -771,7 +771,7 @@ rx_dequeued++;
26507 vcc->push(vcc,skb);
26508 pushed++;
26509 }
26510- atomic_inc(&vcc->stats->rx);
26511+ atomic_inc_unchecked(&vcc->stats->rx);
26512 }
26513 wake_up(&eni_dev->rx_wait);
26514 }
26515@@ -1228,7 +1228,7 @@ static void dequeue_tx(struct atm_dev *d
26516 PCI_DMA_TODEVICE);
26517 if (vcc->pop) vcc->pop(vcc,skb);
26518 else dev_kfree_skb_irq(skb);
26519- atomic_inc(&vcc->stats->tx);
26520+ atomic_inc_unchecked(&vcc->stats->tx);
26521 wake_up(&eni_dev->tx_wait);
26522 dma_complete++;
26523 }
26524diff -urNp linux-2.6.39/drivers/atm/firestream.c linux-2.6.39/drivers/atm/firestream.c
26525--- linux-2.6.39/drivers/atm/firestream.c 2011-05-19 00:06:34.000000000 -0400
26526+++ linux-2.6.39/drivers/atm/firestream.c 2011-05-22 19:36:31.000000000 -0400
26527@@ -749,7 +749,7 @@ static void process_txdone_queue (struct
26528 }
26529 }
26530
26531- atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
26532+ atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
26533
26534 fs_dprintk (FS_DEBUG_TXMEM, "i");
26535 fs_dprintk (FS_DEBUG_ALLOC, "Free t-skb: %p\n", skb);
26536@@ -816,7 +816,7 @@ static void process_incoming (struct fs_
26537 #endif
26538 skb_put (skb, qe->p1 & 0xffff);
26539 ATM_SKB(skb)->vcc = atm_vcc;
26540- atomic_inc(&atm_vcc->stats->rx);
26541+ atomic_inc_unchecked(&atm_vcc->stats->rx);
26542 __net_timestamp(skb);
26543 fs_dprintk (FS_DEBUG_ALLOC, "Free rec-skb: %p (pushed)\n", skb);
26544 atm_vcc->push (atm_vcc, skb);
26545@@ -837,12 +837,12 @@ static void process_incoming (struct fs_
26546 kfree (pe);
26547 }
26548 if (atm_vcc)
26549- atomic_inc(&atm_vcc->stats->rx_drop);
26550+ atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
26551 break;
26552 case 0x1f: /* Reassembly abort: no buffers. */
26553 /* Silently increment error counter. */
26554 if (atm_vcc)
26555- atomic_inc(&atm_vcc->stats->rx_drop);
26556+ atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
26557 break;
26558 default: /* Hmm. Haven't written the code to handle the others yet... -- REW */
26559 printk (KERN_WARNING "Don't know what to do with RX status %x: %s.\n",
26560diff -urNp linux-2.6.39/drivers/atm/fore200e.c linux-2.6.39/drivers/atm/fore200e.c
26561--- linux-2.6.39/drivers/atm/fore200e.c 2011-05-19 00:06:34.000000000 -0400
26562+++ linux-2.6.39/drivers/atm/fore200e.c 2011-05-22 19:36:31.000000000 -0400
26563@@ -933,9 +933,9 @@ fore200e_tx_irq(struct fore200e* fore200
26564 #endif
26565 /* check error condition */
26566 if (*entry->status & STATUS_ERROR)
26567- atomic_inc(&vcc->stats->tx_err);
26568+ atomic_inc_unchecked(&vcc->stats->tx_err);
26569 else
26570- atomic_inc(&vcc->stats->tx);
26571+ atomic_inc_unchecked(&vcc->stats->tx);
26572 }
26573 }
26574
26575@@ -1084,7 +1084,7 @@ fore200e_push_rpd(struct fore200e* fore2
26576 if (skb == NULL) {
26577 DPRINTK(2, "unable to alloc new skb, rx PDU length = %d\n", pdu_len);
26578
26579- atomic_inc(&vcc->stats->rx_drop);
26580+ atomic_inc_unchecked(&vcc->stats->rx_drop);
26581 return -ENOMEM;
26582 }
26583
26584@@ -1127,14 +1127,14 @@ fore200e_push_rpd(struct fore200e* fore2
26585
26586 dev_kfree_skb_any(skb);
26587
26588- atomic_inc(&vcc->stats->rx_drop);
26589+ atomic_inc_unchecked(&vcc->stats->rx_drop);
26590 return -ENOMEM;
26591 }
26592
26593 ASSERT(atomic_read(&sk_atm(vcc)->sk_wmem_alloc) >= 0);
26594
26595 vcc->push(vcc, skb);
26596- atomic_inc(&vcc->stats->rx);
26597+ atomic_inc_unchecked(&vcc->stats->rx);
26598
26599 ASSERT(atomic_read(&sk_atm(vcc)->sk_wmem_alloc) >= 0);
26600
26601@@ -1212,7 +1212,7 @@ fore200e_rx_irq(struct fore200e* fore200
26602 DPRINTK(2, "damaged PDU on %d.%d.%d\n",
26603 fore200e->atm_dev->number,
26604 entry->rpd->atm_header.vpi, entry->rpd->atm_header.vci);
26605- atomic_inc(&vcc->stats->rx_err);
26606+ atomic_inc_unchecked(&vcc->stats->rx_err);
26607 }
26608 }
26609
26610@@ -1657,7 +1657,7 @@ fore200e_send(struct atm_vcc *vcc, struc
26611 goto retry_here;
26612 }
26613
26614- atomic_inc(&vcc->stats->tx_err);
26615+ atomic_inc_unchecked(&vcc->stats->tx_err);
26616
26617 fore200e->tx_sat++;
26618 DPRINTK(2, "tx queue of device %s is saturated, PDU dropped - heartbeat is %08x\n",
26619diff -urNp linux-2.6.39/drivers/atm/he.c linux-2.6.39/drivers/atm/he.c
26620--- linux-2.6.39/drivers/atm/he.c 2011-05-19 00:06:34.000000000 -0400
26621+++ linux-2.6.39/drivers/atm/he.c 2011-05-22 19:36:31.000000000 -0400
26622@@ -1709,7 +1709,7 @@ he_service_rbrq(struct he_dev *he_dev, i
26623
26624 if (RBRQ_HBUF_ERR(he_dev->rbrq_head)) {
26625 hprintk("HBUF_ERR! (cid 0x%x)\n", cid);
26626- atomic_inc(&vcc->stats->rx_drop);
26627+ atomic_inc_unchecked(&vcc->stats->rx_drop);
26628 goto return_host_buffers;
26629 }
26630
26631@@ -1736,7 +1736,7 @@ he_service_rbrq(struct he_dev *he_dev, i
26632 RBRQ_LEN_ERR(he_dev->rbrq_head)
26633 ? "LEN_ERR" : "",
26634 vcc->vpi, vcc->vci);
26635- atomic_inc(&vcc->stats->rx_err);
26636+ atomic_inc_unchecked(&vcc->stats->rx_err);
26637 goto return_host_buffers;
26638 }
26639
26640@@ -1788,7 +1788,7 @@ he_service_rbrq(struct he_dev *he_dev, i
26641 vcc->push(vcc, skb);
26642 spin_lock(&he_dev->global_lock);
26643
26644- atomic_inc(&vcc->stats->rx);
26645+ atomic_inc_unchecked(&vcc->stats->rx);
26646
26647 return_host_buffers:
26648 ++pdus_assembled;
26649@@ -2114,7 +2114,7 @@ __enqueue_tpd(struct he_dev *he_dev, str
26650 tpd->vcc->pop(tpd->vcc, tpd->skb);
26651 else
26652 dev_kfree_skb_any(tpd->skb);
26653- atomic_inc(&tpd->vcc->stats->tx_err);
26654+ atomic_inc_unchecked(&tpd->vcc->stats->tx_err);
26655 }
26656 pci_pool_free(he_dev->tpd_pool, tpd, TPD_ADDR(tpd->status));
26657 return;
26658@@ -2526,7 +2526,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
26659 vcc->pop(vcc, skb);
26660 else
26661 dev_kfree_skb_any(skb);
26662- atomic_inc(&vcc->stats->tx_err);
26663+ atomic_inc_unchecked(&vcc->stats->tx_err);
26664 return -EINVAL;
26665 }
26666
26667@@ -2537,7 +2537,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
26668 vcc->pop(vcc, skb);
26669 else
26670 dev_kfree_skb_any(skb);
26671- atomic_inc(&vcc->stats->tx_err);
26672+ atomic_inc_unchecked(&vcc->stats->tx_err);
26673 return -EINVAL;
26674 }
26675 #endif
26676@@ -2549,7 +2549,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
26677 vcc->pop(vcc, skb);
26678 else
26679 dev_kfree_skb_any(skb);
26680- atomic_inc(&vcc->stats->tx_err);
26681+ atomic_inc_unchecked(&vcc->stats->tx_err);
26682 spin_unlock_irqrestore(&he_dev->global_lock, flags);
26683 return -ENOMEM;
26684 }
26685@@ -2591,7 +2591,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
26686 vcc->pop(vcc, skb);
26687 else
26688 dev_kfree_skb_any(skb);
26689- atomic_inc(&vcc->stats->tx_err);
26690+ atomic_inc_unchecked(&vcc->stats->tx_err);
26691 spin_unlock_irqrestore(&he_dev->global_lock, flags);
26692 return -ENOMEM;
26693 }
26694@@ -2622,7 +2622,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
26695 __enqueue_tpd(he_dev, tpd, cid);
26696 spin_unlock_irqrestore(&he_dev->global_lock, flags);
26697
26698- atomic_inc(&vcc->stats->tx);
26699+ atomic_inc_unchecked(&vcc->stats->tx);
26700
26701 return 0;
26702 }
26703diff -urNp linux-2.6.39/drivers/atm/horizon.c linux-2.6.39/drivers/atm/horizon.c
26704--- linux-2.6.39/drivers/atm/horizon.c 2011-05-19 00:06:34.000000000 -0400
26705+++ linux-2.6.39/drivers/atm/horizon.c 2011-05-22 19:36:31.000000000 -0400
26706@@ -1034,7 +1034,7 @@ static void rx_schedule (hrz_dev * dev,
26707 {
26708 struct atm_vcc * vcc = ATM_SKB(skb)->vcc;
26709 // VC layer stats
26710- atomic_inc(&vcc->stats->rx);
26711+ atomic_inc_unchecked(&vcc->stats->rx);
26712 __net_timestamp(skb);
26713 // end of our responsibility
26714 vcc->push (vcc, skb);
26715@@ -1186,7 +1186,7 @@ static void tx_schedule (hrz_dev * const
26716 dev->tx_iovec = NULL;
26717
26718 // VC layer stats
26719- atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
26720+ atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
26721
26722 // free the skb
26723 hrz_kfree_skb (skb);
26724diff -urNp linux-2.6.39/drivers/atm/idt77252.c linux-2.6.39/drivers/atm/idt77252.c
26725--- linux-2.6.39/drivers/atm/idt77252.c 2011-05-19 00:06:34.000000000 -0400
26726+++ linux-2.6.39/drivers/atm/idt77252.c 2011-05-22 19:36:31.000000000 -0400
26727@@ -811,7 +811,7 @@ drain_scq(struct idt77252_dev *card, str
26728 else
26729 dev_kfree_skb(skb);
26730
26731- atomic_inc(&vcc->stats->tx);
26732+ atomic_inc_unchecked(&vcc->stats->tx);
26733 }
26734
26735 atomic_dec(&scq->used);
26736@@ -1074,13 +1074,13 @@ dequeue_rx(struct idt77252_dev *card, st
26737 if ((sb = dev_alloc_skb(64)) == NULL) {
26738 printk("%s: Can't allocate buffers for aal0.\n",
26739 card->name);
26740- atomic_add(i, &vcc->stats->rx_drop);
26741+ atomic_add_unchecked(i, &vcc->stats->rx_drop);
26742 break;
26743 }
26744 if (!atm_charge(vcc, sb->truesize)) {
26745 RXPRINTK("%s: atm_charge() dropped aal0 packets.\n",
26746 card->name);
26747- atomic_add(i - 1, &vcc->stats->rx_drop);
26748+ atomic_add_unchecked(i - 1, &vcc->stats->rx_drop);
26749 dev_kfree_skb(sb);
26750 break;
26751 }
26752@@ -1097,7 +1097,7 @@ dequeue_rx(struct idt77252_dev *card, st
26753 ATM_SKB(sb)->vcc = vcc;
26754 __net_timestamp(sb);
26755 vcc->push(vcc, sb);
26756- atomic_inc(&vcc->stats->rx);
26757+ atomic_inc_unchecked(&vcc->stats->rx);
26758
26759 cell += ATM_CELL_PAYLOAD;
26760 }
26761@@ -1134,13 +1134,13 @@ dequeue_rx(struct idt77252_dev *card, st
26762 "(CDC: %08x)\n",
26763 card->name, len, rpp->len, readl(SAR_REG_CDC));
26764 recycle_rx_pool_skb(card, rpp);
26765- atomic_inc(&vcc->stats->rx_err);
26766+ atomic_inc_unchecked(&vcc->stats->rx_err);
26767 return;
26768 }
26769 if (stat & SAR_RSQE_CRC) {
26770 RXPRINTK("%s: AAL5 CRC error.\n", card->name);
26771 recycle_rx_pool_skb(card, rpp);
26772- atomic_inc(&vcc->stats->rx_err);
26773+ atomic_inc_unchecked(&vcc->stats->rx_err);
26774 return;
26775 }
26776 if (skb_queue_len(&rpp->queue) > 1) {
26777@@ -1151,7 +1151,7 @@ dequeue_rx(struct idt77252_dev *card, st
26778 RXPRINTK("%s: Can't alloc RX skb.\n",
26779 card->name);
26780 recycle_rx_pool_skb(card, rpp);
26781- atomic_inc(&vcc->stats->rx_err);
26782+ atomic_inc_unchecked(&vcc->stats->rx_err);
26783 return;
26784 }
26785 if (!atm_charge(vcc, skb->truesize)) {
26786@@ -1170,7 +1170,7 @@ dequeue_rx(struct idt77252_dev *card, st
26787 __net_timestamp(skb);
26788
26789 vcc->push(vcc, skb);
26790- atomic_inc(&vcc->stats->rx);
26791+ atomic_inc_unchecked(&vcc->stats->rx);
26792
26793 return;
26794 }
26795@@ -1192,7 +1192,7 @@ dequeue_rx(struct idt77252_dev *card, st
26796 __net_timestamp(skb);
26797
26798 vcc->push(vcc, skb);
26799- atomic_inc(&vcc->stats->rx);
26800+ atomic_inc_unchecked(&vcc->stats->rx);
26801
26802 if (skb->truesize > SAR_FB_SIZE_3)
26803 add_rx_skb(card, 3, SAR_FB_SIZE_3, 1);
26804@@ -1304,14 +1304,14 @@ idt77252_rx_raw(struct idt77252_dev *car
26805 if (vcc->qos.aal != ATM_AAL0) {
26806 RPRINTK("%s: raw cell for non AAL0 vc %u.%u\n",
26807 card->name, vpi, vci);
26808- atomic_inc(&vcc->stats->rx_drop);
26809+ atomic_inc_unchecked(&vcc->stats->rx_drop);
26810 goto drop;
26811 }
26812
26813 if ((sb = dev_alloc_skb(64)) == NULL) {
26814 printk("%s: Can't allocate buffers for AAL0.\n",
26815 card->name);
26816- atomic_inc(&vcc->stats->rx_err);
26817+ atomic_inc_unchecked(&vcc->stats->rx_err);
26818 goto drop;
26819 }
26820
26821@@ -1330,7 +1330,7 @@ idt77252_rx_raw(struct idt77252_dev *car
26822 ATM_SKB(sb)->vcc = vcc;
26823 __net_timestamp(sb);
26824 vcc->push(vcc, sb);
26825- atomic_inc(&vcc->stats->rx);
26826+ atomic_inc_unchecked(&vcc->stats->rx);
26827
26828 drop:
26829 skb_pull(queue, 64);
26830@@ -1955,13 +1955,13 @@ idt77252_send_skb(struct atm_vcc *vcc, s
26831
26832 if (vc == NULL) {
26833 printk("%s: NULL connection in send().\n", card->name);
26834- atomic_inc(&vcc->stats->tx_err);
26835+ atomic_inc_unchecked(&vcc->stats->tx_err);
26836 dev_kfree_skb(skb);
26837 return -EINVAL;
26838 }
26839 if (!test_bit(VCF_TX, &vc->flags)) {
26840 printk("%s: Trying to transmit on a non-tx VC.\n", card->name);
26841- atomic_inc(&vcc->stats->tx_err);
26842+ atomic_inc_unchecked(&vcc->stats->tx_err);
26843 dev_kfree_skb(skb);
26844 return -EINVAL;
26845 }
26846@@ -1973,14 +1973,14 @@ idt77252_send_skb(struct atm_vcc *vcc, s
26847 break;
26848 default:
26849 printk("%s: Unsupported AAL: %d\n", card->name, vcc->qos.aal);
26850- atomic_inc(&vcc->stats->tx_err);
26851+ atomic_inc_unchecked(&vcc->stats->tx_err);
26852 dev_kfree_skb(skb);
26853 return -EINVAL;
26854 }
26855
26856 if (skb_shinfo(skb)->nr_frags != 0) {
26857 printk("%s: No scatter-gather yet.\n", card->name);
26858- atomic_inc(&vcc->stats->tx_err);
26859+ atomic_inc_unchecked(&vcc->stats->tx_err);
26860 dev_kfree_skb(skb);
26861 return -EINVAL;
26862 }
26863@@ -1988,7 +1988,7 @@ idt77252_send_skb(struct atm_vcc *vcc, s
26864
26865 err = queue_skb(card, vc, skb, oam);
26866 if (err) {
26867- atomic_inc(&vcc->stats->tx_err);
26868+ atomic_inc_unchecked(&vcc->stats->tx_err);
26869 dev_kfree_skb(skb);
26870 return err;
26871 }
26872@@ -2011,7 +2011,7 @@ idt77252_send_oam(struct atm_vcc *vcc, v
26873 skb = dev_alloc_skb(64);
26874 if (!skb) {
26875 printk("%s: Out of memory in send_oam().\n", card->name);
26876- atomic_inc(&vcc->stats->tx_err);
26877+ atomic_inc_unchecked(&vcc->stats->tx_err);
26878 return -ENOMEM;
26879 }
26880 atomic_add(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc);
26881diff -urNp linux-2.6.39/drivers/atm/iphase.c linux-2.6.39/drivers/atm/iphase.c
26882--- linux-2.6.39/drivers/atm/iphase.c 2011-05-19 00:06:34.000000000 -0400
26883+++ linux-2.6.39/drivers/atm/iphase.c 2011-05-22 19:36:31.000000000 -0400
26884@@ -1124,7 +1124,7 @@ static int rx_pkt(struct atm_dev *dev)
26885 status = (u_short) (buf_desc_ptr->desc_mode);
26886 if (status & (RX_CER | RX_PTE | RX_OFL))
26887 {
26888- atomic_inc(&vcc->stats->rx_err);
26889+ atomic_inc_unchecked(&vcc->stats->rx_err);
26890 IF_ERR(printk("IA: bad packet, dropping it");)
26891 if (status & RX_CER) {
26892 IF_ERR(printk(" cause: packet CRC error\n");)
26893@@ -1147,7 +1147,7 @@ static int rx_pkt(struct atm_dev *dev)
26894 len = dma_addr - buf_addr;
26895 if (len > iadev->rx_buf_sz) {
26896 printk("Over %d bytes sdu received, dropped!!!\n", iadev->rx_buf_sz);
26897- atomic_inc(&vcc->stats->rx_err);
26898+ atomic_inc_unchecked(&vcc->stats->rx_err);
26899 goto out_free_desc;
26900 }
26901
26902@@ -1297,7 +1297,7 @@ static void rx_dle_intr(struct atm_dev *
26903 ia_vcc = INPH_IA_VCC(vcc);
26904 if (ia_vcc == NULL)
26905 {
26906- atomic_inc(&vcc->stats->rx_err);
26907+ atomic_inc_unchecked(&vcc->stats->rx_err);
26908 dev_kfree_skb_any(skb);
26909 atm_return(vcc, atm_guess_pdu2truesize(len));
26910 goto INCR_DLE;
26911@@ -1309,7 +1309,7 @@ static void rx_dle_intr(struct atm_dev *
26912 if ((length > iadev->rx_buf_sz) || (length >
26913 (skb->len - sizeof(struct cpcs_trailer))))
26914 {
26915- atomic_inc(&vcc->stats->rx_err);
26916+ atomic_inc_unchecked(&vcc->stats->rx_err);
26917 IF_ERR(printk("rx_dle_intr: Bad AAL5 trailer %d (skb len %d)",
26918 length, skb->len);)
26919 dev_kfree_skb_any(skb);
26920@@ -1325,7 +1325,7 @@ static void rx_dle_intr(struct atm_dev *
26921
26922 IF_RX(printk("rx_dle_intr: skb push");)
26923 vcc->push(vcc,skb);
26924- atomic_inc(&vcc->stats->rx);
26925+ atomic_inc_unchecked(&vcc->stats->rx);
26926 iadev->rx_pkt_cnt++;
26927 }
26928 INCR_DLE:
26929@@ -2807,15 +2807,15 @@ static int ia_ioctl(struct atm_dev *dev,
26930 {
26931 struct k_sonet_stats *stats;
26932 stats = &PRIV(_ia_dev[board])->sonet_stats;
26933- printk("section_bip: %d\n", atomic_read(&stats->section_bip));
26934- printk("line_bip : %d\n", atomic_read(&stats->line_bip));
26935- printk("path_bip : %d\n", atomic_read(&stats->path_bip));
26936- printk("line_febe : %d\n", atomic_read(&stats->line_febe));
26937- printk("path_febe : %d\n", atomic_read(&stats->path_febe));
26938- printk("corr_hcs : %d\n", atomic_read(&stats->corr_hcs));
26939- printk("uncorr_hcs : %d\n", atomic_read(&stats->uncorr_hcs));
26940- printk("tx_cells : %d\n", atomic_read(&stats->tx_cells));
26941- printk("rx_cells : %d\n", atomic_read(&stats->rx_cells));
26942+ printk("section_bip: %d\n", atomic_read_unchecked(&stats->section_bip));
26943+ printk("line_bip : %d\n", atomic_read_unchecked(&stats->line_bip));
26944+ printk("path_bip : %d\n", atomic_read_unchecked(&stats->path_bip));
26945+ printk("line_febe : %d\n", atomic_read_unchecked(&stats->line_febe));
26946+ printk("path_febe : %d\n", atomic_read_unchecked(&stats->path_febe));
26947+ printk("corr_hcs : %d\n", atomic_read_unchecked(&stats->corr_hcs));
26948+ printk("uncorr_hcs : %d\n", atomic_read_unchecked(&stats->uncorr_hcs));
26949+ printk("tx_cells : %d\n", atomic_read_unchecked(&stats->tx_cells));
26950+ printk("rx_cells : %d\n", atomic_read_unchecked(&stats->rx_cells));
26951 }
26952 ia_cmds.status = 0;
26953 break;
26954@@ -2920,7 +2920,7 @@ static int ia_pkt_tx (struct atm_vcc *vc
26955 if ((desc == 0) || (desc > iadev->num_tx_desc))
26956 {
26957 IF_ERR(printk(DEV_LABEL "invalid desc for send: %d\n", desc);)
26958- atomic_inc(&vcc->stats->tx);
26959+ atomic_inc_unchecked(&vcc->stats->tx);
26960 if (vcc->pop)
26961 vcc->pop(vcc, skb);
26962 else
26963@@ -3025,14 +3025,14 @@ static int ia_pkt_tx (struct atm_vcc *vc
26964 ATM_DESC(skb) = vcc->vci;
26965 skb_queue_tail(&iadev->tx_dma_q, skb);
26966
26967- atomic_inc(&vcc->stats->tx);
26968+ atomic_inc_unchecked(&vcc->stats->tx);
26969 iadev->tx_pkt_cnt++;
26970 /* Increment transaction counter */
26971 writel(2, iadev->dma+IPHASE5575_TX_COUNTER);
26972
26973 #if 0
26974 /* add flow control logic */
26975- if (atomic_read(&vcc->stats->tx) % 20 == 0) {
26976+ if (atomic_read_unchecked(&vcc->stats->tx) % 20 == 0) {
26977 if (iavcc->vc_desc_cnt > 10) {
26978 vcc->tx_quota = vcc->tx_quota * 3 / 4;
26979 printk("Tx1: vcc->tx_quota = %d \n", (u32)vcc->tx_quota );
26980diff -urNp linux-2.6.39/drivers/atm/lanai.c linux-2.6.39/drivers/atm/lanai.c
26981--- linux-2.6.39/drivers/atm/lanai.c 2011-05-19 00:06:34.000000000 -0400
26982+++ linux-2.6.39/drivers/atm/lanai.c 2011-05-22 19:36:31.000000000 -0400
26983@@ -1303,7 +1303,7 @@ static void lanai_send_one_aal5(struct l
26984 vcc_tx_add_aal5_trailer(lvcc, skb->len, 0, 0);
26985 lanai_endtx(lanai, lvcc);
26986 lanai_free_skb(lvcc->tx.atmvcc, skb);
26987- atomic_inc(&lvcc->tx.atmvcc->stats->tx);
26988+ atomic_inc_unchecked(&lvcc->tx.atmvcc->stats->tx);
26989 }
26990
26991 /* Try to fill the buffer - don't call unless there is backlog */
26992@@ -1426,7 +1426,7 @@ static void vcc_rx_aal5(struct lanai_vcc
26993 ATM_SKB(skb)->vcc = lvcc->rx.atmvcc;
26994 __net_timestamp(skb);
26995 lvcc->rx.atmvcc->push(lvcc->rx.atmvcc, skb);
26996- atomic_inc(&lvcc->rx.atmvcc->stats->rx);
26997+ atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx);
26998 out:
26999 lvcc->rx.buf.ptr = end;
27000 cardvcc_write(lvcc, endptr, vcc_rxreadptr);
27001@@ -1668,7 +1668,7 @@ static int handle_service(struct lanai_d
27002 DPRINTK("(itf %d) got RX service entry 0x%X for non-AAL5 "
27003 "vcc %d\n", lanai->number, (unsigned int) s, vci);
27004 lanai->stats.service_rxnotaal5++;
27005- atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
27006+ atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
27007 return 0;
27008 }
27009 if (likely(!(s & (SERVICE_TRASH | SERVICE_STREAM | SERVICE_CRCERR)))) {
27010@@ -1680,7 +1680,7 @@ static int handle_service(struct lanai_d
27011 int bytes;
27012 read_unlock(&vcc_sklist_lock);
27013 DPRINTK("got trashed rx pdu on vci %d\n", vci);
27014- atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
27015+ atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
27016 lvcc->stats.x.aal5.service_trash++;
27017 bytes = (SERVICE_GET_END(s) * 16) -
27018 (((unsigned long) lvcc->rx.buf.ptr) -
27019@@ -1692,7 +1692,7 @@ static int handle_service(struct lanai_d
27020 }
27021 if (s & SERVICE_STREAM) {
27022 read_unlock(&vcc_sklist_lock);
27023- atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
27024+ atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
27025 lvcc->stats.x.aal5.service_stream++;
27026 printk(KERN_ERR DEV_LABEL "(itf %d): Got AAL5 stream "
27027 "PDU on VCI %d!\n", lanai->number, vci);
27028@@ -1700,7 +1700,7 @@ static int handle_service(struct lanai_d
27029 return 0;
27030 }
27031 DPRINTK("got rx crc error on vci %d\n", vci);
27032- atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
27033+ atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
27034 lvcc->stats.x.aal5.service_rxcrc++;
27035 lvcc->rx.buf.ptr = &lvcc->rx.buf.start[SERVICE_GET_END(s) * 4];
27036 cardvcc_write(lvcc, SERVICE_GET_END(s), vcc_rxreadptr);
27037diff -urNp linux-2.6.39/drivers/atm/nicstar.c linux-2.6.39/drivers/atm/nicstar.c
27038--- linux-2.6.39/drivers/atm/nicstar.c 2011-05-19 00:06:34.000000000 -0400
27039+++ linux-2.6.39/drivers/atm/nicstar.c 2011-05-22 19:36:31.000000000 -0400
27040@@ -1654,7 +1654,7 @@ static int ns_send(struct atm_vcc *vcc,
27041 if ((vc = (vc_map *) vcc->dev_data) == NULL) {
27042 printk("nicstar%d: vcc->dev_data == NULL on ns_send().\n",
27043 card->index);
27044- atomic_inc(&vcc->stats->tx_err);
27045+ atomic_inc_unchecked(&vcc->stats->tx_err);
27046 dev_kfree_skb_any(skb);
27047 return -EINVAL;
27048 }
27049@@ -1662,7 +1662,7 @@ static int ns_send(struct atm_vcc *vcc,
27050 if (!vc->tx) {
27051 printk("nicstar%d: Trying to transmit on a non-tx VC.\n",
27052 card->index);
27053- atomic_inc(&vcc->stats->tx_err);
27054+ atomic_inc_unchecked(&vcc->stats->tx_err);
27055 dev_kfree_skb_any(skb);
27056 return -EINVAL;
27057 }
27058@@ -1670,14 +1670,14 @@ static int ns_send(struct atm_vcc *vcc,
27059 if (vcc->qos.aal != ATM_AAL5 && vcc->qos.aal != ATM_AAL0) {
27060 printk("nicstar%d: Only AAL0 and AAL5 are supported.\n",
27061 card->index);
27062- atomic_inc(&vcc->stats->tx_err);
27063+ atomic_inc_unchecked(&vcc->stats->tx_err);
27064 dev_kfree_skb_any(skb);
27065 return -EINVAL;
27066 }
27067
27068 if (skb_shinfo(skb)->nr_frags != 0) {
27069 printk("nicstar%d: No scatter-gather yet.\n", card->index);
27070- atomic_inc(&vcc->stats->tx_err);
27071+ atomic_inc_unchecked(&vcc->stats->tx_err);
27072 dev_kfree_skb_any(skb);
27073 return -EINVAL;
27074 }
27075@@ -1725,11 +1725,11 @@ static int ns_send(struct atm_vcc *vcc,
27076 }
27077
27078 if (push_scqe(card, vc, scq, &scqe, skb) != 0) {
27079- atomic_inc(&vcc->stats->tx_err);
27080+ atomic_inc_unchecked(&vcc->stats->tx_err);
27081 dev_kfree_skb_any(skb);
27082 return -EIO;
27083 }
27084- atomic_inc(&vcc->stats->tx);
27085+ atomic_inc_unchecked(&vcc->stats->tx);
27086
27087 return 0;
27088 }
27089@@ -2046,14 +2046,14 @@ static void dequeue_rx(ns_dev * card, ns
27090 printk
27091 ("nicstar%d: Can't allocate buffers for aal0.\n",
27092 card->index);
27093- atomic_add(i, &vcc->stats->rx_drop);
27094+ atomic_add_unchecked(i, &vcc->stats->rx_drop);
27095 break;
27096 }
27097 if (!atm_charge(vcc, sb->truesize)) {
27098 RXPRINTK
27099 ("nicstar%d: atm_charge() dropped aal0 packets.\n",
27100 card->index);
27101- atomic_add(i - 1, &vcc->stats->rx_drop); /* already increased by 1 */
27102+ atomic_add_unchecked(i - 1, &vcc->stats->rx_drop); /* already increased by 1 */
27103 dev_kfree_skb_any(sb);
27104 break;
27105 }
27106@@ -2068,7 +2068,7 @@ static void dequeue_rx(ns_dev * card, ns
27107 ATM_SKB(sb)->vcc = vcc;
27108 __net_timestamp(sb);
27109 vcc->push(vcc, sb);
27110- atomic_inc(&vcc->stats->rx);
27111+ atomic_inc_unchecked(&vcc->stats->rx);
27112 cell += ATM_CELL_PAYLOAD;
27113 }
27114
27115@@ -2085,7 +2085,7 @@ static void dequeue_rx(ns_dev * card, ns
27116 if (iovb == NULL) {
27117 printk("nicstar%d: Out of iovec buffers.\n",
27118 card->index);
27119- atomic_inc(&vcc->stats->rx_drop);
27120+ atomic_inc_unchecked(&vcc->stats->rx_drop);
27121 recycle_rx_buf(card, skb);
27122 return;
27123 }
27124@@ -2109,7 +2109,7 @@ static void dequeue_rx(ns_dev * card, ns
27125 small or large buffer itself. */
27126 } else if (NS_PRV_IOVCNT(iovb) >= NS_MAX_IOVECS) {
27127 printk("nicstar%d: received too big AAL5 SDU.\n", card->index);
27128- atomic_inc(&vcc->stats->rx_err);
27129+ atomic_inc_unchecked(&vcc->stats->rx_err);
27130 recycle_iovec_rx_bufs(card, (struct iovec *)iovb->data,
27131 NS_MAX_IOVECS);
27132 NS_PRV_IOVCNT(iovb) = 0;
27133@@ -2129,7 +2129,7 @@ static void dequeue_rx(ns_dev * card, ns
27134 ("nicstar%d: Expected a small buffer, and this is not one.\n",
27135 card->index);
27136 which_list(card, skb);
27137- atomic_inc(&vcc->stats->rx_err);
27138+ atomic_inc_unchecked(&vcc->stats->rx_err);
27139 recycle_rx_buf(card, skb);
27140 vc->rx_iov = NULL;
27141 recycle_iov_buf(card, iovb);
27142@@ -2142,7 +2142,7 @@ static void dequeue_rx(ns_dev * card, ns
27143 ("nicstar%d: Expected a large buffer, and this is not one.\n",
27144 card->index);
27145 which_list(card, skb);
27146- atomic_inc(&vcc->stats->rx_err);
27147+ atomic_inc_unchecked(&vcc->stats->rx_err);
27148 recycle_iovec_rx_bufs(card, (struct iovec *)iovb->data,
27149 NS_PRV_IOVCNT(iovb));
27150 vc->rx_iov = NULL;
27151@@ -2165,7 +2165,7 @@ static void dequeue_rx(ns_dev * card, ns
27152 printk(" - PDU size mismatch.\n");
27153 else
27154 printk(".\n");
27155- atomic_inc(&vcc->stats->rx_err);
27156+ atomic_inc_unchecked(&vcc->stats->rx_err);
27157 recycle_iovec_rx_bufs(card, (struct iovec *)iovb->data,
27158 NS_PRV_IOVCNT(iovb));
27159 vc->rx_iov = NULL;
27160@@ -2179,7 +2179,7 @@ static void dequeue_rx(ns_dev * card, ns
27161 /* skb points to a small buffer */
27162 if (!atm_charge(vcc, skb->truesize)) {
27163 push_rxbufs(card, skb);
27164- atomic_inc(&vcc->stats->rx_drop);
27165+ atomic_inc_unchecked(&vcc->stats->rx_drop);
27166 } else {
27167 skb_put(skb, len);
27168 dequeue_sm_buf(card, skb);
27169@@ -2189,7 +2189,7 @@ static void dequeue_rx(ns_dev * card, ns
27170 ATM_SKB(skb)->vcc = vcc;
27171 __net_timestamp(skb);
27172 vcc->push(vcc, skb);
27173- atomic_inc(&vcc->stats->rx);
27174+ atomic_inc_unchecked(&vcc->stats->rx);
27175 }
27176 } else if (NS_PRV_IOVCNT(iovb) == 2) { /* One small plus one large buffer */
27177 struct sk_buff *sb;
27178@@ -2200,7 +2200,7 @@ static void dequeue_rx(ns_dev * card, ns
27179 if (len <= NS_SMBUFSIZE) {
27180 if (!atm_charge(vcc, sb->truesize)) {
27181 push_rxbufs(card, sb);
27182- atomic_inc(&vcc->stats->rx_drop);
27183+ atomic_inc_unchecked(&vcc->stats->rx_drop);
27184 } else {
27185 skb_put(sb, len);
27186 dequeue_sm_buf(card, sb);
27187@@ -2210,7 +2210,7 @@ static void dequeue_rx(ns_dev * card, ns
27188 ATM_SKB(sb)->vcc = vcc;
27189 __net_timestamp(sb);
27190 vcc->push(vcc, sb);
27191- atomic_inc(&vcc->stats->rx);
27192+ atomic_inc_unchecked(&vcc->stats->rx);
27193 }
27194
27195 push_rxbufs(card, skb);
27196@@ -2219,7 +2219,7 @@ static void dequeue_rx(ns_dev * card, ns
27197
27198 if (!atm_charge(vcc, skb->truesize)) {
27199 push_rxbufs(card, skb);
27200- atomic_inc(&vcc->stats->rx_drop);
27201+ atomic_inc_unchecked(&vcc->stats->rx_drop);
27202 } else {
27203 dequeue_lg_buf(card, skb);
27204 #ifdef NS_USE_DESTRUCTORS
27205@@ -2232,7 +2232,7 @@ static void dequeue_rx(ns_dev * card, ns
27206 ATM_SKB(skb)->vcc = vcc;
27207 __net_timestamp(skb);
27208 vcc->push(vcc, skb);
27209- atomic_inc(&vcc->stats->rx);
27210+ atomic_inc_unchecked(&vcc->stats->rx);
27211 }
27212
27213 push_rxbufs(card, sb);
27214@@ -2253,7 +2253,7 @@ static void dequeue_rx(ns_dev * card, ns
27215 printk
27216 ("nicstar%d: Out of huge buffers.\n",
27217 card->index);
27218- atomic_inc(&vcc->stats->rx_drop);
27219+ atomic_inc_unchecked(&vcc->stats->rx_drop);
27220 recycle_iovec_rx_bufs(card,
27221 (struct iovec *)
27222 iovb->data,
27223@@ -2304,7 +2304,7 @@ static void dequeue_rx(ns_dev * card, ns
27224 card->hbpool.count++;
27225 } else
27226 dev_kfree_skb_any(hb);
27227- atomic_inc(&vcc->stats->rx_drop);
27228+ atomic_inc_unchecked(&vcc->stats->rx_drop);
27229 } else {
27230 /* Copy the small buffer to the huge buffer */
27231 sb = (struct sk_buff *)iov->iov_base;
27232@@ -2341,7 +2341,7 @@ static void dequeue_rx(ns_dev * card, ns
27233 #endif /* NS_USE_DESTRUCTORS */
27234 __net_timestamp(hb);
27235 vcc->push(vcc, hb);
27236- atomic_inc(&vcc->stats->rx);
27237+ atomic_inc_unchecked(&vcc->stats->rx);
27238 }
27239 }
27240
27241diff -urNp linux-2.6.39/drivers/atm/solos-pci.c linux-2.6.39/drivers/atm/solos-pci.c
27242--- linux-2.6.39/drivers/atm/solos-pci.c 2011-05-19 00:06:34.000000000 -0400
27243+++ linux-2.6.39/drivers/atm/solos-pci.c 2011-05-22 19:36:31.000000000 -0400
27244@@ -715,7 +715,7 @@ void solos_bh(unsigned long card_arg)
27245 }
27246 atm_charge(vcc, skb->truesize);
27247 vcc->push(vcc, skb);
27248- atomic_inc(&vcc->stats->rx);
27249+ atomic_inc_unchecked(&vcc->stats->rx);
27250 break;
27251
27252 case PKT_STATUS:
27253@@ -900,6 +900,8 @@ static int print_buffer(struct sk_buff *
27254 char msg[500];
27255 char item[10];
27256
27257+ pax_track_stack();
27258+
27259 len = buf->len;
27260 for (i = 0; i < len; i++){
27261 if(i % 8 == 0)
27262@@ -1009,7 +1011,7 @@ static uint32_t fpga_tx(struct solos_car
27263 vcc = SKB_CB(oldskb)->vcc;
27264
27265 if (vcc) {
27266- atomic_inc(&vcc->stats->tx);
27267+ atomic_inc_unchecked(&vcc->stats->tx);
27268 solos_pop(vcc, oldskb);
27269 } else
27270 dev_kfree_skb_irq(oldskb);
27271diff -urNp linux-2.6.39/drivers/atm/suni.c linux-2.6.39/drivers/atm/suni.c
27272--- linux-2.6.39/drivers/atm/suni.c 2011-05-19 00:06:34.000000000 -0400
27273+++ linux-2.6.39/drivers/atm/suni.c 2011-05-22 19:36:31.000000000 -0400
27274@@ -50,8 +50,8 @@ static DEFINE_SPINLOCK(sunis_lock);
27275
27276
27277 #define ADD_LIMITED(s,v) \
27278- atomic_add((v),&stats->s); \
27279- if (atomic_read(&stats->s) < 0) atomic_set(&stats->s,INT_MAX);
27280+ atomic_add_unchecked((v),&stats->s); \
27281+ if (atomic_read_unchecked(&stats->s) < 0) atomic_set_unchecked(&stats->s,INT_MAX);
27282
27283
27284 static void suni_hz(unsigned long from_timer)
27285diff -urNp linux-2.6.39/drivers/atm/uPD98402.c linux-2.6.39/drivers/atm/uPD98402.c
27286--- linux-2.6.39/drivers/atm/uPD98402.c 2011-05-19 00:06:34.000000000 -0400
27287+++ linux-2.6.39/drivers/atm/uPD98402.c 2011-05-22 19:36:31.000000000 -0400
27288@@ -42,7 +42,7 @@ static int fetch_stats(struct atm_dev *d
27289 struct sonet_stats tmp;
27290 int error = 0;
27291
27292- atomic_add(GET(HECCT),&PRIV(dev)->sonet_stats.uncorr_hcs);
27293+ atomic_add_unchecked(GET(HECCT),&PRIV(dev)->sonet_stats.uncorr_hcs);
27294 sonet_copy_stats(&PRIV(dev)->sonet_stats,&tmp);
27295 if (arg) error = copy_to_user(arg,&tmp,sizeof(tmp));
27296 if (zero && !error) {
27297@@ -161,9 +161,9 @@ static int uPD98402_ioctl(struct atm_dev
27298
27299
27300 #define ADD_LIMITED(s,v) \
27301- { atomic_add(GET(v),&PRIV(dev)->sonet_stats.s); \
27302- if (atomic_read(&PRIV(dev)->sonet_stats.s) < 0) \
27303- atomic_set(&PRIV(dev)->sonet_stats.s,INT_MAX); }
27304+ { atomic_add_unchecked(GET(v),&PRIV(dev)->sonet_stats.s); \
27305+ if (atomic_read_unchecked(&PRIV(dev)->sonet_stats.s) < 0) \
27306+ atomic_set_unchecked(&PRIV(dev)->sonet_stats.s,INT_MAX); }
27307
27308
27309 static void stat_event(struct atm_dev *dev)
27310@@ -194,7 +194,7 @@ static void uPD98402_int(struct atm_dev
27311 if (reason & uPD98402_INT_PFM) stat_event(dev);
27312 if (reason & uPD98402_INT_PCO) {
27313 (void) GET(PCOCR); /* clear interrupt cause */
27314- atomic_add(GET(HECCT),
27315+ atomic_add_unchecked(GET(HECCT),
27316 &PRIV(dev)->sonet_stats.uncorr_hcs);
27317 }
27318 if ((reason & uPD98402_INT_RFO) &&
27319@@ -222,9 +222,9 @@ static int uPD98402_start(struct atm_dev
27320 PUT(~(uPD98402_INT_PFM | uPD98402_INT_ALM | uPD98402_INT_RFO |
27321 uPD98402_INT_LOS),PIMR); /* enable them */
27322 (void) fetch_stats(dev,NULL,1); /* clear kernel counters */
27323- atomic_set(&PRIV(dev)->sonet_stats.corr_hcs,-1);
27324- atomic_set(&PRIV(dev)->sonet_stats.tx_cells,-1);
27325- atomic_set(&PRIV(dev)->sonet_stats.rx_cells,-1);
27326+ atomic_set_unchecked(&PRIV(dev)->sonet_stats.corr_hcs,-1);
27327+ atomic_set_unchecked(&PRIV(dev)->sonet_stats.tx_cells,-1);
27328+ atomic_set_unchecked(&PRIV(dev)->sonet_stats.rx_cells,-1);
27329 return 0;
27330 }
27331
27332diff -urNp linux-2.6.39/drivers/atm/zatm.c linux-2.6.39/drivers/atm/zatm.c
27333--- linux-2.6.39/drivers/atm/zatm.c 2011-05-19 00:06:34.000000000 -0400
27334+++ linux-2.6.39/drivers/atm/zatm.c 2011-05-22 19:36:31.000000000 -0400
27335@@ -459,7 +459,7 @@ printk("dummy: 0x%08lx, 0x%08lx\n",dummy
27336 }
27337 if (!size) {
27338 dev_kfree_skb_irq(skb);
27339- if (vcc) atomic_inc(&vcc->stats->rx_err);
27340+ if (vcc) atomic_inc_unchecked(&vcc->stats->rx_err);
27341 continue;
27342 }
27343 if (!atm_charge(vcc,skb->truesize)) {
27344@@ -469,7 +469,7 @@ printk("dummy: 0x%08lx, 0x%08lx\n",dummy
27345 skb->len = size;
27346 ATM_SKB(skb)->vcc = vcc;
27347 vcc->push(vcc,skb);
27348- atomic_inc(&vcc->stats->rx);
27349+ atomic_inc_unchecked(&vcc->stats->rx);
27350 }
27351 zout(pos & 0xffff,MTA(mbx));
27352 #if 0 /* probably a stupid idea */
27353@@ -733,7 +733,7 @@ if (*ZATM_PRV_DSC(skb) != (uPD98401_TXPD
27354 skb_queue_head(&zatm_vcc->backlog,skb);
27355 break;
27356 }
27357- atomic_inc(&vcc->stats->tx);
27358+ atomic_inc_unchecked(&vcc->stats->tx);
27359 wake_up(&zatm_vcc->tx_wait);
27360 }
27361
27362diff -urNp linux-2.6.39/drivers/base/iommu.c linux-2.6.39/drivers/base/iommu.c
27363--- linux-2.6.39/drivers/base/iommu.c 2011-05-19 00:06:34.000000000 -0400
27364+++ linux-2.6.39/drivers/base/iommu.c 2011-05-22 19:36:31.000000000 -0400
27365@@ -23,9 +23,8 @@
27366 #include <linux/errno.h>
27367 #include <linux/iommu.h>
27368
27369-static struct iommu_ops *iommu_ops;
27370-
27371-void register_iommu(struct iommu_ops *ops)
27372+static const struct iommu_ops *iommu_ops;
27373+void register_iommu(const struct iommu_ops *ops)
27374 {
27375 if (iommu_ops)
27376 BUG();
27377diff -urNp linux-2.6.39/drivers/base/power/generic_ops.c linux-2.6.39/drivers/base/power/generic_ops.c
27378--- linux-2.6.39/drivers/base/power/generic_ops.c 2011-05-19 00:06:34.000000000 -0400
27379+++ linux-2.6.39/drivers/base/power/generic_ops.c 2011-05-22 19:36:31.000000000 -0400
27380@@ -215,7 +215,7 @@ int pm_generic_restore(struct device *de
27381 EXPORT_SYMBOL_GPL(pm_generic_restore);
27382 #endif /* CONFIG_PM_SLEEP */
27383
27384-struct dev_pm_ops generic_subsys_pm_ops = {
27385+const struct dev_pm_ops generic_subsys_pm_ops = {
27386 #ifdef CONFIG_PM_SLEEP
27387 .suspend = pm_generic_suspend,
27388 .resume = pm_generic_resume,
27389diff -urNp linux-2.6.39/drivers/base/power/wakeup.c linux-2.6.39/drivers/base/power/wakeup.c
27390--- linux-2.6.39/drivers/base/power/wakeup.c 2011-05-19 00:06:34.000000000 -0400
27391+++ linux-2.6.39/drivers/base/power/wakeup.c 2011-05-22 19:36:31.000000000 -0400
27392@@ -29,14 +29,14 @@ bool events_check_enabled;
27393 * They need to be modified together atomically, so it's better to use one
27394 * atomic variable to hold them both.
27395 */
27396-static atomic_t combined_event_count = ATOMIC_INIT(0);
27397+static atomic_unchecked_t combined_event_count = ATOMIC_INIT(0);
27398
27399 #define IN_PROGRESS_BITS (sizeof(int) * 4)
27400 #define MAX_IN_PROGRESS ((1 << IN_PROGRESS_BITS) - 1)
27401
27402 static void split_counters(unsigned int *cnt, unsigned int *inpr)
27403 {
27404- unsigned int comb = atomic_read(&combined_event_count);
27405+ unsigned int comb = atomic_read_unchecked(&combined_event_count);
27406
27407 *cnt = (comb >> IN_PROGRESS_BITS);
27408 *inpr = comb & MAX_IN_PROGRESS;
27409@@ -351,7 +351,7 @@ static void wakeup_source_activate(struc
27410 ws->last_time = ktime_get();
27411
27412 /* Increment the counter of events in progress. */
27413- atomic_inc(&combined_event_count);
27414+ atomic_inc_unchecked(&combined_event_count);
27415 }
27416
27417 /**
27418@@ -441,7 +441,7 @@ static void wakeup_source_deactivate(str
27419 * Increment the counter of registered wakeup events and decrement the
27420 * couter of wakeup events in progress simultaneously.
27421 */
27422- atomic_add(MAX_IN_PROGRESS, &combined_event_count);
27423+ atomic_add_unchecked(MAX_IN_PROGRESS, &combined_event_count);
27424 }
27425
27426 /**
27427diff -urNp linux-2.6.39/drivers/block/cciss.c linux-2.6.39/drivers/block/cciss.c
27428--- linux-2.6.39/drivers/block/cciss.c 2011-05-19 00:06:34.000000000 -0400
27429+++ linux-2.6.39/drivers/block/cciss.c 2011-05-22 19:41:32.000000000 -0400
27430@@ -103,7 +103,7 @@ MODULE_DEVICE_TABLE(pci, cciss_pci_devic
27431 * product = Marketing Name for the board
27432 * access = Address of the struct of function pointers
27433 */
27434-static struct board_type products[] = {
27435+static const struct board_type products[] = {
27436 {0x40700E11, "Smart Array 5300", &SA5_access},
27437 {0x40800E11, "Smart Array 5i", &SA5B_access},
27438 {0x40820E11, "Smart Array 532", &SA5B_access},
27439@@ -1151,6 +1151,8 @@ static int cciss_ioctl32_passthru(struct
27440 int err;
27441 u32 cp;
27442
27443+ memset(&arg64, 0, sizeof(arg64));
27444+
27445 err = 0;
27446 err |=
27447 copy_from_user(&arg64.LUN_info, &arg32->LUN_info,
27448diff -urNp linux-2.6.39/drivers/block/cciss.h linux-2.6.39/drivers/block/cciss.h
27449--- linux-2.6.39/drivers/block/cciss.h 2011-05-19 00:06:34.000000000 -0400
27450+++ linux-2.6.39/drivers/block/cciss.h 2011-05-22 19:36:31.000000000 -0400
27451@@ -393,7 +393,7 @@ static bool SA5_performant_intr_pending(
27452 return register_value & SA5_OUTDB_STATUS_PERF_BIT;
27453 }
27454
27455-static struct access_method SA5_access = {
27456+static const struct access_method SA5_access = {
27457 SA5_submit_command,
27458 SA5_intr_mask,
27459 SA5_fifo_full,
27460@@ -401,7 +401,7 @@ static struct access_method SA5_access =
27461 SA5_completed,
27462 };
27463
27464-static struct access_method SA5B_access = {
27465+static const struct access_method SA5B_access = {
27466 SA5_submit_command,
27467 SA5B_intr_mask,
27468 SA5_fifo_full,
27469@@ -409,7 +409,7 @@ static struct access_method SA5B_access
27470 SA5_completed,
27471 };
27472
27473-static struct access_method SA5_performant_access = {
27474+static const struct access_method SA5_performant_access = {
27475 SA5_submit_command,
27476 SA5_performant_intr_mask,
27477 SA5_fifo_full,
27478@@ -420,7 +420,7 @@ static struct access_method SA5_performa
27479 struct board_type {
27480 __u32 board_id;
27481 char *product_name;
27482- struct access_method *access;
27483+ const struct access_method *access;
27484 int nr_cmds; /* Max cmds this kind of ctlr can handle. */
27485 };
27486
27487diff -urNp linux-2.6.39/drivers/block/cpqarray.c linux-2.6.39/drivers/block/cpqarray.c
27488--- linux-2.6.39/drivers/block/cpqarray.c 2011-05-19 00:06:34.000000000 -0400
27489+++ linux-2.6.39/drivers/block/cpqarray.c 2011-05-22 19:36:31.000000000 -0400
27490@@ -80,7 +80,7 @@ static int eisa[8];
27491 * product = Marketing Name for the board
27492 * access = Address of the struct of function pointers
27493 */
27494-static struct board_type products[] = {
27495+static const struct board_type products[] = {
27496 { 0x0040110E, "IDA", &smart1_access },
27497 { 0x0140110E, "IDA-2", &smart1_access },
27498 { 0x1040110E, "IAES", &smart1_access },
27499@@ -911,6 +911,8 @@ static void do_ida_request(struct reques
27500 struct scatterlist tmp_sg[SG_MAX];
27501 int i, dir, seg;
27502
27503+ pax_track_stack();
27504+
27505 queue_next:
27506 creq = blk_peek_request(q);
27507 if (!creq)
27508diff -urNp linux-2.6.39/drivers/block/cpqarray.h linux-2.6.39/drivers/block/cpqarray.h
27509--- linux-2.6.39/drivers/block/cpqarray.h 2011-05-19 00:06:34.000000000 -0400
27510+++ linux-2.6.39/drivers/block/cpqarray.h 2011-05-22 19:36:31.000000000 -0400
27511@@ -69,7 +69,7 @@ struct access_method {
27512 struct board_type {
27513 __u32 board_id;
27514 char *product_name;
27515- struct access_method *access;
27516+ const struct access_method *access;
27517 };
27518
27519 struct ctlr_info {
27520diff -urNp linux-2.6.39/drivers/block/DAC960.c linux-2.6.39/drivers/block/DAC960.c
27521--- linux-2.6.39/drivers/block/DAC960.c 2011-05-19 00:06:34.000000000 -0400
27522+++ linux-2.6.39/drivers/block/DAC960.c 2011-05-22 19:36:31.000000000 -0400
27523@@ -1980,6 +1980,8 @@ static bool DAC960_V1_ReadDeviceConfigur
27524 unsigned long flags;
27525 int Channel, TargetID;
27526
27527+ pax_track_stack();
27528+
27529 if (!init_dma_loaf(Controller->PCIDevice, &local_dma,
27530 DAC960_V1_MaxChannels*(sizeof(DAC960_V1_DCDB_T) +
27531 sizeof(DAC960_SCSI_Inquiry_T) +
27532diff -urNp linux-2.6.39/drivers/block/drbd/drbd_int.h linux-2.6.39/drivers/block/drbd/drbd_int.h
27533--- linux-2.6.39/drivers/block/drbd/drbd_int.h 2011-05-19 00:06:34.000000000 -0400
27534+++ linux-2.6.39/drivers/block/drbd/drbd_int.h 2011-05-22 19:36:31.000000000 -0400
27535@@ -736,7 +736,7 @@ struct drbd_request;
27536 struct drbd_epoch {
27537 struct list_head list;
27538 unsigned int barrier_nr;
27539- atomic_t epoch_size; /* increased on every request added. */
27540+ atomic_unchecked_t epoch_size; /* increased on every request added. */
27541 atomic_t active; /* increased on every req. added, and dec on every finished. */
27542 unsigned long flags;
27543 };
27544@@ -1108,7 +1108,7 @@ struct drbd_conf {
27545 void *int_dig_in;
27546 void *int_dig_vv;
27547 wait_queue_head_t seq_wait;
27548- atomic_t packet_seq;
27549+ atomic_unchecked_t packet_seq;
27550 unsigned int peer_seq;
27551 spinlock_t peer_seq_lock;
27552 unsigned int minor;
27553diff -urNp linux-2.6.39/drivers/block/drbd/drbd_main.c linux-2.6.39/drivers/block/drbd/drbd_main.c
27554--- linux-2.6.39/drivers/block/drbd/drbd_main.c 2011-05-19 00:06:34.000000000 -0400
27555+++ linux-2.6.39/drivers/block/drbd/drbd_main.c 2011-05-22 19:36:31.000000000 -0400
27556@@ -2387,7 +2387,7 @@ static int _drbd_send_ack(struct drbd_co
27557 p.sector = sector;
27558 p.block_id = block_id;
27559 p.blksize = blksize;
27560- p.seq_num = cpu_to_be32(atomic_add_return(1, &mdev->packet_seq));
27561+ p.seq_num = cpu_to_be32(atomic_add_return_unchecked(1, &mdev->packet_seq));
27562
27563 if (!mdev->meta.socket || mdev->state.conn < C_CONNECTED)
27564 return false;
27565@@ -2686,7 +2686,7 @@ int drbd_send_dblock(struct drbd_conf *m
27566 p.sector = cpu_to_be64(req->sector);
27567 p.block_id = (unsigned long)req;
27568 p.seq_num = cpu_to_be32(req->seq_num =
27569- atomic_add_return(1, &mdev->packet_seq));
27570+ atomic_add_return_unchecked(1, &mdev->packet_seq));
27571
27572 dp_flags = bio_flags_to_wire(mdev, req->master_bio->bi_rw);
27573
27574@@ -2971,7 +2971,7 @@ void drbd_init_set_defaults(struct drbd_
27575 atomic_set(&mdev->unacked_cnt, 0);
27576 atomic_set(&mdev->local_cnt, 0);
27577 atomic_set(&mdev->net_cnt, 0);
27578- atomic_set(&mdev->packet_seq, 0);
27579+ atomic_set_unchecked(&mdev->packet_seq, 0);
27580 atomic_set(&mdev->pp_in_use, 0);
27581 atomic_set(&mdev->pp_in_use_by_net, 0);
27582 atomic_set(&mdev->rs_sect_in, 0);
27583@@ -3051,8 +3051,8 @@ void drbd_mdev_cleanup(struct drbd_conf
27584 mdev->receiver.t_state);
27585
27586 /* no need to lock it, I'm the only thread alive */
27587- if (atomic_read(&mdev->current_epoch->epoch_size) != 0)
27588- dev_err(DEV, "epoch_size:%d\n", atomic_read(&mdev->current_epoch->epoch_size));
27589+ if (atomic_read_unchecked(&mdev->current_epoch->epoch_size) != 0)
27590+ dev_err(DEV, "epoch_size:%d\n", atomic_read_unchecked(&mdev->current_epoch->epoch_size));
27591 mdev->al_writ_cnt =
27592 mdev->bm_writ_cnt =
27593 mdev->read_cnt =
27594diff -urNp linux-2.6.39/drivers/block/drbd/drbd_nl.c linux-2.6.39/drivers/block/drbd/drbd_nl.c
27595--- linux-2.6.39/drivers/block/drbd/drbd_nl.c 2011-05-19 00:06:34.000000000 -0400
27596+++ linux-2.6.39/drivers/block/drbd/drbd_nl.c 2011-05-22 19:36:31.000000000 -0400
27597@@ -2298,7 +2298,7 @@ static void drbd_connector_callback(stru
27598 module_put(THIS_MODULE);
27599 }
27600
27601-static atomic_t drbd_nl_seq = ATOMIC_INIT(2); /* two. */
27602+static atomic_unchecked_t drbd_nl_seq = ATOMIC_INIT(2); /* two. */
27603
27604 static unsigned short *
27605 __tl_add_blob(unsigned short *tl, enum drbd_tags tag, const void *data,
27606@@ -2369,7 +2369,7 @@ void drbd_bcast_state(struct drbd_conf *
27607 cn_reply->id.idx = CN_IDX_DRBD;
27608 cn_reply->id.val = CN_VAL_DRBD;
27609
27610- cn_reply->seq = atomic_add_return(1, &drbd_nl_seq);
27611+ cn_reply->seq = atomic_add_return_unchecked(1, &drbd_nl_seq);
27612 cn_reply->ack = 0; /* not used here. */
27613 cn_reply->len = sizeof(struct drbd_nl_cfg_reply) +
27614 (int)((char *)tl - (char *)reply->tag_list);
27615@@ -2401,7 +2401,7 @@ void drbd_bcast_ev_helper(struct drbd_co
27616 cn_reply->id.idx = CN_IDX_DRBD;
27617 cn_reply->id.val = CN_VAL_DRBD;
27618
27619- cn_reply->seq = atomic_add_return(1, &drbd_nl_seq);
27620+ cn_reply->seq = atomic_add_return_unchecked(1, &drbd_nl_seq);
27621 cn_reply->ack = 0; /* not used here. */
27622 cn_reply->len = sizeof(struct drbd_nl_cfg_reply) +
27623 (int)((char *)tl - (char *)reply->tag_list);
27624@@ -2479,7 +2479,7 @@ void drbd_bcast_ee(struct drbd_conf *mde
27625 cn_reply->id.idx = CN_IDX_DRBD;
27626 cn_reply->id.val = CN_VAL_DRBD;
27627
27628- cn_reply->seq = atomic_add_return(1,&drbd_nl_seq);
27629+ cn_reply->seq = atomic_add_return_unchecked(1,&drbd_nl_seq);
27630 cn_reply->ack = 0; // not used here.
27631 cn_reply->len = sizeof(struct drbd_nl_cfg_reply) +
27632 (int)((char*)tl - (char*)reply->tag_list);
27633@@ -2518,7 +2518,7 @@ void drbd_bcast_sync_progress(struct drb
27634 cn_reply->id.idx = CN_IDX_DRBD;
27635 cn_reply->id.val = CN_VAL_DRBD;
27636
27637- cn_reply->seq = atomic_add_return(1, &drbd_nl_seq);
27638+ cn_reply->seq = atomic_add_return_unchecked(1, &drbd_nl_seq);
27639 cn_reply->ack = 0; /* not used here. */
27640 cn_reply->len = sizeof(struct drbd_nl_cfg_reply) +
27641 (int)((char *)tl - (char *)reply->tag_list);
27642diff -urNp linux-2.6.39/drivers/block/drbd/drbd_receiver.c linux-2.6.39/drivers/block/drbd/drbd_receiver.c
27643--- linux-2.6.39/drivers/block/drbd/drbd_receiver.c 2011-05-19 00:06:34.000000000 -0400
27644+++ linux-2.6.39/drivers/block/drbd/drbd_receiver.c 2011-05-22 19:36:31.000000000 -0400
27645@@ -894,7 +894,7 @@ retry:
27646 sock->sk->sk_sndtimeo = mdev->net_conf->timeout*HZ/10;
27647 sock->sk->sk_rcvtimeo = MAX_SCHEDULE_TIMEOUT;
27648
27649- atomic_set(&mdev->packet_seq, 0);
27650+ atomic_set_unchecked(&mdev->packet_seq, 0);
27651 mdev->peer_seq = 0;
27652
27653 drbd_thread_start(&mdev->asender);
27654@@ -990,7 +990,7 @@ static enum finish_epoch drbd_may_finish
27655 do {
27656 next_epoch = NULL;
27657
27658- epoch_size = atomic_read(&epoch->epoch_size);
27659+ epoch_size = atomic_read_unchecked(&epoch->epoch_size);
27660
27661 switch (ev & ~EV_CLEANUP) {
27662 case EV_PUT:
27663@@ -1025,7 +1025,7 @@ static enum finish_epoch drbd_may_finish
27664 rv = FE_DESTROYED;
27665 } else {
27666 epoch->flags = 0;
27667- atomic_set(&epoch->epoch_size, 0);
27668+ atomic_set_unchecked(&epoch->epoch_size, 0);
27669 /* atomic_set(&epoch->active, 0); is already zero */
27670 if (rv == FE_STILL_LIVE)
27671 rv = FE_RECYCLED;
27672@@ -1196,14 +1196,14 @@ static int receive_Barrier(struct drbd_c
27673 drbd_wait_ee_list_empty(mdev, &mdev->active_ee);
27674 drbd_flush(mdev);
27675
27676- if (atomic_read(&mdev->current_epoch->epoch_size)) {
27677+ if (atomic_read_unchecked(&mdev->current_epoch->epoch_size)) {
27678 epoch = kmalloc(sizeof(struct drbd_epoch), GFP_NOIO);
27679 if (epoch)
27680 break;
27681 }
27682
27683 epoch = mdev->current_epoch;
27684- wait_event(mdev->ee_wait, atomic_read(&epoch->epoch_size) == 0);
27685+ wait_event(mdev->ee_wait, atomic_read_unchecked(&epoch->epoch_size) == 0);
27686
27687 D_ASSERT(atomic_read(&epoch->active) == 0);
27688 D_ASSERT(epoch->flags == 0);
27689@@ -1215,11 +1215,11 @@ static int receive_Barrier(struct drbd_c
27690 }
27691
27692 epoch->flags = 0;
27693- atomic_set(&epoch->epoch_size, 0);
27694+ atomic_set_unchecked(&epoch->epoch_size, 0);
27695 atomic_set(&epoch->active, 0);
27696
27697 spin_lock(&mdev->epoch_lock);
27698- if (atomic_read(&mdev->current_epoch->epoch_size)) {
27699+ if (atomic_read_unchecked(&mdev->current_epoch->epoch_size)) {
27700 list_add(&epoch->list, &mdev->current_epoch->list);
27701 mdev->current_epoch = epoch;
27702 mdev->epochs++;
27703@@ -1668,7 +1668,7 @@ static int receive_Data(struct drbd_conf
27704 spin_unlock(&mdev->peer_seq_lock);
27705
27706 drbd_send_ack_dp(mdev, P_NEG_ACK, p, data_size);
27707- atomic_inc(&mdev->current_epoch->epoch_size);
27708+ atomic_inc_unchecked(&mdev->current_epoch->epoch_size);
27709 return drbd_drain_block(mdev, data_size);
27710 }
27711
27712@@ -1694,7 +1694,7 @@ static int receive_Data(struct drbd_conf
27713
27714 spin_lock(&mdev->epoch_lock);
27715 e->epoch = mdev->current_epoch;
27716- atomic_inc(&e->epoch->epoch_size);
27717+ atomic_inc_unchecked(&e->epoch->epoch_size);
27718 atomic_inc(&e->epoch->active);
27719 spin_unlock(&mdev->epoch_lock);
27720
27721@@ -3905,7 +3905,7 @@ static void drbd_disconnect(struct drbd_
27722 D_ASSERT(list_empty(&mdev->done_ee));
27723
27724 /* ok, no more ee's on the fly, it is safe to reset the epoch_size */
27725- atomic_set(&mdev->current_epoch->epoch_size, 0);
27726+ atomic_set_unchecked(&mdev->current_epoch->epoch_size, 0);
27727 D_ASSERT(list_empty(&mdev->current_epoch->list));
27728 }
27729
27730diff -urNp linux-2.6.39/drivers/block/nbd.c linux-2.6.39/drivers/block/nbd.c
27731--- linux-2.6.39/drivers/block/nbd.c 2011-05-19 00:06:34.000000000 -0400
27732+++ linux-2.6.39/drivers/block/nbd.c 2011-05-22 19:36:31.000000000 -0400
27733@@ -157,6 +157,8 @@ static int sock_xmit(struct nbd_device *
27734 struct kvec iov;
27735 sigset_t blocked, oldset;
27736
27737+ pax_track_stack();
27738+
27739 if (unlikely(!sock)) {
27740 printk(KERN_ERR "%s: Attempted %s on closed socket in sock_xmit\n",
27741 lo->disk->disk_name, (send ? "send" : "recv"));
27742@@ -571,6 +573,8 @@ static void do_nbd_request(struct reques
27743 static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *lo,
27744 unsigned int cmd, unsigned long arg)
27745 {
27746+ pax_track_stack();
27747+
27748 switch (cmd) {
27749 case NBD_DISCONNECT: {
27750 struct request sreq;
27751diff -urNp linux-2.6.39/drivers/block/smart1,2.h linux-2.6.39/drivers/block/smart1,2.h
27752--- linux-2.6.39/drivers/block/smart1,2.h 2011-05-19 00:06:34.000000000 -0400
27753+++ linux-2.6.39/drivers/block/smart1,2.h 2011-05-22 19:36:31.000000000 -0400
27754@@ -107,7 +107,7 @@ static unsigned long smart4_intr_pending
27755 return 0 ;
27756 }
27757
27758-static struct access_method smart4_access = {
27759+static const struct access_method smart4_access = {
27760 smart4_submit_command,
27761 smart4_intr_mask,
27762 smart4_fifo_full,
27763@@ -143,7 +143,7 @@ static unsigned long smart2_intr_pending
27764 return readl(h->vaddr + INTR_PENDING);
27765 }
27766
27767-static struct access_method smart2_access = {
27768+static const struct access_method smart2_access = {
27769 smart2_submit_command,
27770 smart2_intr_mask,
27771 smart2_fifo_full,
27772@@ -179,7 +179,7 @@ static unsigned long smart2e_intr_pendin
27773 return inl(h->io_mem_addr + INTR_PENDING);
27774 }
27775
27776-static struct access_method smart2e_access = {
27777+static const struct access_method smart2e_access = {
27778 smart2e_submit_command,
27779 smart2e_intr_mask,
27780 smart2e_fifo_full,
27781@@ -269,7 +269,7 @@ static unsigned long smart1_intr_pending
27782 return chan;
27783 }
27784
27785-static struct access_method smart1_access = {
27786+static const struct access_method smart1_access = {
27787 smart1_submit_command,
27788 smart1_intr_mask,
27789 smart1_fifo_full,
27790diff -urNp linux-2.6.39/drivers/block/xsysace.c linux-2.6.39/drivers/block/xsysace.c
27791--- linux-2.6.39/drivers/block/xsysace.c 2011-05-19 00:06:34.000000000 -0400
27792+++ linux-2.6.39/drivers/block/xsysace.c 2011-05-22 19:36:31.000000000 -0400
27793@@ -262,7 +262,7 @@ static void ace_dataout_8(struct ace_dev
27794 ace->data_ptr = src;
27795 }
27796
27797-static struct ace_reg_ops ace_reg_8_ops = {
27798+static const struct ace_reg_ops ace_reg_8_ops = {
27799 .in = ace_in_8,
27800 .out = ace_out_8,
27801 .datain = ace_datain_8,
27802@@ -327,14 +327,14 @@ static void ace_dataout_le16(struct ace_
27803 ace->data_ptr = src;
27804 }
27805
27806-static struct ace_reg_ops ace_reg_be16_ops = {
27807+static const struct ace_reg_ops ace_reg_be16_ops = {
27808 .in = ace_in_be16,
27809 .out = ace_out_be16,
27810 .datain = ace_datain_be16,
27811 .dataout = ace_dataout_be16,
27812 };
27813
27814-static struct ace_reg_ops ace_reg_le16_ops = {
27815+static const struct ace_reg_ops ace_reg_le16_ops = {
27816 .in = ace_in_le16,
27817 .out = ace_out_le16,
27818 .datain = ace_datain_le16,
27819diff -urNp linux-2.6.39/drivers/char/agp/frontend.c linux-2.6.39/drivers/char/agp/frontend.c
27820--- linux-2.6.39/drivers/char/agp/frontend.c 2011-05-19 00:06:34.000000000 -0400
27821+++ linux-2.6.39/drivers/char/agp/frontend.c 2011-05-22 19:36:31.000000000 -0400
27822@@ -817,7 +817,7 @@ static int agpioc_reserve_wrap(struct ag
27823 if (copy_from_user(&reserve, arg, sizeof(struct agp_region)))
27824 return -EFAULT;
27825
27826- if ((unsigned) reserve.seg_count >= ~0U/sizeof(struct agp_segment))
27827+ if ((unsigned) reserve.seg_count >= ~0U/sizeof(struct agp_segment_priv))
27828 return -EFAULT;
27829
27830 client = agp_find_client_by_pid(reserve.pid);
27831diff -urNp linux-2.6.39/drivers/char/briq_panel.c linux-2.6.39/drivers/char/briq_panel.c
27832--- linux-2.6.39/drivers/char/briq_panel.c 2011-05-19 00:06:34.000000000 -0400
27833+++ linux-2.6.39/drivers/char/briq_panel.c 2011-05-22 19:41:32.000000000 -0400
27834@@ -9,6 +9,7 @@
27835 #include <linux/types.h>
27836 #include <linux/errno.h>
27837 #include <linux/tty.h>
27838+#include <linux/mutex.h>
27839 #include <linux/timer.h>
27840 #include <linux/kernel.h>
27841 #include <linux/wait.h>
27842@@ -34,6 +35,7 @@ static int vfd_is_open;
27843 static unsigned char vfd[40];
27844 static int vfd_cursor;
27845 static unsigned char ledpb, led;
27846+static DEFINE_MUTEX(vfd_mutex);
27847
27848 static void update_vfd(void)
27849 {
27850@@ -140,12 +142,15 @@ static ssize_t briq_panel_write(struct f
27851 if (!vfd_is_open)
27852 return -EBUSY;
27853
27854+ mutex_lock(&vfd_mutex);
27855 for (;;) {
27856 char c;
27857 if (!indx)
27858 break;
27859- if (get_user(c, buf))
27860+ if (get_user(c, buf)) {
27861+ mutex_unlock(&vfd_mutex);
27862 return -EFAULT;
27863+ }
27864 if (esc) {
27865 set_led(c);
27866 esc = 0;
27867@@ -175,6 +180,7 @@ static ssize_t briq_panel_write(struct f
27868 buf++;
27869 }
27870 update_vfd();
27871+ mutex_unlock(&vfd_mutex);
27872
27873 return len;
27874 }
27875diff -urNp linux-2.6.39/drivers/char/genrtc.c linux-2.6.39/drivers/char/genrtc.c
27876--- linux-2.6.39/drivers/char/genrtc.c 2011-05-19 00:06:34.000000000 -0400
27877+++ linux-2.6.39/drivers/char/genrtc.c 2011-05-22 19:41:32.000000000 -0400
27878@@ -273,6 +273,7 @@ static int gen_rtc_ioctl(struct file *fi
27879 switch (cmd) {
27880
27881 case RTC_PLL_GET:
27882+ memset(&pll, 0, sizeof(pll));
27883 if (get_rtc_pll(&pll))
27884 return -EINVAL;
27885 else
27886diff -urNp linux-2.6.39/drivers/char/hpet.c linux-2.6.39/drivers/char/hpet.c
27887--- linux-2.6.39/drivers/char/hpet.c 2011-05-19 00:06:34.000000000 -0400
27888+++ linux-2.6.39/drivers/char/hpet.c 2011-05-22 19:36:31.000000000 -0400
27889@@ -553,7 +553,7 @@ static inline unsigned long hpet_time_di
27890 }
27891
27892 static int
27893-hpet_ioctl_common(struct hpet_dev *devp, int cmd, unsigned long arg,
27894+hpet_ioctl_common(struct hpet_dev *devp, unsigned int cmd, unsigned long arg,
27895 struct hpet_info *info)
27896 {
27897 struct hpet_timer __iomem *timer;
27898diff -urNp linux-2.6.39/drivers/char/ipmi/ipmi_devintf.c linux-2.6.39/drivers/char/ipmi/ipmi_devintf.c
27899--- linux-2.6.39/drivers/char/ipmi/ipmi_devintf.c 2011-05-19 00:06:34.000000000 -0400
27900+++ linux-2.6.39/drivers/char/ipmi/ipmi_devintf.c 2011-05-22 19:36:31.000000000 -0400
27901@@ -109,8 +109,7 @@ static int ipmi_fasync(int fd, struct fi
27902 return (result);
27903 }
27904
27905-static struct ipmi_user_hndl ipmi_hndlrs =
27906-{
27907+static const struct ipmi_user_hndl ipmi_hndlrs = {
27908 .ipmi_recv_hndl = file_receive_handler,
27909 };
27910
27911diff -urNp linux-2.6.39/drivers/char/ipmi/ipmi_msghandler.c linux-2.6.39/drivers/char/ipmi/ipmi_msghandler.c
27912--- linux-2.6.39/drivers/char/ipmi/ipmi_msghandler.c 2011-05-19 00:06:34.000000000 -0400
27913+++ linux-2.6.39/drivers/char/ipmi/ipmi_msghandler.c 2011-05-22 19:36:31.000000000 -0400
27914@@ -82,7 +82,7 @@ struct ipmi_user {
27915 struct kref refcount;
27916
27917 /* The upper layer that handles receive messages. */
27918- struct ipmi_user_hndl *handler;
27919+ const struct ipmi_user_hndl *handler;
27920 void *handler_data;
27921
27922 /* The interface this user is bound to. */
27923@@ -414,7 +414,7 @@ struct ipmi_smi {
27924 struct proc_dir_entry *proc_dir;
27925 char proc_dir_name[10];
27926
27927- atomic_t stats[IPMI_NUM_STATS];
27928+ atomic_unchecked_t stats[IPMI_NUM_STATS];
27929
27930 /*
27931 * run_to_completion duplicate of smb_info, smi_info
27932@@ -447,9 +447,9 @@ static DEFINE_MUTEX(smi_watchers_mutex);
27933
27934
27935 #define ipmi_inc_stat(intf, stat) \
27936- atomic_inc(&(intf)->stats[IPMI_STAT_ ## stat])
27937+ atomic_inc_unchecked(&(intf)->stats[IPMI_STAT_ ## stat])
27938 #define ipmi_get_stat(intf, stat) \
27939- ((unsigned int) atomic_read(&(intf)->stats[IPMI_STAT_ ## stat]))
27940+ ((unsigned int) atomic_read_unchecked(&(intf)->stats[IPMI_STAT_ ## stat]))
27941
27942 static int is_lan_addr(struct ipmi_addr *addr)
27943 {
27944@@ -875,7 +875,7 @@ static int intf_err_seq(ipmi_smi_t int
27945
27946
27947 int ipmi_create_user(unsigned int if_num,
27948- struct ipmi_user_hndl *handler,
27949+ const struct ipmi_user_hndl *handler,
27950 void *handler_data,
27951 ipmi_user_t *user)
27952 {
27953@@ -2844,7 +2844,7 @@ int ipmi_register_smi(struct ipmi_smi_ha
27954 INIT_LIST_HEAD(&intf->cmd_rcvrs);
27955 init_waitqueue_head(&intf->waitq);
27956 for (i = 0; i < IPMI_NUM_STATS; i++)
27957- atomic_set(&intf->stats[i], 0);
27958+ atomic_set_unchecked(&intf->stats[i], 0);
27959
27960 intf->proc_dir = NULL;
27961
27962@@ -4196,6 +4196,8 @@ static void send_panic_events(char *str)
27963 struct ipmi_smi_msg smi_msg;
27964 struct ipmi_recv_msg recv_msg;
27965
27966+ pax_track_stack();
27967+
27968 si = (struct ipmi_system_interface_addr *) &addr;
27969 si->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
27970 si->channel = IPMI_BMC_CHANNEL;
27971diff -urNp linux-2.6.39/drivers/char/ipmi/ipmi_poweroff.c linux-2.6.39/drivers/char/ipmi/ipmi_poweroff.c
27972--- linux-2.6.39/drivers/char/ipmi/ipmi_poweroff.c 2011-05-19 00:06:34.000000000 -0400
27973+++ linux-2.6.39/drivers/char/ipmi/ipmi_poweroff.c 2011-05-22 19:36:31.000000000 -0400
27974@@ -133,7 +133,7 @@ static void receive_handler(struct ipmi_
27975 complete(comp);
27976 }
27977
27978-static struct ipmi_user_hndl ipmi_poweroff_handler = {
27979+static const struct ipmi_user_hndl ipmi_poweroff_handler = {
27980 .ipmi_recv_hndl = receive_handler
27981 };
27982
27983diff -urNp linux-2.6.39/drivers/char/ipmi/ipmi_si_intf.c linux-2.6.39/drivers/char/ipmi/ipmi_si_intf.c
27984--- linux-2.6.39/drivers/char/ipmi/ipmi_si_intf.c 2011-05-19 00:06:34.000000000 -0400
27985+++ linux-2.6.39/drivers/char/ipmi/ipmi_si_intf.c 2011-05-22 19:36:31.000000000 -0400
27986@@ -276,7 +276,7 @@ struct smi_info {
27987 unsigned char slave_addr;
27988
27989 /* Counters and things for the proc filesystem. */
27990- atomic_t stats[SI_NUM_STATS];
27991+ atomic_unchecked_t stats[SI_NUM_STATS];
27992
27993 struct task_struct *thread;
27994
27995@@ -285,9 +285,9 @@ struct smi_info {
27996 };
27997
27998 #define smi_inc_stat(smi, stat) \
27999- atomic_inc(&(smi)->stats[SI_STAT_ ## stat])
28000+ atomic_inc_unchecked(&(smi)->stats[SI_STAT_ ## stat])
28001 #define smi_get_stat(smi, stat) \
28002- ((unsigned int) atomic_read(&(smi)->stats[SI_STAT_ ## stat]))
28003+ ((unsigned int) atomic_read_unchecked(&(smi)->stats[SI_STAT_ ## stat]))
28004
28005 #define SI_MAX_PARMS 4
28006
28007@@ -3198,7 +3198,7 @@ static int try_smi_init(struct smi_info
28008 atomic_set(&new_smi->req_events, 0);
28009 new_smi->run_to_completion = 0;
28010 for (i = 0; i < SI_NUM_STATS; i++)
28011- atomic_set(&new_smi->stats[i], 0);
28012+ atomic_set_unchecked(&new_smi->stats[i], 0);
28013
28014 new_smi->interrupt_disabled = 1;
28015 atomic_set(&new_smi->stop_operation, 0);
28016diff -urNp linux-2.6.39/drivers/char/ipmi/ipmi_watchdog.c linux-2.6.39/drivers/char/ipmi/ipmi_watchdog.c
28017--- linux-2.6.39/drivers/char/ipmi/ipmi_watchdog.c 2011-05-19 00:06:34.000000000 -0400
28018+++ linux-2.6.39/drivers/char/ipmi/ipmi_watchdog.c 2011-05-22 19:36:31.000000000 -0400
28019@@ -216,7 +216,7 @@ static int set_param_timeout(const char
28020 return rv;
28021 }
28022
28023-static struct kernel_param_ops param_ops_timeout = {
28024+static const struct kernel_param_ops param_ops_timeout = {
28025 .set = set_param_timeout,
28026 .get = param_get_int,
28027 };
28028@@ -278,14 +278,14 @@ static int set_param_wdog_ifnum(const ch
28029 return 0;
28030 }
28031
28032-static struct kernel_param_ops param_ops_wdog_ifnum = {
28033+static const struct kernel_param_ops param_ops_wdog_ifnum = {
28034 .set = set_param_wdog_ifnum,
28035 .get = param_get_int,
28036 };
28037
28038 #define param_check_wdog_ifnum param_check_int
28039
28040-static struct kernel_param_ops param_ops_str = {
28041+static const struct kernel_param_ops param_ops_str = {
28042 .set = set_param_str,
28043 .get = get_param_str,
28044 };
28045@@ -953,7 +953,7 @@ static void ipmi_wdog_pretimeout_handler
28046 pretimeout_since_last_heartbeat = 1;
28047 }
28048
28049-static struct ipmi_user_hndl ipmi_hndlrs = {
28050+static const struct ipmi_user_hndl ipmi_hndlrs = {
28051 .ipmi_recv_hndl = ipmi_wdog_msg_handler,
28052 .ipmi_watchdog_pretimeout = ipmi_wdog_pretimeout_handler
28053 };
28054diff -urNp linux-2.6.39/drivers/char/Kconfig linux-2.6.39/drivers/char/Kconfig
28055--- linux-2.6.39/drivers/char/Kconfig 2011-05-19 00:06:34.000000000 -0400
28056+++ linux-2.6.39/drivers/char/Kconfig 2011-05-22 19:41:37.000000000 -0400
28057@@ -8,7 +8,8 @@ source "drivers/tty/Kconfig"
28058
28059 config DEVKMEM
28060 bool "/dev/kmem virtual device support"
28061- default y
28062+ default n
28063+ depends on !GRKERNSEC_KMEM
28064 help
28065 Say Y here if you want to support the /dev/kmem device. The
28066 /dev/kmem device is rarely used, but can be used for certain
28067@@ -596,6 +597,7 @@ config DEVPORT
28068 bool
28069 depends on !M68K
28070 depends on ISA || PCI
28071+ depends on !GRKERNSEC_KMEM
28072 default y
28073
28074 source "drivers/s390/char/Kconfig"
28075diff -urNp linux-2.6.39/drivers/char/mem.c linux-2.6.39/drivers/char/mem.c
28076--- linux-2.6.39/drivers/char/mem.c 2011-05-19 00:06:34.000000000 -0400
28077+++ linux-2.6.39/drivers/char/mem.c 2011-05-22 19:41:37.000000000 -0400
28078@@ -18,6 +18,7 @@
28079 #include <linux/raw.h>
28080 #include <linux/tty.h>
28081 #include <linux/capability.h>
28082+#include <linux/security.h>
28083 #include <linux/ptrace.h>
28084 #include <linux/device.h>
28085 #include <linux/highmem.h>
28086@@ -34,6 +35,10 @@
28087 # include <linux/efi.h>
28088 #endif
28089
28090+#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
28091+extern struct file_operations grsec_fops;
28092+#endif
28093+
28094 static inline unsigned long size_inside_page(unsigned long start,
28095 unsigned long size)
28096 {
28097@@ -65,9 +70,13 @@ static inline int range_is_allowed(unsig
28098
28099 while (cursor < to) {
28100 if (!devmem_is_allowed(pfn)) {
28101+#ifdef CONFIG_GRKERNSEC_KMEM
28102+ gr_handle_mem_readwrite(from, to);
28103+#else
28104 printk(KERN_INFO
28105 "Program %s tried to access /dev/mem between %Lx->%Lx.\n",
28106 current->comm, from, to);
28107+#endif
28108 return 0;
28109 }
28110 cursor += PAGE_SIZE;
28111@@ -75,6 +84,11 @@ static inline int range_is_allowed(unsig
28112 }
28113 return 1;
28114 }
28115+#elif defined(CONFIG_GRKERNSEC_KMEM)
28116+static inline int range_is_allowed(unsigned long pfn, unsigned long size)
28117+{
28118+ return 0;
28119+}
28120 #else
28121 static inline int range_is_allowed(unsigned long pfn, unsigned long size)
28122 {
28123@@ -117,6 +131,7 @@ static ssize_t read_mem(struct file *fil
28124
28125 while (count > 0) {
28126 unsigned long remaining;
28127+ char *temp;
28128
28129 sz = size_inside_page(p, count);
28130
28131@@ -132,7 +147,23 @@ static ssize_t read_mem(struct file *fil
28132 if (!ptr)
28133 return -EFAULT;
28134
28135- remaining = copy_to_user(buf, ptr, sz);
28136+#ifdef CONFIG_PAX_USERCOPY
28137+ temp = kmalloc(sz, GFP_KERNEL);
28138+ if (!temp) {
28139+ unxlate_dev_mem_ptr(p, ptr);
28140+ return -ENOMEM;
28141+ }
28142+ memcpy(temp, ptr, sz);
28143+#else
28144+ temp = ptr;
28145+#endif
28146+
28147+ remaining = copy_to_user(buf, temp, sz);
28148+
28149+#ifdef CONFIG_PAX_USERCOPY
28150+ kfree(temp);
28151+#endif
28152+
28153 unxlate_dev_mem_ptr(p, ptr);
28154 if (remaining)
28155 return -EFAULT;
28156@@ -395,9 +426,8 @@ static ssize_t read_kmem(struct file *fi
28157 size_t count, loff_t *ppos)
28158 {
28159 unsigned long p = *ppos;
28160- ssize_t low_count, read, sz;
28161+ ssize_t low_count, read, sz, err = 0;
28162 char * kbuf; /* k-addr because vread() takes vmlist_lock rwlock */
28163- int err = 0;
28164
28165 read = 0;
28166 if (p < (unsigned long) high_memory) {
28167@@ -419,6 +449,8 @@ static ssize_t read_kmem(struct file *fi
28168 }
28169 #endif
28170 while (low_count > 0) {
28171+ char *temp;
28172+
28173 sz = size_inside_page(p, low_count);
28174
28175 /*
28176@@ -428,7 +460,22 @@ static ssize_t read_kmem(struct file *fi
28177 */
28178 kbuf = xlate_dev_kmem_ptr((char *)p);
28179
28180- if (copy_to_user(buf, kbuf, sz))
28181+#ifdef CONFIG_PAX_USERCOPY
28182+ temp = kmalloc(sz, GFP_KERNEL);
28183+ if (!temp)
28184+ return -ENOMEM;
28185+ memcpy(temp, kbuf, sz);
28186+#else
28187+ temp = kbuf;
28188+#endif
28189+
28190+ err = copy_to_user(buf, temp, sz);
28191+
28192+#ifdef CONFIG_PAX_USERCOPY
28193+ kfree(temp);
28194+#endif
28195+
28196+ if (err)
28197 return -EFAULT;
28198 buf += sz;
28199 p += sz;
28200@@ -854,6 +901,9 @@ static const struct memdev {
28201 #ifdef CONFIG_CRASH_DUMP
28202 [12] = { "oldmem", 0, &oldmem_fops, NULL },
28203 #endif
28204+#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
28205+ [13] = { "grsec",S_IRUSR | S_IWUGO, &grsec_fops, NULL },
28206+#endif
28207 };
28208
28209 static int memory_open(struct inode *inode, struct file *filp)
28210diff -urNp linux-2.6.39/drivers/char/mmtimer.c linux-2.6.39/drivers/char/mmtimer.c
28211--- linux-2.6.39/drivers/char/mmtimer.c 2011-05-19 00:06:34.000000000 -0400
28212+++ linux-2.6.39/drivers/char/mmtimer.c 2011-05-22 19:36:31.000000000 -0400
28213@@ -53,7 +53,7 @@ MODULE_LICENSE("GPL");
28214
28215 #define RTC_BITS 55 /* 55 bits for this implementation */
28216
28217-static struct k_clock sgi_clock;
28218+static const struct k_clock sgi_clock;
28219
28220 extern unsigned long sn_rtc_cycles_per_second;
28221
28222@@ -772,7 +772,7 @@ static int sgi_clock_getres(const clocki
28223 return 0;
28224 }
28225
28226-static struct k_clock sgi_clock = {
28227+static const struct k_clock sgi_clock = {
28228 .clock_set = sgi_clock_set,
28229 .clock_get = sgi_clock_get,
28230 .clock_getres = sgi_clock_getres,
28231diff -urNp linux-2.6.39/drivers/char/nvram.c linux-2.6.39/drivers/char/nvram.c
28232--- linux-2.6.39/drivers/char/nvram.c 2011-05-19 00:06:34.000000000 -0400
28233+++ linux-2.6.39/drivers/char/nvram.c 2011-05-22 19:36:31.000000000 -0400
28234@@ -246,7 +246,7 @@ static ssize_t nvram_read(struct file *f
28235
28236 spin_unlock_irq(&rtc_lock);
28237
28238- if (copy_to_user(buf, contents, tmp - contents))
28239+ if (tmp - contents > sizeof(contents) || copy_to_user(buf, contents, tmp - contents))
28240 return -EFAULT;
28241
28242 *ppos = i;
28243diff -urNp linux-2.6.39/drivers/char/random.c linux-2.6.39/drivers/char/random.c
28244--- linux-2.6.39/drivers/char/random.c 2011-05-19 00:06:34.000000000 -0400
28245+++ linux-2.6.39/drivers/char/random.c 2011-05-22 19:41:37.000000000 -0400
28246@@ -261,8 +261,13 @@
28247 /*
28248 * Configuration information
28249 */
28250+#ifdef CONFIG_GRKERNSEC_RANDNET
28251+#define INPUT_POOL_WORDS 512
28252+#define OUTPUT_POOL_WORDS 128
28253+#else
28254 #define INPUT_POOL_WORDS 128
28255 #define OUTPUT_POOL_WORDS 32
28256+#endif
28257 #define SEC_XFER_SIZE 512
28258 #define EXTRACT_SIZE 10
28259
28260@@ -300,10 +305,17 @@ static struct poolinfo {
28261 int poolwords;
28262 int tap1, tap2, tap3, tap4, tap5;
28263 } poolinfo_table[] = {
28264+#ifdef CONFIG_GRKERNSEC_RANDNET
28265+ /* x^512 + x^411 + x^308 + x^208 +x^104 + x + 1 -- 225 */
28266+ { 512, 411, 308, 208, 104, 1 },
28267+ /* x^128 + x^103 + x^76 + x^51 + x^25 + x + 1 -- 105 */
28268+ { 128, 103, 76, 51, 25, 1 },
28269+#else
28270 /* x^128 + x^103 + x^76 + x^51 +x^25 + x + 1 -- 105 */
28271 { 128, 103, 76, 51, 25, 1 },
28272 /* x^32 + x^26 + x^20 + x^14 + x^7 + x + 1 -- 15 */
28273 { 32, 26, 20, 14, 7, 1 },
28274+#endif
28275 #if 0
28276 /* x^2048 + x^1638 + x^1231 + x^819 + x^411 + x + 1 -- 115 */
28277 { 2048, 1638, 1231, 819, 411, 1 },
28278@@ -909,7 +921,7 @@ static ssize_t extract_entropy_user(stru
28279
28280 extract_buf(r, tmp);
28281 i = min_t(int, nbytes, EXTRACT_SIZE);
28282- if (copy_to_user(buf, tmp, i)) {
28283+ if (i > sizeof(tmp) || copy_to_user(buf, tmp, i)) {
28284 ret = -EFAULT;
28285 break;
28286 }
28287@@ -1214,7 +1226,7 @@ EXPORT_SYMBOL(generate_random_uuid);
28288 #include <linux/sysctl.h>
28289
28290 static int min_read_thresh = 8, min_write_thresh;
28291-static int max_read_thresh = INPUT_POOL_WORDS * 32;
28292+static int max_read_thresh = OUTPUT_POOL_WORDS * 32;
28293 static int max_write_thresh = INPUT_POOL_WORDS * 32;
28294 static char sysctl_bootid[16];
28295
28296diff -urNp linux-2.6.39/drivers/char/sonypi.c linux-2.6.39/drivers/char/sonypi.c
28297--- linux-2.6.39/drivers/char/sonypi.c 2011-05-19 00:06:34.000000000 -0400
28298+++ linux-2.6.39/drivers/char/sonypi.c 2011-05-22 19:36:31.000000000 -0400
28299@@ -55,6 +55,7 @@
28300 #include <asm/uaccess.h>
28301 #include <asm/io.h>
28302 #include <asm/system.h>
28303+#include <asm/local.h>
28304
28305 #include <linux/sonypi.h>
28306
28307@@ -491,7 +492,7 @@ static struct sonypi_device {
28308 spinlock_t fifo_lock;
28309 wait_queue_head_t fifo_proc_list;
28310 struct fasync_struct *fifo_async;
28311- int open_count;
28312+ local_t open_count;
28313 int model;
28314 struct input_dev *input_jog_dev;
28315 struct input_dev *input_key_dev;
28316@@ -898,7 +899,7 @@ static int sonypi_misc_fasync(int fd, st
28317 static int sonypi_misc_release(struct inode *inode, struct file *file)
28318 {
28319 mutex_lock(&sonypi_device.lock);
28320- sonypi_device.open_count--;
28321+ local_dec(&sonypi_device.open_count);
28322 mutex_unlock(&sonypi_device.lock);
28323 return 0;
28324 }
28325@@ -907,9 +908,9 @@ static int sonypi_misc_open(struct inode
28326 {
28327 mutex_lock(&sonypi_device.lock);
28328 /* Flush input queue on first open */
28329- if (!sonypi_device.open_count)
28330+ if (!local_read(&sonypi_device.open_count))
28331 kfifo_reset(&sonypi_device.fifo);
28332- sonypi_device.open_count++;
28333+ local_inc(&sonypi_device.open_count);
28334 mutex_unlock(&sonypi_device.lock);
28335
28336 return 0;
28337diff -urNp linux-2.6.39/drivers/char/tpm/tpm_bios.c linux-2.6.39/drivers/char/tpm/tpm_bios.c
28338--- linux-2.6.39/drivers/char/tpm/tpm_bios.c 2011-05-19 00:06:34.000000000 -0400
28339+++ linux-2.6.39/drivers/char/tpm/tpm_bios.c 2011-05-22 19:36:31.000000000 -0400
28340@@ -173,7 +173,7 @@ static void *tpm_bios_measurements_start
28341 event = addr;
28342
28343 if ((event->event_type == 0 && event->event_size == 0) ||
28344- ((addr + sizeof(struct tcpa_event) + event->event_size) >= limit))
28345+ (event->event_size >= limit - addr - sizeof(struct tcpa_event)))
28346 return NULL;
28347
28348 return addr;
28349@@ -198,7 +198,7 @@ static void *tpm_bios_measurements_next(
28350 return NULL;
28351
28352 if ((event->event_type == 0 && event->event_size == 0) ||
28353- ((v + sizeof(struct tcpa_event) + event->event_size) >= limit))
28354+ (event->event_size >= limit - v - sizeof(struct tcpa_event)))
28355 return NULL;
28356
28357 (*pos)++;
28358@@ -291,7 +291,8 @@ static int tpm_binary_bios_measurements_
28359 int i;
28360
28361 for (i = 0; i < sizeof(struct tcpa_event) + event->event_size; i++)
28362- seq_putc(m, data[i]);
28363+ if (!seq_putc(m, data[i]))
28364+ return -EFAULT;
28365
28366 return 0;
28367 }
28368@@ -410,6 +411,11 @@ static int read_log(struct tpm_bios_log
28369 log->bios_event_log_end = log->bios_event_log + len;
28370
28371 virt = acpi_os_map_memory(start, len);
28372+ if (!virt) {
28373+ kfree(log->bios_event_log);
28374+ log->bios_event_log = NULL;
28375+ return -EFAULT;
28376+ }
28377
28378 memcpy(log->bios_event_log, virt, len);
28379
28380diff -urNp linux-2.6.39/drivers/char/tpm/tpm.c linux-2.6.39/drivers/char/tpm/tpm.c
28381--- linux-2.6.39/drivers/char/tpm/tpm.c 2011-05-19 00:06:34.000000000 -0400
28382+++ linux-2.6.39/drivers/char/tpm/tpm.c 2011-05-22 19:36:31.000000000 -0400
28383@@ -411,7 +411,7 @@ static ssize_t tpm_transmit(struct tpm_c
28384 chip->vendor.req_complete_val)
28385 goto out_recv;
28386
28387- if ((status == chip->vendor.req_canceled)) {
28388+ if (status == chip->vendor.req_canceled) {
28389 dev_err(chip->dev, "Operation Canceled\n");
28390 rc = -ECANCELED;
28391 goto out;
28392@@ -844,6 +844,8 @@ ssize_t tpm_show_pubek(struct device *de
28393
28394 struct tpm_chip *chip = dev_get_drvdata(dev);
28395
28396+ pax_track_stack();
28397+
28398 tpm_cmd.header.in = tpm_readpubek_header;
28399 err = transmit_cmd(chip, &tpm_cmd, READ_PUBEK_RESULT_SIZE,
28400 "attempting to read the PUBEK");
28401diff -urNp linux-2.6.39/drivers/char/ttyprintk.c linux-2.6.39/drivers/char/ttyprintk.c
28402--- linux-2.6.39/drivers/char/ttyprintk.c 2011-05-19 00:06:34.000000000 -0400
28403+++ linux-2.6.39/drivers/char/ttyprintk.c 2011-05-22 19:36:31.000000000 -0400
28404@@ -170,7 +170,7 @@ static const struct tty_operations ttypr
28405 .ioctl = tpk_ioctl,
28406 };
28407
28408-struct tty_port_operations null_ops = { };
28409+const struct tty_port_operations null_ops = { };
28410
28411 static struct tty_driver *ttyprintk_driver;
28412
28413diff -urNp linux-2.6.39/drivers/char/xilinx_hwicap/xilinx_hwicap.c linux-2.6.39/drivers/char/xilinx_hwicap/xilinx_hwicap.c
28414--- linux-2.6.39/drivers/char/xilinx_hwicap/xilinx_hwicap.c 2011-05-19 00:06:34.000000000 -0400
28415+++ linux-2.6.39/drivers/char/xilinx_hwicap/xilinx_hwicap.c 2011-05-22 19:36:31.000000000 -0400
28416@@ -678,14 +678,14 @@ static int __devinit hwicap_setup(struct
28417 return retval;
28418 }
28419
28420-static struct hwicap_driver_config buffer_icap_config = {
28421+static const struct hwicap_driver_config buffer_icap_config = {
28422 .get_configuration = buffer_icap_get_configuration,
28423 .set_configuration = buffer_icap_set_configuration,
28424 .get_status = buffer_icap_get_status,
28425 .reset = buffer_icap_reset,
28426 };
28427
28428-static struct hwicap_driver_config fifo_icap_config = {
28429+static const struct hwicap_driver_config fifo_icap_config = {
28430 .get_configuration = fifo_icap_get_configuration,
28431 .set_configuration = fifo_icap_set_configuration,
28432 .get_status = fifo_icap_get_status,
28433diff -urNp linux-2.6.39/drivers/crypto/hifn_795x.c linux-2.6.39/drivers/crypto/hifn_795x.c
28434--- linux-2.6.39/drivers/crypto/hifn_795x.c 2011-05-19 00:06:34.000000000 -0400
28435+++ linux-2.6.39/drivers/crypto/hifn_795x.c 2011-05-22 19:36:31.000000000 -0400
28436@@ -1655,6 +1655,8 @@ static int hifn_test(struct hifn_device
28437 0xCA, 0x34, 0x2B, 0x2E};
28438 struct scatterlist sg;
28439
28440+ pax_track_stack();
28441+
28442 memset(src, 0, sizeof(src));
28443 memset(ctx.key, 0, sizeof(ctx.key));
28444
28445diff -urNp linux-2.6.39/drivers/crypto/padlock-aes.c linux-2.6.39/drivers/crypto/padlock-aes.c
28446--- linux-2.6.39/drivers/crypto/padlock-aes.c 2011-05-19 00:06:34.000000000 -0400
28447+++ linux-2.6.39/drivers/crypto/padlock-aes.c 2011-05-22 19:36:31.000000000 -0400
28448@@ -109,6 +109,8 @@ static int aes_set_key(struct crypto_tfm
28449 struct crypto_aes_ctx gen_aes;
28450 int cpu;
28451
28452+ pax_track_stack();
28453+
28454 if (key_len % 8) {
28455 *flags |= CRYPTO_TFM_RES_BAD_KEY_LEN;
28456 return -EINVAL;
28457diff -urNp linux-2.6.39/drivers/dca/dca-core.c linux-2.6.39/drivers/dca/dca-core.c
28458--- linux-2.6.39/drivers/dca/dca-core.c 2011-05-19 00:06:34.000000000 -0400
28459+++ linux-2.6.39/drivers/dca/dca-core.c 2011-05-22 19:36:31.000000000 -0400
28460@@ -325,7 +325,7 @@ EXPORT_SYMBOL_GPL(dca_get_tag);
28461 * @ops - pointer to struct of dca operation function pointers
28462 * @priv_size - size of extra mem to be added for provider's needs
28463 */
28464-struct dca_provider *alloc_dca_provider(struct dca_ops *ops, int priv_size)
28465+struct dca_provider *alloc_dca_provider(const struct dca_ops *ops, int priv_size)
28466 {
28467 struct dca_provider *dca;
28468 int alloc_size;
28469diff -urNp linux-2.6.39/drivers/dma/ioat/dca.c linux-2.6.39/drivers/dma/ioat/dca.c
28470--- linux-2.6.39/drivers/dma/ioat/dca.c 2011-05-19 00:06:34.000000000 -0400
28471+++ linux-2.6.39/drivers/dma/ioat/dca.c 2011-05-22 19:36:31.000000000 -0400
28472@@ -234,7 +234,7 @@ static int ioat_dca_dev_managed(struct d
28473 return 0;
28474 }
28475
28476-static struct dca_ops ioat_dca_ops = {
28477+static const struct dca_ops ioat_dca_ops = {
28478 .add_requester = ioat_dca_add_requester,
28479 .remove_requester = ioat_dca_remove_requester,
28480 .get_tag = ioat_dca_get_tag,
28481@@ -384,7 +384,7 @@ static u8 ioat2_dca_get_tag(struct dca_p
28482 return tag;
28483 }
28484
28485-static struct dca_ops ioat2_dca_ops = {
28486+static const struct dca_ops ioat2_dca_ops = {
28487 .add_requester = ioat2_dca_add_requester,
28488 .remove_requester = ioat2_dca_remove_requester,
28489 .get_tag = ioat2_dca_get_tag,
28490@@ -579,7 +579,7 @@ static u8 ioat3_dca_get_tag(struct dca_p
28491 return tag;
28492 }
28493
28494-static struct dca_ops ioat3_dca_ops = {
28495+static const struct dca_ops ioat3_dca_ops = {
28496 .add_requester = ioat3_dca_add_requester,
28497 .remove_requester = ioat3_dca_remove_requester,
28498 .get_tag = ioat3_dca_get_tag,
28499diff -urNp linux-2.6.39/drivers/edac/amd64_edac.h linux-2.6.39/drivers/edac/amd64_edac.h
28500--- linux-2.6.39/drivers/edac/amd64_edac.h 2011-05-19 00:06:34.000000000 -0400
28501+++ linux-2.6.39/drivers/edac/amd64_edac.h 2011-05-22 19:36:31.000000000 -0400
28502@@ -333,7 +333,7 @@ struct chip_select {
28503 };
28504
28505 struct amd64_pvt {
28506- struct low_ops *ops;
28507+ const struct low_ops *ops;
28508
28509 /* pci_device handles which we utilize */
28510 struct pci_dev *F1, *F2, *F3;
28511@@ -443,7 +443,7 @@ struct low_ops {
28512 struct amd64_family_type {
28513 const char *ctl_name;
28514 u16 f1_id, f3_id;
28515- struct low_ops ops;
28516+ const struct low_ops ops;
28517 };
28518
28519 int __amd64_write_pci_cfg_dword(struct pci_dev *pdev, int offset,
28520diff -urNp linux-2.6.39/drivers/edac/edac_mc_sysfs.c linux-2.6.39/drivers/edac/edac_mc_sysfs.c
28521--- linux-2.6.39/drivers/edac/edac_mc_sysfs.c 2011-05-19 00:06:34.000000000 -0400
28522+++ linux-2.6.39/drivers/edac/edac_mc_sysfs.c 2011-05-22 19:36:31.000000000 -0400
28523@@ -760,7 +760,7 @@ static void edac_inst_grp_release(struct
28524 }
28525
28526 /* Intermediate show/store table */
28527-static struct sysfs_ops inst_grp_ops = {
28528+static const struct sysfs_ops inst_grp_ops = {
28529 .show = inst_grp_show,
28530 .store = inst_grp_store
28531 };
28532diff -urNp linux-2.6.39/drivers/edac/edac_pci_sysfs.c linux-2.6.39/drivers/edac/edac_pci_sysfs.c
28533--- linux-2.6.39/drivers/edac/edac_pci_sysfs.c 2011-05-19 00:06:34.000000000 -0400
28534+++ linux-2.6.39/drivers/edac/edac_pci_sysfs.c 2011-05-22 19:36:31.000000000 -0400
28535@@ -26,8 +26,8 @@ static int edac_pci_log_pe = 1; /* log
28536 static int edac_pci_log_npe = 1; /* log PCI non-parity error errors */
28537 static int edac_pci_poll_msec = 1000; /* one second workq period */
28538
28539-static atomic_t pci_parity_count = ATOMIC_INIT(0);
28540-static atomic_t pci_nonparity_count = ATOMIC_INIT(0);
28541+static atomic_unchecked_t pci_parity_count = ATOMIC_INIT(0);
28542+static atomic_unchecked_t pci_nonparity_count = ATOMIC_INIT(0);
28543
28544 static struct kobject *edac_pci_top_main_kobj;
28545 static atomic_t edac_pci_sysfs_refcount = ATOMIC_INIT(0);
28546@@ -582,7 +582,7 @@ static void edac_pci_dev_parity_test(str
28547 edac_printk(KERN_CRIT, EDAC_PCI,
28548 "Signaled System Error on %s\n",
28549 pci_name(dev));
28550- atomic_inc(&pci_nonparity_count);
28551+ atomic_inc_unchecked(&pci_nonparity_count);
28552 }
28553
28554 if (status & (PCI_STATUS_PARITY)) {
28555@@ -590,7 +590,7 @@ static void edac_pci_dev_parity_test(str
28556 "Master Data Parity Error on %s\n",
28557 pci_name(dev));
28558
28559- atomic_inc(&pci_parity_count);
28560+ atomic_inc_unchecked(&pci_parity_count);
28561 }
28562
28563 if (status & (PCI_STATUS_DETECTED_PARITY)) {
28564@@ -598,7 +598,7 @@ static void edac_pci_dev_parity_test(str
28565 "Detected Parity Error on %s\n",
28566 pci_name(dev));
28567
28568- atomic_inc(&pci_parity_count);
28569+ atomic_inc_unchecked(&pci_parity_count);
28570 }
28571 }
28572
28573@@ -619,7 +619,7 @@ static void edac_pci_dev_parity_test(str
28574 edac_printk(KERN_CRIT, EDAC_PCI, "Bridge "
28575 "Signaled System Error on %s\n",
28576 pci_name(dev));
28577- atomic_inc(&pci_nonparity_count);
28578+ atomic_inc_unchecked(&pci_nonparity_count);
28579 }
28580
28581 if (status & (PCI_STATUS_PARITY)) {
28582@@ -627,7 +627,7 @@ static void edac_pci_dev_parity_test(str
28583 "Master Data Parity Error on "
28584 "%s\n", pci_name(dev));
28585
28586- atomic_inc(&pci_parity_count);
28587+ atomic_inc_unchecked(&pci_parity_count);
28588 }
28589
28590 if (status & (PCI_STATUS_DETECTED_PARITY)) {
28591@@ -635,7 +635,7 @@ static void edac_pci_dev_parity_test(str
28592 "Detected Parity Error on %s\n",
28593 pci_name(dev));
28594
28595- atomic_inc(&pci_parity_count);
28596+ atomic_inc_unchecked(&pci_parity_count);
28597 }
28598 }
28599 }
28600@@ -677,7 +677,7 @@ void edac_pci_do_parity_check(void)
28601 if (!check_pci_errors)
28602 return;
28603
28604- before_count = atomic_read(&pci_parity_count);
28605+ before_count = atomic_read_unchecked(&pci_parity_count);
28606
28607 /* scan all PCI devices looking for a Parity Error on devices and
28608 * bridges.
28609@@ -689,7 +689,7 @@ void edac_pci_do_parity_check(void)
28610 /* Only if operator has selected panic on PCI Error */
28611 if (edac_pci_get_panic_on_pe()) {
28612 /* If the count is different 'after' from 'before' */
28613- if (before_count != atomic_read(&pci_parity_count))
28614+ if (before_count != atomic_read_unchecked(&pci_parity_count))
28615 panic("EDAC: PCI Parity Error");
28616 }
28617 }
28618diff -urNp linux-2.6.39/drivers/firewire/core-cdev.c linux-2.6.39/drivers/firewire/core-cdev.c
28619--- linux-2.6.39/drivers/firewire/core-cdev.c 2011-05-19 00:06:34.000000000 -0400
28620+++ linux-2.6.39/drivers/firewire/core-cdev.c 2011-05-22 19:36:31.000000000 -0400
28621@@ -1312,8 +1312,7 @@ static int init_iso_resource(struct clie
28622 int ret;
28623
28624 if ((request->channels == 0 && request->bandwidth == 0) ||
28625- request->bandwidth > BANDWIDTH_AVAILABLE_INITIAL ||
28626- request->bandwidth < 0)
28627+ request->bandwidth > BANDWIDTH_AVAILABLE_INITIAL)
28628 return -EINVAL;
28629
28630 r = kmalloc(sizeof(*r), GFP_KERNEL);
28631diff -urNp linux-2.6.39/drivers/firewire/core-transaction.c linux-2.6.39/drivers/firewire/core-transaction.c
28632--- linux-2.6.39/drivers/firewire/core-transaction.c 2011-05-19 00:06:34.000000000 -0400
28633+++ linux-2.6.39/drivers/firewire/core-transaction.c 2011-05-22 19:36:31.000000000 -0400
28634@@ -36,6 +36,7 @@
28635 #include <linux/string.h>
28636 #include <linux/timer.h>
28637 #include <linux/types.h>
28638+#include <linux/sched.h>
28639
28640 #include <asm/byteorder.h>
28641
28642@@ -420,6 +421,8 @@ int fw_run_transaction(struct fw_card *c
28643 struct transaction_callback_data d;
28644 struct fw_transaction t;
28645
28646+ pax_track_stack();
28647+
28648 init_timer_on_stack(&t.split_timeout_timer);
28649 init_completion(&d.done);
28650 d.payload = payload;
28651diff -urNp linux-2.6.39/drivers/firmware/dmi_scan.c linux-2.6.39/drivers/firmware/dmi_scan.c
28652--- linux-2.6.39/drivers/firmware/dmi_scan.c 2011-05-19 00:06:34.000000000 -0400
28653+++ linux-2.6.39/drivers/firmware/dmi_scan.c 2011-05-22 19:36:31.000000000 -0400
28654@@ -449,11 +449,6 @@ void __init dmi_scan_machine(void)
28655 }
28656 }
28657 else {
28658- /*
28659- * no iounmap() for that ioremap(); it would be a no-op, but
28660- * it's so early in setup that sucker gets confused into doing
28661- * what it shouldn't if we actually call it.
28662- */
28663 p = dmi_ioremap(0xF0000, 0x10000);
28664 if (p == NULL)
28665 goto error;
28666diff -urNp linux-2.6.39/drivers/gpio/vr41xx_giu.c linux-2.6.39/drivers/gpio/vr41xx_giu.c
28667--- linux-2.6.39/drivers/gpio/vr41xx_giu.c 2011-05-19 00:06:34.000000000 -0400
28668+++ linux-2.6.39/drivers/gpio/vr41xx_giu.c 2011-05-22 19:36:31.000000000 -0400
28669@@ -204,7 +204,7 @@ static int giu_get_irq(unsigned int irq)
28670 printk(KERN_ERR "spurious GIU interrupt: %04x(%04x),%04x(%04x)\n",
28671 maskl, pendl, maskh, pendh);
28672
28673- atomic_inc(&irq_err_count);
28674+ atomic_inc_unchecked(&irq_err_count);
28675
28676 return -EINVAL;
28677 }
28678diff -urNp linux-2.6.39/drivers/gpu/drm/drm_crtc_helper.c linux-2.6.39/drivers/gpu/drm/drm_crtc_helper.c
28679--- linux-2.6.39/drivers/gpu/drm/drm_crtc_helper.c 2011-05-19 00:06:34.000000000 -0400
28680+++ linux-2.6.39/drivers/gpu/drm/drm_crtc_helper.c 2011-05-22 19:36:31.000000000 -0400
28681@@ -276,7 +276,7 @@ static bool drm_encoder_crtc_ok(struct d
28682 struct drm_crtc *tmp;
28683 int crtc_mask = 1;
28684
28685- WARN(!crtc, "checking null crtc?\n");
28686+ BUG_ON(!crtc);
28687
28688 dev = crtc->dev;
28689
28690@@ -343,6 +343,8 @@ bool drm_crtc_helper_set_mode(struct drm
28691 struct drm_encoder *encoder;
28692 bool ret = true;
28693
28694+ pax_track_stack();
28695+
28696 crtc->enabled = drm_helper_crtc_in_use(crtc);
28697 if (!crtc->enabled)
28698 return true;
28699diff -urNp linux-2.6.39/drivers/gpu/drm/drm_drv.c linux-2.6.39/drivers/gpu/drm/drm_drv.c
28700--- linux-2.6.39/drivers/gpu/drm/drm_drv.c 2011-05-19 00:06:34.000000000 -0400
28701+++ linux-2.6.39/drivers/gpu/drm/drm_drv.c 2011-05-22 19:36:31.000000000 -0400
28702@@ -386,7 +386,7 @@ long drm_ioctl(struct file *filp,
28703
28704 dev = file_priv->minor->dev;
28705 atomic_inc(&dev->ioctl_count);
28706- atomic_inc(&dev->counts[_DRM_STAT_IOCTLS]);
28707+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_IOCTLS]);
28708 ++file_priv->ioctl_count;
28709
28710 DRM_DEBUG("pid=%d, cmd=0x%02x, nr=0x%02x, dev 0x%lx, auth=%d\n",
28711diff -urNp linux-2.6.39/drivers/gpu/drm/drm_fops.c linux-2.6.39/drivers/gpu/drm/drm_fops.c
28712--- linux-2.6.39/drivers/gpu/drm/drm_fops.c 2011-05-19 00:06:34.000000000 -0400
28713+++ linux-2.6.39/drivers/gpu/drm/drm_fops.c 2011-05-22 19:36:31.000000000 -0400
28714@@ -70,7 +70,7 @@ static int drm_setup(struct drm_device *
28715 }
28716
28717 for (i = 0; i < ARRAY_SIZE(dev->counts); i++)
28718- atomic_set(&dev->counts[i], 0);
28719+ atomic_set_unchecked(&dev->counts[i], 0);
28720
28721 dev->sigdata.lock = NULL;
28722
28723@@ -134,8 +134,8 @@ int drm_open(struct inode *inode, struct
28724
28725 retcode = drm_open_helper(inode, filp, dev);
28726 if (!retcode) {
28727- atomic_inc(&dev->counts[_DRM_STAT_OPENS]);
28728- if (!dev->open_count++)
28729+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_OPENS]);
28730+ if (local_inc_return(&dev->open_count) == 1)
28731 retcode = drm_setup(dev);
28732 }
28733 if (!retcode) {
28734@@ -472,7 +472,7 @@ int drm_release(struct inode *inode, str
28735
28736 mutex_lock(&drm_global_mutex);
28737
28738- DRM_DEBUG("open_count = %d\n", dev->open_count);
28739+ DRM_DEBUG("open_count = %d\n", local_read(&dev->open_count));
28740
28741 if (dev->driver->preclose)
28742 dev->driver->preclose(dev, file_priv);
28743@@ -484,7 +484,7 @@ int drm_release(struct inode *inode, str
28744 DRM_DEBUG("pid = %d, device = 0x%lx, open_count = %d\n",
28745 task_pid_nr(current),
28746 (long)old_encode_dev(file_priv->minor->device),
28747- dev->open_count);
28748+ local_read(&dev->open_count));
28749
28750 /* if the master has gone away we can't do anything with the lock */
28751 if (file_priv->minor->master)
28752@@ -565,8 +565,8 @@ int drm_release(struct inode *inode, str
28753 * End inline drm_release
28754 */
28755
28756- atomic_inc(&dev->counts[_DRM_STAT_CLOSES]);
28757- if (!--dev->open_count) {
28758+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_CLOSES]);
28759+ if (local_dec_and_test(&dev->open_count)) {
28760 if (atomic_read(&dev->ioctl_count)) {
28761 DRM_ERROR("Device busy: %d\n",
28762 atomic_read(&dev->ioctl_count));
28763diff -urNp linux-2.6.39/drivers/gpu/drm/drm_global.c linux-2.6.39/drivers/gpu/drm/drm_global.c
28764--- linux-2.6.39/drivers/gpu/drm/drm_global.c 2011-05-19 00:06:34.000000000 -0400
28765+++ linux-2.6.39/drivers/gpu/drm/drm_global.c 2011-05-22 19:36:31.000000000 -0400
28766@@ -36,7 +36,7 @@
28767 struct drm_global_item {
28768 struct mutex mutex;
28769 void *object;
28770- int refcount;
28771+ atomic_t refcount;
28772 };
28773
28774 static struct drm_global_item glob[DRM_GLOBAL_NUM];
28775@@ -49,7 +49,7 @@ void drm_global_init(void)
28776 struct drm_global_item *item = &glob[i];
28777 mutex_init(&item->mutex);
28778 item->object = NULL;
28779- item->refcount = 0;
28780+ atomic_set(&item->refcount, 0);
28781 }
28782 }
28783
28784@@ -59,7 +59,7 @@ void drm_global_release(void)
28785 for (i = 0; i < DRM_GLOBAL_NUM; ++i) {
28786 struct drm_global_item *item = &glob[i];
28787 BUG_ON(item->object != NULL);
28788- BUG_ON(item->refcount != 0);
28789+ BUG_ON(atomic_read(&item->refcount) != 0);
28790 }
28791 }
28792
28793@@ -70,7 +70,7 @@ int drm_global_item_ref(struct drm_globa
28794 void *object;
28795
28796 mutex_lock(&item->mutex);
28797- if (item->refcount == 0) {
28798+ if (atomic_read(&item->refcount) == 0) {
28799 item->object = kzalloc(ref->size, GFP_KERNEL);
28800 if (unlikely(item->object == NULL)) {
28801 ret = -ENOMEM;
28802@@ -83,7 +83,7 @@ int drm_global_item_ref(struct drm_globa
28803 goto out_err;
28804
28805 }
28806- ++item->refcount;
28807+ atomic_inc(&item->refcount);
28808 ref->object = item->object;
28809 object = item->object;
28810 mutex_unlock(&item->mutex);
28811@@ -100,9 +100,9 @@ void drm_global_item_unref(struct drm_gl
28812 struct drm_global_item *item = &glob[ref->global_type];
28813
28814 mutex_lock(&item->mutex);
28815- BUG_ON(item->refcount == 0);
28816+ BUG_ON(atomic_read(&item->refcount) == 0);
28817 BUG_ON(ref->object != item->object);
28818- if (--item->refcount == 0) {
28819+ if (atomic_dec_and_test(&item->refcount)) {
28820 ref->release(ref);
28821 item->object = NULL;
28822 }
28823diff -urNp linux-2.6.39/drivers/gpu/drm/drm_info.c linux-2.6.39/drivers/gpu/drm/drm_info.c
28824--- linux-2.6.39/drivers/gpu/drm/drm_info.c 2011-05-19 00:06:34.000000000 -0400
28825+++ linux-2.6.39/drivers/gpu/drm/drm_info.c 2011-05-22 19:41:37.000000000 -0400
28826@@ -75,10 +75,14 @@ int drm_vm_info(struct seq_file *m, void
28827 struct drm_local_map *map;
28828 struct drm_map_list *r_list;
28829
28830- /* Hardcoded from _DRM_FRAME_BUFFER,
28831- _DRM_REGISTERS, _DRM_SHM, _DRM_AGP, and
28832- _DRM_SCATTER_GATHER and _DRM_CONSISTENT */
28833- const char *types[] = { "FB", "REG", "SHM", "AGP", "SG", "PCI" };
28834+ static const char * const types[] = {
28835+ [_DRM_FRAME_BUFFER] = "FB",
28836+ [_DRM_REGISTERS] = "REG",
28837+ [_DRM_SHM] = "SHM",
28838+ [_DRM_AGP] = "AGP",
28839+ [_DRM_SCATTER_GATHER] = "SG",
28840+ [_DRM_CONSISTENT] = "PCI",
28841+ [_DRM_GEM] = "GEM" };
28842 const char *type;
28843 int i;
28844
28845@@ -89,7 +93,7 @@ int drm_vm_info(struct seq_file *m, void
28846 map = r_list->map;
28847 if (!map)
28848 continue;
28849- if (map->type < 0 || map->type > 5)
28850+ if (map->type >= ARRAY_SIZE(types))
28851 type = "??";
28852 else
28853 type = types[map->type];
28854@@ -290,7 +294,11 @@ int drm_vma_info(struct seq_file *m, voi
28855 vma->vm_flags & VM_MAYSHARE ? 's' : 'p',
28856 vma->vm_flags & VM_LOCKED ? 'l' : '-',
28857 vma->vm_flags & VM_IO ? 'i' : '-',
28858+#ifdef CONFIG_GRKERNSEC_HIDESYM
28859+ 0);
28860+#else
28861 vma->vm_pgoff);
28862+#endif
28863
28864 #if defined(__i386__)
28865 pgprot = pgprot_val(vma->vm_page_prot);
28866diff -urNp linux-2.6.39/drivers/gpu/drm/drm_ioctl.c linux-2.6.39/drivers/gpu/drm/drm_ioctl.c
28867--- linux-2.6.39/drivers/gpu/drm/drm_ioctl.c 2011-05-19 00:06:34.000000000 -0400
28868+++ linux-2.6.39/drivers/gpu/drm/drm_ioctl.c 2011-05-22 19:36:31.000000000 -0400
28869@@ -256,7 +256,7 @@ int drm_getstats(struct drm_device *dev,
28870 stats->data[i].value =
28871 (file_priv->master->lock.hw_lock ? file_priv->master->lock.hw_lock->lock : 0);
28872 else
28873- stats->data[i].value = atomic_read(&dev->counts[i]);
28874+ stats->data[i].value = atomic_read_unchecked(&dev->counts[i]);
28875 stats->data[i].type = dev->types[i];
28876 }
28877
28878diff -urNp linux-2.6.39/drivers/gpu/drm/drm_lock.c linux-2.6.39/drivers/gpu/drm/drm_lock.c
28879--- linux-2.6.39/drivers/gpu/drm/drm_lock.c 2011-05-19 00:06:34.000000000 -0400
28880+++ linux-2.6.39/drivers/gpu/drm/drm_lock.c 2011-05-22 19:36:31.000000000 -0400
28881@@ -89,7 +89,7 @@ int drm_lock(struct drm_device *dev, voi
28882 if (drm_lock_take(&master->lock, lock->context)) {
28883 master->lock.file_priv = file_priv;
28884 master->lock.lock_time = jiffies;
28885- atomic_inc(&dev->counts[_DRM_STAT_LOCKS]);
28886+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_LOCKS]);
28887 break; /* Got lock */
28888 }
28889
28890@@ -160,7 +160,7 @@ int drm_unlock(struct drm_device *dev, v
28891 return -EINVAL;
28892 }
28893
28894- atomic_inc(&dev->counts[_DRM_STAT_UNLOCKS]);
28895+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_UNLOCKS]);
28896
28897 if (drm_lock_free(&master->lock, lock->context)) {
28898 /* FIXME: Should really bail out here. */
28899diff -urNp linux-2.6.39/drivers/gpu/drm/i810/i810_dma.c linux-2.6.39/drivers/gpu/drm/i810/i810_dma.c
28900--- linux-2.6.39/drivers/gpu/drm/i810/i810_dma.c 2011-05-19 00:06:34.000000000 -0400
28901+++ linux-2.6.39/drivers/gpu/drm/i810/i810_dma.c 2011-05-22 19:36:31.000000000 -0400
28902@@ -950,8 +950,8 @@ static int i810_dma_vertex(struct drm_de
28903 dma->buflist[vertex->idx],
28904 vertex->discard, vertex->used);
28905
28906- atomic_add(vertex->used, &dev->counts[_DRM_STAT_SECONDARY]);
28907- atomic_inc(&dev->counts[_DRM_STAT_DMA]);
28908+ atomic_add_unchecked(vertex->used, &dev->counts[_DRM_STAT_SECONDARY]);
28909+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_DMA]);
28910 sarea_priv->last_enqueue = dev_priv->counter - 1;
28911 sarea_priv->last_dispatch = (int)hw_status[5];
28912
28913@@ -1111,8 +1111,8 @@ static int i810_dma_mc(struct drm_device
28914 i810_dma_dispatch_mc(dev, dma->buflist[mc->idx], mc->used,
28915 mc->last_render);
28916
28917- atomic_add(mc->used, &dev->counts[_DRM_STAT_SECONDARY]);
28918- atomic_inc(&dev->counts[_DRM_STAT_DMA]);
28919+ atomic_add_unchecked(mc->used, &dev->counts[_DRM_STAT_SECONDARY]);
28920+ atomic_inc_unchecked(&dev->counts[_DRM_STAT_DMA]);
28921 sarea_priv->last_enqueue = dev_priv->counter - 1;
28922 sarea_priv->last_dispatch = (int)hw_status[5];
28923
28924diff -urNp linux-2.6.39/drivers/gpu/drm/i810/i810_drv.h linux-2.6.39/drivers/gpu/drm/i810/i810_drv.h
28925--- linux-2.6.39/drivers/gpu/drm/i810/i810_drv.h 2011-05-19 00:06:34.000000000 -0400
28926+++ linux-2.6.39/drivers/gpu/drm/i810/i810_drv.h 2011-05-22 19:36:31.000000000 -0400
28927@@ -108,8 +108,8 @@ typedef struct drm_i810_private {
28928 int page_flipping;
28929
28930 wait_queue_head_t irq_queue;
28931- atomic_t irq_received;
28932- atomic_t irq_emitted;
28933+ atomic_unchecked_t irq_received;
28934+ atomic_unchecked_t irq_emitted;
28935
28936 int front_offset;
28937 } drm_i810_private_t;
28938diff -urNp linux-2.6.39/drivers/gpu/drm/i915/dvo_ch7017.c linux-2.6.39/drivers/gpu/drm/i915/dvo_ch7017.c
28939--- linux-2.6.39/drivers/gpu/drm/i915/dvo_ch7017.c 2011-05-19 00:06:34.000000000 -0400
28940+++ linux-2.6.39/drivers/gpu/drm/i915/dvo_ch7017.c 2011-05-22 19:36:31.000000000 -0400
28941@@ -390,7 +390,7 @@ static void ch7017_destroy(struct intel_
28942 }
28943 }
28944
28945-struct intel_dvo_dev_ops ch7017_ops = {
28946+const struct intel_dvo_dev_ops ch7017_ops = {
28947 .init = ch7017_init,
28948 .detect = ch7017_detect,
28949 .mode_valid = ch7017_mode_valid,
28950diff -urNp linux-2.6.39/drivers/gpu/drm/i915/dvo_ch7xxx.c linux-2.6.39/drivers/gpu/drm/i915/dvo_ch7xxx.c
28951--- linux-2.6.39/drivers/gpu/drm/i915/dvo_ch7xxx.c 2011-05-19 00:06:34.000000000 -0400
28952+++ linux-2.6.39/drivers/gpu/drm/i915/dvo_ch7xxx.c 2011-05-22 19:36:31.000000000 -0400
28953@@ -320,7 +320,7 @@ static void ch7xxx_destroy(struct intel_
28954 }
28955 }
28956
28957-struct intel_dvo_dev_ops ch7xxx_ops = {
28958+const struct intel_dvo_dev_ops ch7xxx_ops = {
28959 .init = ch7xxx_init,
28960 .detect = ch7xxx_detect,
28961 .mode_valid = ch7xxx_mode_valid,
28962diff -urNp linux-2.6.39/drivers/gpu/drm/i915/dvo.h linux-2.6.39/drivers/gpu/drm/i915/dvo.h
28963--- linux-2.6.39/drivers/gpu/drm/i915/dvo.h 2011-05-19 00:06:34.000000000 -0400
28964+++ linux-2.6.39/drivers/gpu/drm/i915/dvo.h 2011-05-22 19:36:31.000000000 -0400
28965@@ -122,23 +122,23 @@ struct intel_dvo_dev_ops {
28966 *
28967 * \return singly-linked list of modes or NULL if no modes found.
28968 */
28969- struct drm_display_mode *(*get_modes)(struct intel_dvo_device *dvo);
28970+ struct drm_display_mode *(* const get_modes)(struct intel_dvo_device *dvo);
28971
28972 /**
28973 * Clean up driver-specific bits of the output
28974 */
28975- void (*destroy) (struct intel_dvo_device *dvo);
28976+ void (* const destroy) (struct intel_dvo_device *dvo);
28977
28978 /**
28979 * Debugging hook to dump device registers to log file
28980 */
28981- void (*dump_regs)(struct intel_dvo_device *dvo);
28982+ void (* const dump_regs)(struct intel_dvo_device *dvo);
28983 };
28984
28985-extern struct intel_dvo_dev_ops sil164_ops;
28986-extern struct intel_dvo_dev_ops ch7xxx_ops;
28987-extern struct intel_dvo_dev_ops ivch_ops;
28988-extern struct intel_dvo_dev_ops tfp410_ops;
28989-extern struct intel_dvo_dev_ops ch7017_ops;
28990+extern const struct intel_dvo_dev_ops sil164_ops;
28991+extern const struct intel_dvo_dev_ops ch7xxx_ops;
28992+extern const struct intel_dvo_dev_ops ivch_ops;
28993+extern const struct intel_dvo_dev_ops tfp410_ops;
28994+extern const struct intel_dvo_dev_ops ch7017_ops;
28995
28996 #endif /* _INTEL_DVO_H */
28997diff -urNp linux-2.6.39/drivers/gpu/drm/i915/dvo_ivch.c linux-2.6.39/drivers/gpu/drm/i915/dvo_ivch.c
28998--- linux-2.6.39/drivers/gpu/drm/i915/dvo_ivch.c 2011-05-19 00:06:34.000000000 -0400
28999+++ linux-2.6.39/drivers/gpu/drm/i915/dvo_ivch.c 2011-05-22 19:36:31.000000000 -0400
29000@@ -410,7 +410,7 @@ static void ivch_destroy(struct intel_dv
29001 }
29002 }
29003
29004-struct intel_dvo_dev_ops ivch_ops= {
29005+const struct intel_dvo_dev_ops ivch_ops= {
29006 .init = ivch_init,
29007 .dpms = ivch_dpms,
29008 .mode_valid = ivch_mode_valid,
29009diff -urNp linux-2.6.39/drivers/gpu/drm/i915/dvo_sil164.c linux-2.6.39/drivers/gpu/drm/i915/dvo_sil164.c
29010--- linux-2.6.39/drivers/gpu/drm/i915/dvo_sil164.c 2011-05-19 00:06:34.000000000 -0400
29011+++ linux-2.6.39/drivers/gpu/drm/i915/dvo_sil164.c 2011-05-22 19:36:31.000000000 -0400
29012@@ -252,7 +252,7 @@ static void sil164_destroy(struct intel_
29013 }
29014 }
29015
29016-struct intel_dvo_dev_ops sil164_ops = {
29017+const struct intel_dvo_dev_ops sil164_ops = {
29018 .init = sil164_init,
29019 .detect = sil164_detect,
29020 .mode_valid = sil164_mode_valid,
29021diff -urNp linux-2.6.39/drivers/gpu/drm/i915/dvo_tfp410.c linux-2.6.39/drivers/gpu/drm/i915/dvo_tfp410.c
29022--- linux-2.6.39/drivers/gpu/drm/i915/dvo_tfp410.c 2011-05-19 00:06:34.000000000 -0400
29023+++ linux-2.6.39/drivers/gpu/drm/i915/dvo_tfp410.c 2011-05-22 19:36:31.000000000 -0400
29024@@ -293,7 +293,7 @@ static void tfp410_destroy(struct intel_
29025 }
29026 }
29027
29028-struct intel_dvo_dev_ops tfp410_ops = {
29029+const struct intel_dvo_dev_ops tfp410_ops = {
29030 .init = tfp410_init,
29031 .detect = tfp410_detect,
29032 .mode_valid = tfp410_mode_valid,
29033diff -urNp linux-2.6.39/drivers/gpu/drm/i915/i915_debugfs.c linux-2.6.39/drivers/gpu/drm/i915/i915_debugfs.c
29034--- linux-2.6.39/drivers/gpu/drm/i915/i915_debugfs.c 2011-05-19 00:06:34.000000000 -0400
29035+++ linux-2.6.39/drivers/gpu/drm/i915/i915_debugfs.c 2011-05-22 19:36:31.000000000 -0400
29036@@ -496,7 +496,7 @@ static int i915_interrupt_info(struct se
29037 I915_READ(GTIMR));
29038 }
29039 seq_printf(m, "Interrupts received: %d\n",
29040- atomic_read(&dev_priv->irq_received));
29041+ atomic_read_unchecked(&dev_priv->irq_received));
29042 for (i = 0; i < I915_NUM_RINGS; i++) {
29043 if (IS_GEN6(dev)) {
29044 seq_printf(m, "Graphics Interrupt mask (%s): %08x\n",
29045diff -urNp linux-2.6.39/drivers/gpu/drm/i915/i915_dma.c linux-2.6.39/drivers/gpu/drm/i915/i915_dma.c
29046--- linux-2.6.39/drivers/gpu/drm/i915/i915_dma.c 2011-05-19 00:06:34.000000000 -0400
29047+++ linux-2.6.39/drivers/gpu/drm/i915/i915_dma.c 2011-05-22 19:36:31.000000000 -0400
29048@@ -1171,7 +1171,7 @@ static bool i915_switcheroo_can_switch(s
29049 bool can_switch;
29050
29051 spin_lock(&dev->count_lock);
29052- can_switch = (dev->open_count == 0);
29053+ can_switch = (local_read(&dev->open_count) == 0);
29054 spin_unlock(&dev->count_lock);
29055 return can_switch;
29056 }
29057diff -urNp linux-2.6.39/drivers/gpu/drm/i915/i915_drv.c linux-2.6.39/drivers/gpu/drm/i915/i915_drv.c
29058--- linux-2.6.39/drivers/gpu/drm/i915/i915_drv.c 2011-05-19 00:06:34.000000000 -0400
29059+++ linux-2.6.39/drivers/gpu/drm/i915/i915_drv.c 2011-05-22 19:36:31.000000000 -0400
29060@@ -679,7 +679,7 @@ static const struct dev_pm_ops i915_pm_o
29061 .restore = i915_pm_resume,
29062 };
29063
29064-static struct vm_operations_struct i915_gem_vm_ops = {
29065+static const struct vm_operations_struct i915_gem_vm_ops = {
29066 .fault = i915_gem_fault,
29067 .open = drm_gem_vm_open,
29068 .close = drm_gem_vm_close,
29069diff -urNp linux-2.6.39/drivers/gpu/drm/i915/i915_drv.h linux-2.6.39/drivers/gpu/drm/i915/i915_drv.h
29070--- linux-2.6.39/drivers/gpu/drm/i915/i915_drv.h 2011-05-19 00:06:34.000000000 -0400
29071+++ linux-2.6.39/drivers/gpu/drm/i915/i915_drv.h 2011-05-22 19:36:31.000000000 -0400
29072@@ -287,7 +287,7 @@ typedef struct drm_i915_private {
29073 int current_page;
29074 int page_flipping;
29075
29076- atomic_t irq_received;
29077+ atomic_unchecked_t irq_received;
29078
29079 /* protects the irq masks */
29080 spinlock_t irq_lock;
29081@@ -848,7 +848,7 @@ struct drm_i915_gem_object {
29082 * will be page flipped away on the next vblank. When it
29083 * reaches 0, dev_priv->pending_flip_queue will be woken up.
29084 */
29085- atomic_t pending_flip;
29086+ atomic_unchecked_t pending_flip;
29087 };
29088
29089 #define to_intel_bo(x) container_of(x, struct drm_i915_gem_object, base)
29090@@ -1232,7 +1232,7 @@ extern int intel_setup_gmbus(struct drm_
29091 extern void intel_teardown_gmbus(struct drm_device *dev);
29092 extern void intel_gmbus_set_speed(struct i2c_adapter *adapter, int speed);
29093 extern void intel_gmbus_force_bit(struct i2c_adapter *adapter, bool force_bit);
29094-extern inline bool intel_gmbus_is_forced_bit(struct i2c_adapter *adapter)
29095+static inline bool intel_gmbus_is_forced_bit(struct i2c_adapter *adapter)
29096 {
29097 return container_of(adapter, struct intel_gmbus, adapter)->force_bit;
29098 }
29099diff -urNp linux-2.6.39/drivers/gpu/drm/i915/i915_gem_execbuffer.c linux-2.6.39/drivers/gpu/drm/i915/i915_gem_execbuffer.c
29100--- linux-2.6.39/drivers/gpu/drm/i915/i915_gem_execbuffer.c 2011-05-19 00:06:34.000000000 -0400
29101+++ linux-2.6.39/drivers/gpu/drm/i915/i915_gem_execbuffer.c 2011-05-22 19:36:31.000000000 -0400
29102@@ -192,7 +192,7 @@ i915_gem_object_set_to_gpu_domain(struct
29103 i915_gem_release_mmap(obj);
29104
29105 if (obj->base.pending_write_domain)
29106- cd->flips |= atomic_read(&obj->pending_flip);
29107+ cd->flips |= atomic_read_unchecked(&obj->pending_flip);
29108
29109 /* The actual obj->write_domain will be updated with
29110 * pending_write_domain after we emit the accumulated flush for all
29111diff -urNp linux-2.6.39/drivers/gpu/drm/i915/i915_irq.c linux-2.6.39/drivers/gpu/drm/i915/i915_irq.c
29112--- linux-2.6.39/drivers/gpu/drm/i915/i915_irq.c 2011-05-19 00:06:34.000000000 -0400
29113+++ linux-2.6.39/drivers/gpu/drm/i915/i915_irq.c 2011-05-22 19:36:31.000000000 -0400
29114@@ -1101,7 +1101,7 @@ irqreturn_t i915_driver_irq_handler(DRM_
29115 int ret = IRQ_NONE, pipe;
29116 bool blc_event = false;
29117
29118- atomic_inc(&dev_priv->irq_received);
29119+ atomic_inc_unchecked(&dev_priv->irq_received);
29120
29121 if (HAS_PCH_SPLIT(dev))
29122 return ironlake_irq_handler(dev);
29123@@ -1655,7 +1655,7 @@ void i915_driver_irq_preinstall(struct d
29124 drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
29125 int pipe;
29126
29127- atomic_set(&dev_priv->irq_received, 0);
29128+ atomic_set_unchecked(&dev_priv->irq_received, 0);
29129
29130 INIT_WORK(&dev_priv->hotplug_work, i915_hotplug_work_func);
29131 INIT_WORK(&dev_priv->error_work, i915_error_work_func);
29132diff -urNp linux-2.6.39/drivers/gpu/drm/i915/intel_display.c linux-2.6.39/drivers/gpu/drm/i915/intel_display.c
29133--- linux-2.6.39/drivers/gpu/drm/i915/intel_display.c 2011-05-19 00:06:34.000000000 -0400
29134+++ linux-2.6.39/drivers/gpu/drm/i915/intel_display.c 2011-05-22 19:36:31.000000000 -0400
29135@@ -2244,7 +2244,7 @@ intel_pipe_set_base(struct drm_crtc *crt
29136
29137 wait_event(dev_priv->pending_flip_queue,
29138 atomic_read(&dev_priv->mm.wedged) ||
29139- atomic_read(&obj->pending_flip) == 0);
29140+ atomic_read_unchecked(&obj->pending_flip) == 0);
29141
29142 /* Big Hammer, we also need to ensure that any pending
29143 * MI_WAIT_FOR_EVENT inside a user batch buffer on the
29144@@ -2712,7 +2712,7 @@ static void intel_crtc_wait_for_pending_
29145 obj = to_intel_framebuffer(crtc->fb)->obj;
29146 dev_priv = crtc->dev->dev_private;
29147 wait_event(dev_priv->pending_flip_queue,
29148- atomic_read(&obj->pending_flip) == 0);
29149+ atomic_read_unchecked(&obj->pending_flip) == 0);
29150 }
29151
29152 static bool intel_crtc_driving_pch(struct drm_crtc *crtc)
29153@@ -6016,7 +6016,7 @@ static void do_intel_finish_page_flip(st
29154
29155 atomic_clear_mask(1 << intel_crtc->plane,
29156 &obj->pending_flip.counter);
29157- if (atomic_read(&obj->pending_flip) == 0)
29158+ if (atomic_read_unchecked(&obj->pending_flip) == 0)
29159 wake_up(&dev_priv->pending_flip_queue);
29160
29161 schedule_work(&work->work);
29162@@ -6145,7 +6145,7 @@ static int intel_crtc_page_flip(struct d
29163 /* Block clients from rendering to the new back buffer until
29164 * the flip occurs and the object is no longer visible.
29165 */
29166- atomic_add(1 << intel_crtc->plane, &work->old_fb_obj->pending_flip);
29167+ atomic_add_unchecked(1 << intel_crtc->plane, &work->old_fb_obj->pending_flip);
29168
29169 switch (INTEL_INFO(dev)->gen) {
29170 case 2:
29171diff -urNp linux-2.6.39/drivers/gpu/drm/mga/mga_drv.h linux-2.6.39/drivers/gpu/drm/mga/mga_drv.h
29172--- linux-2.6.39/drivers/gpu/drm/mga/mga_drv.h 2011-05-19 00:06:34.000000000 -0400
29173+++ linux-2.6.39/drivers/gpu/drm/mga/mga_drv.h 2011-05-22 19:36:31.000000000 -0400
29174@@ -120,9 +120,9 @@ typedef struct drm_mga_private {
29175 u32 clear_cmd;
29176 u32 maccess;
29177
29178- atomic_t vbl_received; /**< Number of vblanks received. */
29179+ atomic_unchecked_t vbl_received; /**< Number of vblanks received. */
29180 wait_queue_head_t fence_queue;
29181- atomic_t last_fence_retired;
29182+ atomic_unchecked_t last_fence_retired;
29183 u32 next_fence_to_post;
29184
29185 unsigned int fb_cpp;
29186diff -urNp linux-2.6.39/drivers/gpu/drm/mga/mga_irq.c linux-2.6.39/drivers/gpu/drm/mga/mga_irq.c
29187--- linux-2.6.39/drivers/gpu/drm/mga/mga_irq.c 2011-05-19 00:06:34.000000000 -0400
29188+++ linux-2.6.39/drivers/gpu/drm/mga/mga_irq.c 2011-05-22 19:36:31.000000000 -0400
29189@@ -44,7 +44,7 @@ u32 mga_get_vblank_counter(struct drm_de
29190 if (crtc != 0)
29191 return 0;
29192
29193- return atomic_read(&dev_priv->vbl_received);
29194+ return atomic_read_unchecked(&dev_priv->vbl_received);
29195 }
29196
29197
29198@@ -60,7 +60,7 @@ irqreturn_t mga_driver_irq_handler(DRM_I
29199 /* VBLANK interrupt */
29200 if (status & MGA_VLINEPEN) {
29201 MGA_WRITE(MGA_ICLEAR, MGA_VLINEICLR);
29202- atomic_inc(&dev_priv->vbl_received);
29203+ atomic_inc_unchecked(&dev_priv->vbl_received);
29204 drm_handle_vblank(dev, 0);
29205 handled = 1;
29206 }
29207@@ -79,7 +79,7 @@ irqreturn_t mga_driver_irq_handler(DRM_I
29208 if ((prim_start & ~0x03) != (prim_end & ~0x03))
29209 MGA_WRITE(MGA_PRIMEND, prim_end);
29210
29211- atomic_inc(&dev_priv->last_fence_retired);
29212+ atomic_inc_unchecked(&dev_priv->last_fence_retired);
29213 DRM_WAKEUP(&dev_priv->fence_queue);
29214 handled = 1;
29215 }
29216@@ -130,7 +130,7 @@ int mga_driver_fence_wait(struct drm_dev
29217 * using fences.
29218 */
29219 DRM_WAIT_ON(ret, dev_priv->fence_queue, 3 * DRM_HZ,
29220- (((cur_fence = atomic_read(&dev_priv->last_fence_retired))
29221+ (((cur_fence = atomic_read_unchecked(&dev_priv->last_fence_retired))
29222 - *sequence) <= (1 << 23)));
29223
29224 *sequence = cur_fence;
29225diff -urNp linux-2.6.39/drivers/gpu/drm/nouveau/nouveau_acpi.c linux-2.6.39/drivers/gpu/drm/nouveau/nouveau_acpi.c
29226--- linux-2.6.39/drivers/gpu/drm/nouveau/nouveau_acpi.c 2011-05-19 00:06:34.000000000 -0400
29227+++ linux-2.6.39/drivers/gpu/drm/nouveau/nouveau_acpi.c 2011-05-22 19:36:31.000000000 -0400
29228@@ -141,7 +141,7 @@ static int nouveau_dsm_get_client_id(str
29229 return VGA_SWITCHEROO_DIS;
29230 }
29231
29232-static struct vga_switcheroo_handler nouveau_dsm_handler = {
29233+static const struct vga_switcheroo_handler nouveau_dsm_handler = {
29234 .switchto = nouveau_dsm_switchto,
29235 .power_state = nouveau_dsm_power_state,
29236 .init = nouveau_dsm_init,
29237diff -urNp linux-2.6.39/drivers/gpu/drm/nouveau/nouveau_drv.h linux-2.6.39/drivers/gpu/drm/nouveau/nouveau_drv.h
29238--- linux-2.6.39/drivers/gpu/drm/nouveau/nouveau_drv.h 2011-05-19 00:06:34.000000000 -0400
29239+++ linux-2.6.39/drivers/gpu/drm/nouveau/nouveau_drv.h 2011-05-23 17:07:00.000000000 -0400
29240@@ -228,7 +228,7 @@ struct nouveau_channel {
29241 struct list_head pending;
29242 uint32_t sequence;
29243 uint32_t sequence_ack;
29244- atomic_t last_sequence_irq;
29245+ atomic_unchecked_t last_sequence_irq;
29246 } fence;
29247
29248 /* DMA push buffer */
29249@@ -520,8 +520,8 @@ struct nouveau_vram_engine {
29250
29251 struct nouveau_engine {
29252 struct nouveau_instmem_engine instmem;
29253- struct nouveau_mc_engine mc;
29254- struct nouveau_timer_engine timer;
29255+ struct nouveau_mc_engine mc;
29256+ struct nouveau_timer_engine timer;
29257 struct nouveau_fb_engine fb;
29258 struct nouveau_pgraph_engine graph;
29259 struct nouveau_fifo_engine fifo;
29260@@ -529,7 +529,7 @@ struct nouveau_engine {
29261 struct nouveau_gpio_engine gpio;
29262 struct nouveau_pm_engine pm;
29263 struct nouveau_crypt_engine crypt;
29264- struct nouveau_vram_engine vram;
29265+ struct nouveau_vram_engine vram;
29266 };
29267
29268 struct nouveau_pll_vals {
29269@@ -662,7 +662,7 @@ struct drm_nouveau_private {
29270 struct drm_global_reference mem_global_ref;
29271 struct ttm_bo_global_ref bo_global_ref;
29272 struct ttm_bo_device bdev;
29273- atomic_t validate_sequence;
29274+ atomic_unchecked_t validate_sequence;
29275 } ttm;
29276
29277 struct {
29278diff -urNp linux-2.6.39/drivers/gpu/drm/nouveau/nouveau_fence.c linux-2.6.39/drivers/gpu/drm/nouveau/nouveau_fence.c
29279--- linux-2.6.39/drivers/gpu/drm/nouveau/nouveau_fence.c 2011-05-19 00:06:34.000000000 -0400
29280+++ linux-2.6.39/drivers/gpu/drm/nouveau/nouveau_fence.c 2011-05-22 19:36:31.000000000 -0400
29281@@ -85,7 +85,7 @@ nouveau_fence_update(struct nouveau_chan
29282 if (USE_REFCNT(dev))
29283 sequence = nvchan_rd32(chan, 0x48);
29284 else
29285- sequence = atomic_read(&chan->fence.last_sequence_irq);
29286+ sequence = atomic_read_unchecked(&chan->fence.last_sequence_irq);
29287
29288 if (chan->fence.sequence_ack == sequence)
29289 goto out;
29290@@ -553,7 +553,7 @@ nouveau_fence_channel_init(struct nouvea
29291 out_initialised:
29292 INIT_LIST_HEAD(&chan->fence.pending);
29293 spin_lock_init(&chan->fence.lock);
29294- atomic_set(&chan->fence.last_sequence_irq, 0);
29295+ atomic_set_unchecked(&chan->fence.last_sequence_irq, 0);
29296 return 0;
29297 }
29298
29299diff -urNp linux-2.6.39/drivers/gpu/drm/nouveau/nouveau_gem.c linux-2.6.39/drivers/gpu/drm/nouveau/nouveau_gem.c
29300--- linux-2.6.39/drivers/gpu/drm/nouveau/nouveau_gem.c 2011-05-19 00:06:34.000000000 -0400
29301+++ linux-2.6.39/drivers/gpu/drm/nouveau/nouveau_gem.c 2011-05-22 19:36:31.000000000 -0400
29302@@ -249,7 +249,7 @@ validate_init(struct nouveau_channel *ch
29303 int trycnt = 0;
29304 int ret, i;
29305
29306- sequence = atomic_add_return(1, &dev_priv->ttm.validate_sequence);
29307+ sequence = atomic_add_return_unchecked(1, &dev_priv->ttm.validate_sequence);
29308 retry:
29309 if (++trycnt > 100000) {
29310 NV_ERROR(dev, "%s failed and gave up.\n", __func__);
29311diff -urNp linux-2.6.39/drivers/gpu/drm/nouveau/nouveau_state.c linux-2.6.39/drivers/gpu/drm/nouveau/nouveau_state.c
29312--- linux-2.6.39/drivers/gpu/drm/nouveau/nouveau_state.c 2011-05-19 00:06:34.000000000 -0400
29313+++ linux-2.6.39/drivers/gpu/drm/nouveau/nouveau_state.c 2011-05-22 19:36:31.000000000 -0400
29314@@ -583,7 +583,7 @@ static bool nouveau_switcheroo_can_switc
29315 bool can_switch;
29316
29317 spin_lock(&dev->count_lock);
29318- can_switch = (dev->open_count == 0);
29319+ can_switch = (local_read(&dev->open_count) == 0);
29320 spin_unlock(&dev->count_lock);
29321 return can_switch;
29322 }
29323diff -urNp linux-2.6.39/drivers/gpu/drm/nouveau/nv04_graph.c linux-2.6.39/drivers/gpu/drm/nouveau/nv04_graph.c
29324--- linux-2.6.39/drivers/gpu/drm/nouveau/nv04_graph.c 2011-05-19 00:06:34.000000000 -0400
29325+++ linux-2.6.39/drivers/gpu/drm/nouveau/nv04_graph.c 2011-05-22 19:36:31.000000000 -0400
29326@@ -552,7 +552,7 @@ static int
29327 nv04_graph_mthd_set_ref(struct nouveau_channel *chan,
29328 u32 class, u32 mthd, u32 data)
29329 {
29330- atomic_set(&chan->fence.last_sequence_irq, data);
29331+ atomic_set_unchecked(&chan->fence.last_sequence_irq, data);
29332 return 0;
29333 }
29334
29335diff -urNp linux-2.6.39/drivers/gpu/drm/r128/r128_cce.c linux-2.6.39/drivers/gpu/drm/r128/r128_cce.c
29336--- linux-2.6.39/drivers/gpu/drm/r128/r128_cce.c 2011-05-19 00:06:34.000000000 -0400
29337+++ linux-2.6.39/drivers/gpu/drm/r128/r128_cce.c 2011-05-22 19:36:31.000000000 -0400
29338@@ -377,7 +377,7 @@ static int r128_do_init_cce(struct drm_d
29339
29340 /* GH: Simple idle check.
29341 */
29342- atomic_set(&dev_priv->idle_count, 0);
29343+ atomic_set_unchecked(&dev_priv->idle_count, 0);
29344
29345 /* We don't support anything other than bus-mastering ring mode,
29346 * but the ring can be in either AGP or PCI space for the ring
29347diff -urNp linux-2.6.39/drivers/gpu/drm/r128/r128_drv.h linux-2.6.39/drivers/gpu/drm/r128/r128_drv.h
29348--- linux-2.6.39/drivers/gpu/drm/r128/r128_drv.h 2011-05-19 00:06:34.000000000 -0400
29349+++ linux-2.6.39/drivers/gpu/drm/r128/r128_drv.h 2011-05-22 19:36:31.000000000 -0400
29350@@ -90,14 +90,14 @@ typedef struct drm_r128_private {
29351 int is_pci;
29352 unsigned long cce_buffers_offset;
29353
29354- atomic_t idle_count;
29355+ atomic_unchecked_t idle_count;
29356
29357 int page_flipping;
29358 int current_page;
29359 u32 crtc_offset;
29360 u32 crtc_offset_cntl;
29361
29362- atomic_t vbl_received;
29363+ atomic_unchecked_t vbl_received;
29364
29365 u32 color_fmt;
29366 unsigned int front_offset;
29367diff -urNp linux-2.6.39/drivers/gpu/drm/r128/r128_irq.c linux-2.6.39/drivers/gpu/drm/r128/r128_irq.c
29368--- linux-2.6.39/drivers/gpu/drm/r128/r128_irq.c 2011-05-19 00:06:34.000000000 -0400
29369+++ linux-2.6.39/drivers/gpu/drm/r128/r128_irq.c 2011-05-22 19:36:31.000000000 -0400
29370@@ -42,7 +42,7 @@ u32 r128_get_vblank_counter(struct drm_d
29371 if (crtc != 0)
29372 return 0;
29373
29374- return atomic_read(&dev_priv->vbl_received);
29375+ return atomic_read_unchecked(&dev_priv->vbl_received);
29376 }
29377
29378 irqreturn_t r128_driver_irq_handler(DRM_IRQ_ARGS)
29379@@ -56,7 +56,7 @@ irqreturn_t r128_driver_irq_handler(DRM_
29380 /* VBLANK interrupt */
29381 if (status & R128_CRTC_VBLANK_INT) {
29382 R128_WRITE(R128_GEN_INT_STATUS, R128_CRTC_VBLANK_INT_AK);
29383- atomic_inc(&dev_priv->vbl_received);
29384+ atomic_inc_unchecked(&dev_priv->vbl_received);
29385 drm_handle_vblank(dev, 0);
29386 return IRQ_HANDLED;
29387 }
29388diff -urNp linux-2.6.39/drivers/gpu/drm/r128/r128_state.c linux-2.6.39/drivers/gpu/drm/r128/r128_state.c
29389--- linux-2.6.39/drivers/gpu/drm/r128/r128_state.c 2011-05-19 00:06:34.000000000 -0400
29390+++ linux-2.6.39/drivers/gpu/drm/r128/r128_state.c 2011-05-22 19:36:31.000000000 -0400
29391@@ -321,10 +321,10 @@ static void r128_clear_box(drm_r128_priv
29392
29393 static void r128_cce_performance_boxes(drm_r128_private_t *dev_priv)
29394 {
29395- if (atomic_read(&dev_priv->idle_count) == 0)
29396+ if (atomic_read_unchecked(&dev_priv->idle_count) == 0)
29397 r128_clear_box(dev_priv, 64, 4, 8, 8, 0, 255, 0);
29398 else
29399- atomic_set(&dev_priv->idle_count, 0);
29400+ atomic_set_unchecked(&dev_priv->idle_count, 0);
29401 }
29402
29403 #endif
29404diff -urNp linux-2.6.39/drivers/gpu/drm/radeon/atom.c linux-2.6.39/drivers/gpu/drm/radeon/atom.c
29405--- linux-2.6.39/drivers/gpu/drm/radeon/atom.c 2011-05-19 00:06:34.000000000 -0400
29406+++ linux-2.6.39/drivers/gpu/drm/radeon/atom.c 2011-05-22 19:36:31.000000000 -0400
29407@@ -1245,6 +1245,8 @@ struct atom_context *atom_parse(struct c
29408 char name[512];
29409 int i;
29410
29411+ pax_track_stack();
29412+
29413 ctx->card = card;
29414 ctx->bios = bios;
29415
29416diff -urNp linux-2.6.39/drivers/gpu/drm/radeon/mkregtable.c linux-2.6.39/drivers/gpu/drm/radeon/mkregtable.c
29417--- linux-2.6.39/drivers/gpu/drm/radeon/mkregtable.c 2011-05-19 00:06:34.000000000 -0400
29418+++ linux-2.6.39/drivers/gpu/drm/radeon/mkregtable.c 2011-05-22 19:36:31.000000000 -0400
29419@@ -637,14 +637,14 @@ static int parser_auth(struct table *t,
29420 regex_t mask_rex;
29421 regmatch_t match[4];
29422 char buf[1024];
29423- size_t end;
29424+ long end;
29425 int len;
29426 int done = 0;
29427 int r;
29428 unsigned o;
29429 struct offset *offset;
29430 char last_reg_s[10];
29431- int last_reg;
29432+ unsigned long last_reg;
29433
29434 if (regcomp
29435 (&mask_rex, "(0x[0-9a-fA-F]*) *([_a-zA-Z0-9]*)", REG_EXTENDED)) {
29436diff -urNp linux-2.6.39/drivers/gpu/drm/radeon/radeon_atombios.c linux-2.6.39/drivers/gpu/drm/radeon/radeon_atombios.c
29437--- linux-2.6.39/drivers/gpu/drm/radeon/radeon_atombios.c 2011-05-19 00:06:34.000000000 -0400
29438+++ linux-2.6.39/drivers/gpu/drm/radeon/radeon_atombios.c 2011-05-22 19:36:31.000000000 -0400
29439@@ -545,6 +545,8 @@ bool radeon_get_atom_connector_info_from
29440 struct radeon_gpio_rec gpio;
29441 struct radeon_hpd hpd;
29442
29443+ pax_track_stack();
29444+
29445 if (!atom_parse_data_header(ctx, index, &size, &frev, &crev, &data_offset))
29446 return false;
29447
29448diff -urNp linux-2.6.39/drivers/gpu/drm/radeon/radeon_atpx_handler.c linux-2.6.39/drivers/gpu/drm/radeon/radeon_atpx_handler.c
29449--- linux-2.6.39/drivers/gpu/drm/radeon/radeon_atpx_handler.c 2011-05-19 00:06:34.000000000 -0400
29450+++ linux-2.6.39/drivers/gpu/drm/radeon/radeon_atpx_handler.c 2011-05-22 19:36:31.000000000 -0400
29451@@ -234,7 +234,7 @@ static int radeon_atpx_get_client_id(str
29452 return VGA_SWITCHEROO_DIS;
29453 }
29454
29455-static struct vga_switcheroo_handler radeon_atpx_handler = {
29456+static const struct vga_switcheroo_handler radeon_atpx_handler = {
29457 .switchto = radeon_atpx_switchto,
29458 .power_state = radeon_atpx_power_state,
29459 .init = radeon_atpx_init,
29460diff -urNp linux-2.6.39/drivers/gpu/drm/radeon/radeon_device.c linux-2.6.39/drivers/gpu/drm/radeon/radeon_device.c
29461--- linux-2.6.39/drivers/gpu/drm/radeon/radeon_device.c 2011-05-19 00:06:34.000000000 -0400
29462+++ linux-2.6.39/drivers/gpu/drm/radeon/radeon_device.c 2011-05-22 19:36:31.000000000 -0400
29463@@ -674,7 +674,7 @@ static bool radeon_switcheroo_can_switch
29464 bool can_switch;
29465
29466 spin_lock(&dev->count_lock);
29467- can_switch = (dev->open_count == 0);
29468+ can_switch = (local_read(&dev->open_count) == 0);
29469 spin_unlock(&dev->count_lock);
29470 return can_switch;
29471 }
29472diff -urNp linux-2.6.39/drivers/gpu/drm/radeon/radeon_display.c linux-2.6.39/drivers/gpu/drm/radeon/radeon_display.c
29473--- linux-2.6.39/drivers/gpu/drm/radeon/radeon_display.c 2011-05-19 00:06:34.000000000 -0400
29474+++ linux-2.6.39/drivers/gpu/drm/radeon/radeon_display.c 2011-05-22 19:36:31.000000000 -0400
29475@@ -934,6 +934,8 @@ void radeon_compute_pll_legacy(struct ra
29476 uint32_t post_div;
29477 u32 pll_out_min, pll_out_max;
29478
29479+ pax_track_stack();
29480+
29481 DRM_DEBUG_KMS("PLL freq %llu %u %u\n", freq, pll->min_ref_div, pll->max_ref_div);
29482 freq = freq * 1000;
29483
29484diff -urNp linux-2.6.39/drivers/gpu/drm/radeon/radeon_drv.h linux-2.6.39/drivers/gpu/drm/radeon/radeon_drv.h
29485--- linux-2.6.39/drivers/gpu/drm/radeon/radeon_drv.h 2011-05-19 00:06:34.000000000 -0400
29486+++ linux-2.6.39/drivers/gpu/drm/radeon/radeon_drv.h 2011-05-22 19:36:31.000000000 -0400
29487@@ -255,7 +255,7 @@ typedef struct drm_radeon_private {
29488
29489 /* SW interrupt */
29490 wait_queue_head_t swi_queue;
29491- atomic_t swi_emitted;
29492+ atomic_unchecked_t swi_emitted;
29493 int vblank_crtc;
29494 uint32_t irq_enable_reg;
29495 uint32_t r500_disp_irq_reg;
29496diff -urNp linux-2.6.39/drivers/gpu/drm/radeon/radeon_fence.c linux-2.6.39/drivers/gpu/drm/radeon/radeon_fence.c
29497--- linux-2.6.39/drivers/gpu/drm/radeon/radeon_fence.c 2011-05-19 00:06:34.000000000 -0400
29498+++ linux-2.6.39/drivers/gpu/drm/radeon/radeon_fence.c 2011-05-22 19:36:31.000000000 -0400
29499@@ -49,7 +49,7 @@ int radeon_fence_emit(struct radeon_devi
29500 write_unlock_irqrestore(&rdev->fence_drv.lock, irq_flags);
29501 return 0;
29502 }
29503- fence->seq = atomic_add_return(1, &rdev->fence_drv.seq);
29504+ fence->seq = atomic_add_return_unchecked(1, &rdev->fence_drv.seq);
29505 if (!rdev->cp.ready) {
29506 /* FIXME: cp is not running assume everythings is done right
29507 * away
29508@@ -352,7 +352,7 @@ int radeon_fence_driver_init(struct rade
29509 return r;
29510 }
29511 WREG32(rdev->fence_drv.scratch_reg, 0);
29512- atomic_set(&rdev->fence_drv.seq, 0);
29513+ atomic_set_unchecked(&rdev->fence_drv.seq, 0);
29514 INIT_LIST_HEAD(&rdev->fence_drv.created);
29515 INIT_LIST_HEAD(&rdev->fence_drv.emited);
29516 INIT_LIST_HEAD(&rdev->fence_drv.signaled);
29517diff -urNp linux-2.6.39/drivers/gpu/drm/radeon/radeon.h linux-2.6.39/drivers/gpu/drm/radeon/radeon.h
29518--- linux-2.6.39/drivers/gpu/drm/radeon/radeon.h 2011-05-19 00:06:34.000000000 -0400
29519+++ linux-2.6.39/drivers/gpu/drm/radeon/radeon.h 2011-05-22 19:36:31.000000000 -0400
29520@@ -189,7 +189,7 @@ extern int sumo_get_temp(struct radeon_d
29521 */
29522 struct radeon_fence_driver {
29523 uint32_t scratch_reg;
29524- atomic_t seq;
29525+ atomic_unchecked_t seq;
29526 uint32_t last_seq;
29527 unsigned long last_jiffies;
29528 unsigned long last_timeout;
29529diff -urNp linux-2.6.39/drivers/gpu/drm/radeon/radeon_ioc32.c linux-2.6.39/drivers/gpu/drm/radeon/radeon_ioc32.c
29530--- linux-2.6.39/drivers/gpu/drm/radeon/radeon_ioc32.c 2011-05-19 00:06:34.000000000 -0400
29531+++ linux-2.6.39/drivers/gpu/drm/radeon/radeon_ioc32.c 2011-05-22 19:36:31.000000000 -0400
29532@@ -359,7 +359,7 @@ static int compat_radeon_cp_setparam(str
29533 request = compat_alloc_user_space(sizeof(*request));
29534 if (!access_ok(VERIFY_WRITE, request, sizeof(*request))
29535 || __put_user(req32.param, &request->param)
29536- || __put_user((void __user *)(unsigned long)req32.value,
29537+ || __put_user((unsigned long)req32.value,
29538 &request->value))
29539 return -EFAULT;
29540
29541diff -urNp linux-2.6.39/drivers/gpu/drm/radeon/radeon_irq.c linux-2.6.39/drivers/gpu/drm/radeon/radeon_irq.c
29542--- linux-2.6.39/drivers/gpu/drm/radeon/radeon_irq.c 2011-05-19 00:06:34.000000000 -0400
29543+++ linux-2.6.39/drivers/gpu/drm/radeon/radeon_irq.c 2011-05-22 19:36:31.000000000 -0400
29544@@ -225,8 +225,8 @@ static int radeon_emit_irq(struct drm_de
29545 unsigned int ret;
29546 RING_LOCALS;
29547
29548- atomic_inc(&dev_priv->swi_emitted);
29549- ret = atomic_read(&dev_priv->swi_emitted);
29550+ atomic_inc_unchecked(&dev_priv->swi_emitted);
29551+ ret = atomic_read_unchecked(&dev_priv->swi_emitted);
29552
29553 BEGIN_RING(4);
29554 OUT_RING_REG(RADEON_LAST_SWI_REG, ret);
29555@@ -352,7 +352,7 @@ int radeon_driver_irq_postinstall(struct
29556 drm_radeon_private_t *dev_priv =
29557 (drm_radeon_private_t *) dev->dev_private;
29558
29559- atomic_set(&dev_priv->swi_emitted, 0);
29560+ atomic_set_unchecked(&dev_priv->swi_emitted, 0);
29561 DRM_INIT_WAITQUEUE(&dev_priv->swi_queue);
29562
29563 dev->max_vblank_count = 0x001fffff;
29564diff -urNp linux-2.6.39/drivers/gpu/drm/radeon/radeon_state.c linux-2.6.39/drivers/gpu/drm/radeon/radeon_state.c
29565--- linux-2.6.39/drivers/gpu/drm/radeon/radeon_state.c 2011-05-19 00:06:34.000000000 -0400
29566+++ linux-2.6.39/drivers/gpu/drm/radeon/radeon_state.c 2011-05-22 19:36:31.000000000 -0400
29567@@ -2168,7 +2168,7 @@ static int radeon_cp_clear(struct drm_de
29568 if (sarea_priv->nbox > RADEON_NR_SAREA_CLIPRECTS)
29569 sarea_priv->nbox = RADEON_NR_SAREA_CLIPRECTS;
29570
29571- if (DRM_COPY_FROM_USER(&depth_boxes, clear->depth_boxes,
29572+ if (sarea_priv->nbox > RADEON_NR_SAREA_CLIPRECTS || DRM_COPY_FROM_USER(&depth_boxes, clear->depth_boxes,
29573 sarea_priv->nbox * sizeof(depth_boxes[0])))
29574 return -EFAULT;
29575
29576@@ -3031,7 +3031,7 @@ static int radeon_cp_getparam(struct drm
29577 {
29578 drm_radeon_private_t *dev_priv = dev->dev_private;
29579 drm_radeon_getparam_t *param = data;
29580- int value;
29581+ int value = 0;
29582
29583 DRM_DEBUG("pid=%d\n", DRM_CURRENTPID);
29584
29585diff -urNp linux-2.6.39/drivers/gpu/drm/radeon/radeon_ttm.c linux-2.6.39/drivers/gpu/drm/radeon/radeon_ttm.c
29586--- linux-2.6.39/drivers/gpu/drm/radeon/radeon_ttm.c 2011-05-19 00:06:34.000000000 -0400
29587+++ linux-2.6.39/drivers/gpu/drm/radeon/radeon_ttm.c 2011-05-22 19:36:31.000000000 -0400
29588@@ -603,8 +603,9 @@ void radeon_ttm_set_active_vram_size(str
29589 man->size = size >> PAGE_SHIFT;
29590 }
29591
29592-static struct vm_operations_struct radeon_ttm_vm_ops;
29593-static const struct vm_operations_struct *ttm_vm_ops = NULL;
29594+extern int ttm_bo_vm_fault(struct vm_area_struct *vma, struct vm_fault *vmf);
29595+extern void ttm_bo_vm_open(struct vm_area_struct *vma);
29596+extern void ttm_bo_vm_close(struct vm_area_struct *vma);
29597
29598 static int radeon_ttm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
29599 {
29600@@ -612,17 +613,22 @@ static int radeon_ttm_fault(struct vm_ar
29601 struct radeon_device *rdev;
29602 int r;
29603
29604- bo = (struct ttm_buffer_object *)vma->vm_private_data;
29605- if (bo == NULL) {
29606+ bo = (struct ttm_buffer_object *)vma->vm_private_data;
29607+ if (!bo)
29608 return VM_FAULT_NOPAGE;
29609- }
29610 rdev = radeon_get_rdev(bo->bdev);
29611 mutex_lock(&rdev->vram_mutex);
29612- r = ttm_vm_ops->fault(vma, vmf);
29613+ r = ttm_bo_vm_fault(vma, vmf);
29614 mutex_unlock(&rdev->vram_mutex);
29615 return r;
29616 }
29617
29618+static const struct vm_operations_struct radeon_ttm_vm_ops = {
29619+ .fault = radeon_ttm_fault,
29620+ .open = ttm_bo_vm_open,
29621+ .close = ttm_bo_vm_close
29622+};
29623+
29624 int radeon_mmap(struct file *filp, struct vm_area_struct *vma)
29625 {
29626 struct drm_file *file_priv;
29627@@ -635,18 +641,11 @@ int radeon_mmap(struct file *filp, struc
29628
29629 file_priv = filp->private_data;
29630 rdev = file_priv->minor->dev->dev_private;
29631- if (rdev == NULL) {
29632+ if (!rdev)
29633 return -EINVAL;
29634- }
29635 r = ttm_bo_mmap(filp, vma, &rdev->mman.bdev);
29636- if (unlikely(r != 0)) {
29637+ if (r)
29638 return r;
29639- }
29640- if (unlikely(ttm_vm_ops == NULL)) {
29641- ttm_vm_ops = vma->vm_ops;
29642- radeon_ttm_vm_ops = *ttm_vm_ops;
29643- radeon_ttm_vm_ops.fault = &radeon_ttm_fault;
29644- }
29645 vma->vm_ops = &radeon_ttm_vm_ops;
29646 return 0;
29647 }
29648diff -urNp linux-2.6.39/drivers/gpu/drm/radeon/rs690.c linux-2.6.39/drivers/gpu/drm/radeon/rs690.c
29649--- linux-2.6.39/drivers/gpu/drm/radeon/rs690.c 2011-05-19 00:06:34.000000000 -0400
29650+++ linux-2.6.39/drivers/gpu/drm/radeon/rs690.c 2011-05-22 19:36:31.000000000 -0400
29651@@ -304,9 +304,11 @@ void rs690_crtc_bandwidth_compute(struct
29652 if (rdev->pm.max_bandwidth.full > rdev->pm.sideport_bandwidth.full &&
29653 rdev->pm.sideport_bandwidth.full)
29654 rdev->pm.max_bandwidth = rdev->pm.sideport_bandwidth;
29655- read_delay_latency.full = dfixed_const(370 * 800 * 1000);
29656+ read_delay_latency.full = dfixed_const(800 * 1000);
29657 read_delay_latency.full = dfixed_div(read_delay_latency,
29658 rdev->pm.igp_sideport_mclk);
29659+ a.full = dfixed_const(370);
29660+ read_delay_latency.full = dfixed_mul(read_delay_latency, a);
29661 } else {
29662 if (rdev->pm.max_bandwidth.full > rdev->pm.k8_bandwidth.full &&
29663 rdev->pm.k8_bandwidth.full)
29664diff -urNp linux-2.6.39/drivers/gpu/drm/ttm/ttm_bo_vm.c linux-2.6.39/drivers/gpu/drm/ttm/ttm_bo_vm.c
29665--- linux-2.6.39/drivers/gpu/drm/ttm/ttm_bo_vm.c 2011-05-19 00:06:34.000000000 -0400
29666+++ linux-2.6.39/drivers/gpu/drm/ttm/ttm_bo_vm.c 2011-05-22 19:36:31.000000000 -0400
29667@@ -69,11 +69,11 @@ static struct ttm_buffer_object *ttm_bo_
29668 return best_bo;
29669 }
29670
29671-static int ttm_bo_vm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
29672+int ttm_bo_vm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
29673 {
29674 struct ttm_buffer_object *bo = (struct ttm_buffer_object *)
29675 vma->vm_private_data;
29676- struct ttm_bo_device *bdev = bo->bdev;
29677+ struct ttm_bo_device *bdev;
29678 unsigned long page_offset;
29679 unsigned long page_last;
29680 unsigned long pfn;
29681@@ -83,8 +83,12 @@ static int ttm_bo_vm_fault(struct vm_are
29682 int i;
29683 unsigned long address = (unsigned long)vmf->virtual_address;
29684 int retval = VM_FAULT_NOPAGE;
29685- struct ttm_mem_type_manager *man =
29686- &bdev->man[bo->mem.mem_type];
29687+ struct ttm_mem_type_manager *man;
29688+
29689+ if (!bo)
29690+ return VM_FAULT_NOPAGE;
29691+ bdev = bo->bdev;
29692+ man = &bdev->man[bo->mem.mem_type];
29693
29694 /*
29695 * Work around locking order reversal in fault / nopfn
29696@@ -219,22 +223,25 @@ out_unlock:
29697 ttm_bo_unreserve(bo);
29698 return retval;
29699 }
29700+EXPORT_SYMBOL(ttm_bo_vm_fault);
29701
29702-static void ttm_bo_vm_open(struct vm_area_struct *vma)
29703+void ttm_bo_vm_open(struct vm_area_struct *vma)
29704 {
29705 struct ttm_buffer_object *bo =
29706 (struct ttm_buffer_object *)vma->vm_private_data;
29707
29708 (void)ttm_bo_reference(bo);
29709 }
29710+EXPORT_SYMBOL(ttm_bo_vm_open);
29711
29712-static void ttm_bo_vm_close(struct vm_area_struct *vma)
29713+void ttm_bo_vm_close(struct vm_area_struct *vma)
29714 {
29715 struct ttm_buffer_object *bo = (struct ttm_buffer_object *)vma->vm_private_data;
29716
29717 ttm_bo_unref(&bo);
29718 vma->vm_private_data = NULL;
29719 }
29720+EXPORT_SYMBOL(ttm_bo_vm_close);
29721
29722 static const struct vm_operations_struct ttm_bo_vm_ops = {
29723 .fault = ttm_bo_vm_fault,
29724diff -urNp linux-2.6.39/drivers/gpu/drm/ttm/ttm_page_alloc.c linux-2.6.39/drivers/gpu/drm/ttm/ttm_page_alloc.c
29725--- linux-2.6.39/drivers/gpu/drm/ttm/ttm_page_alloc.c 2011-05-19 00:06:34.000000000 -0400
29726+++ linux-2.6.39/drivers/gpu/drm/ttm/ttm_page_alloc.c 2011-05-22 19:36:31.000000000 -0400
29727@@ -397,9 +397,9 @@ static int ttm_pool_get_num_unused_pages
29728 */
29729 static int ttm_pool_mm_shrink(struct shrinker *shrink, int shrink_pages, gfp_t gfp_mask)
29730 {
29731- static atomic_t start_pool = ATOMIC_INIT(0);
29732+ static atomic_unchecked_t start_pool = ATOMIC_INIT(0);
29733 unsigned i;
29734- unsigned pool_offset = atomic_add_return(1, &start_pool);
29735+ unsigned pool_offset = atomic_add_return_unchecked(1, &start_pool);
29736 struct ttm_page_pool *pool;
29737
29738 pool_offset = pool_offset % NUM_POOLS;
29739diff -urNp linux-2.6.39/drivers/gpu/drm/via/via_drv.h linux-2.6.39/drivers/gpu/drm/via/via_drv.h
29740--- linux-2.6.39/drivers/gpu/drm/via/via_drv.h 2011-05-19 00:06:34.000000000 -0400
29741+++ linux-2.6.39/drivers/gpu/drm/via/via_drv.h 2011-05-22 19:36:31.000000000 -0400
29742@@ -51,7 +51,7 @@ typedef struct drm_via_ring_buffer {
29743 typedef uint32_t maskarray_t[5];
29744
29745 typedef struct drm_via_irq {
29746- atomic_t irq_received;
29747+ atomic_unchecked_t irq_received;
29748 uint32_t pending_mask;
29749 uint32_t enable_mask;
29750 wait_queue_head_t irq_queue;
29751@@ -75,7 +75,7 @@ typedef struct drm_via_private {
29752 struct timeval last_vblank;
29753 int last_vblank_valid;
29754 unsigned usec_per_vblank;
29755- atomic_t vbl_received;
29756+ atomic_unchecked_t vbl_received;
29757 drm_via_state_t hc_state;
29758 char pci_buf[VIA_PCI_BUF_SIZE];
29759 const uint32_t *fire_offsets[VIA_FIRE_BUF_SIZE];
29760diff -urNp linux-2.6.39/drivers/gpu/drm/via/via_irq.c linux-2.6.39/drivers/gpu/drm/via/via_irq.c
29761--- linux-2.6.39/drivers/gpu/drm/via/via_irq.c 2011-05-19 00:06:34.000000000 -0400
29762+++ linux-2.6.39/drivers/gpu/drm/via/via_irq.c 2011-05-22 19:36:31.000000000 -0400
29763@@ -102,7 +102,7 @@ u32 via_get_vblank_counter(struct drm_de
29764 if (crtc != 0)
29765 return 0;
29766
29767- return atomic_read(&dev_priv->vbl_received);
29768+ return atomic_read_unchecked(&dev_priv->vbl_received);
29769 }
29770
29771 irqreturn_t via_driver_irq_handler(DRM_IRQ_ARGS)
29772@@ -117,8 +117,8 @@ irqreturn_t via_driver_irq_handler(DRM_I
29773
29774 status = VIA_READ(VIA_REG_INTERRUPT);
29775 if (status & VIA_IRQ_VBLANK_PENDING) {
29776- atomic_inc(&dev_priv->vbl_received);
29777- if (!(atomic_read(&dev_priv->vbl_received) & 0x0F)) {
29778+ atomic_inc_unchecked(&dev_priv->vbl_received);
29779+ if (!(atomic_read_unchecked(&dev_priv->vbl_received) & 0x0F)) {
29780 do_gettimeofday(&cur_vblank);
29781 if (dev_priv->last_vblank_valid) {
29782 dev_priv->usec_per_vblank =
29783@@ -128,7 +128,7 @@ irqreturn_t via_driver_irq_handler(DRM_I
29784 dev_priv->last_vblank = cur_vblank;
29785 dev_priv->last_vblank_valid = 1;
29786 }
29787- if (!(atomic_read(&dev_priv->vbl_received) & 0xFF)) {
29788+ if (!(atomic_read_unchecked(&dev_priv->vbl_received) & 0xFF)) {
29789 DRM_DEBUG("US per vblank is: %u\n",
29790 dev_priv->usec_per_vblank);
29791 }
29792@@ -138,7 +138,7 @@ irqreturn_t via_driver_irq_handler(DRM_I
29793
29794 for (i = 0; i < dev_priv->num_irqs; ++i) {
29795 if (status & cur_irq->pending_mask) {
29796- atomic_inc(&cur_irq->irq_received);
29797+ atomic_inc_unchecked(&cur_irq->irq_received);
29798 DRM_WAKEUP(&cur_irq->irq_queue);
29799 handled = 1;
29800 if (dev_priv->irq_map[drm_via_irq_dma0_td] == i)
29801@@ -243,11 +243,11 @@ via_driver_irq_wait(struct drm_device *d
29802 DRM_WAIT_ON(ret, cur_irq->irq_queue, 3 * DRM_HZ,
29803 ((VIA_READ(masks[irq][2]) & masks[irq][3]) ==
29804 masks[irq][4]));
29805- cur_irq_sequence = atomic_read(&cur_irq->irq_received);
29806+ cur_irq_sequence = atomic_read_unchecked(&cur_irq->irq_received);
29807 } else {
29808 DRM_WAIT_ON(ret, cur_irq->irq_queue, 3 * DRM_HZ,
29809 (((cur_irq_sequence =
29810- atomic_read(&cur_irq->irq_received)) -
29811+ atomic_read_unchecked(&cur_irq->irq_received)) -
29812 *sequence) <= (1 << 23)));
29813 }
29814 *sequence = cur_irq_sequence;
29815@@ -285,7 +285,7 @@ void via_driver_irq_preinstall(struct dr
29816 }
29817
29818 for (i = 0; i < dev_priv->num_irqs; ++i) {
29819- atomic_set(&cur_irq->irq_received, 0);
29820+ atomic_set_unchecked(&cur_irq->irq_received, 0);
29821 cur_irq->enable_mask = dev_priv->irq_masks[i][0];
29822 cur_irq->pending_mask = dev_priv->irq_masks[i][1];
29823 DRM_INIT_WAITQUEUE(&cur_irq->irq_queue);
29824@@ -367,7 +367,7 @@ int via_wait_irq(struct drm_device *dev,
29825 switch (irqwait->request.type & ~VIA_IRQ_FLAGS_MASK) {
29826 case VIA_IRQ_RELATIVE:
29827 irqwait->request.sequence +=
29828- atomic_read(&cur_irq->irq_received);
29829+ atomic_read_unchecked(&cur_irq->irq_received);
29830 irqwait->request.type &= ~_DRM_VBLANK_RELATIVE;
29831 case VIA_IRQ_ABSOLUTE:
29832 break;
29833diff -urNp linux-2.6.39/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h linux-2.6.39/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
29834--- linux-2.6.39/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h 2011-05-19 00:06:34.000000000 -0400
29835+++ linux-2.6.39/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h 2011-05-22 19:36:31.000000000 -0400
29836@@ -240,7 +240,7 @@ struct vmw_private {
29837 * Fencing and IRQs.
29838 */
29839
29840- atomic_t fence_seq;
29841+ atomic_unchecked_t fence_seq;
29842 wait_queue_head_t fence_queue;
29843 wait_queue_head_t fifo_queue;
29844 atomic_t fence_queue_waiters;
29845diff -urNp linux-2.6.39/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c linux-2.6.39/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
29846--- linux-2.6.39/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c 2011-05-19 00:06:34.000000000 -0400
29847+++ linux-2.6.39/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c 2011-05-22 19:36:31.000000000 -0400
29848@@ -151,7 +151,7 @@ int vmw_wait_lag(struct vmw_private *dev
29849 while (!vmw_lag_lt(queue, us)) {
29850 spin_lock(&queue->lock);
29851 if (list_empty(&queue->head))
29852- sequence = atomic_read(&dev_priv->fence_seq);
29853+ sequence = atomic_read_unchecked(&dev_priv->fence_seq);
29854 else {
29855 fence = list_first_entry(&queue->head,
29856 struct vmw_fence, head);
29857diff -urNp linux-2.6.39/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c linux-2.6.39/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
29858--- linux-2.6.39/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c 2011-05-19 00:06:34.000000000 -0400
29859+++ linux-2.6.39/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c 2011-05-22 19:36:31.000000000 -0400
29860@@ -137,7 +137,7 @@ int vmw_fifo_init(struct vmw_private *de
29861 (unsigned int) min,
29862 (unsigned int) fifo->capabilities);
29863
29864- atomic_set(&dev_priv->fence_seq, dev_priv->last_read_sequence);
29865+ atomic_set_unchecked(&dev_priv->fence_seq, dev_priv->last_read_sequence);
29866 iowrite32(dev_priv->last_read_sequence, fifo_mem + SVGA_FIFO_FENCE);
29867 vmw_fence_queue_init(&fifo->fence_queue);
29868 return vmw_fifo_send_fence(dev_priv, &dummy);
29869@@ -476,7 +476,7 @@ int vmw_fifo_send_fence(struct vmw_priva
29870
29871 fm = vmw_fifo_reserve(dev_priv, bytes);
29872 if (unlikely(fm == NULL)) {
29873- *sequence = atomic_read(&dev_priv->fence_seq);
29874+ *sequence = atomic_read_unchecked(&dev_priv->fence_seq);
29875 ret = -ENOMEM;
29876 (void)vmw_fallback_wait(dev_priv, false, true, *sequence,
29877 false, 3*HZ);
29878@@ -484,7 +484,7 @@ int vmw_fifo_send_fence(struct vmw_priva
29879 }
29880
29881 do {
29882- *sequence = atomic_add_return(1, &dev_priv->fence_seq);
29883+ *sequence = atomic_add_return_unchecked(1, &dev_priv->fence_seq);
29884 } while (*sequence == 0);
29885
29886 if (!(fifo_state->capabilities & SVGA_FIFO_CAP_FENCE)) {
29887@@ -534,7 +534,7 @@ static int vmw_fifo_vm_fault(struct vm_a
29888 return VM_FAULT_SIGBUS;
29889 }
29890
29891-static struct vm_operations_struct vmw_fifo_vm_ops = {
29892+static const struct vm_operations_struct vmw_fifo_vm_ops = {
29893 .fault = vmw_fifo_vm_fault,
29894 .open = NULL,
29895 .close = NULL
29896diff -urNp linux-2.6.39/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c linux-2.6.39/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c
29897--- linux-2.6.39/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c 2011-05-19 00:06:34.000000000 -0400
29898+++ linux-2.6.39/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c 2011-05-22 19:36:31.000000000 -0400
29899@@ -100,7 +100,7 @@ bool vmw_fence_signaled(struct vmw_priva
29900 * emitted. Then the fence is stale and signaled.
29901 */
29902
29903- ret = ((atomic_read(&dev_priv->fence_seq) - sequence)
29904+ ret = ((atomic_read_unchecked(&dev_priv->fence_seq) - sequence)
29905 > VMW_FENCE_WRAP);
29906
29907 return ret;
29908@@ -131,7 +131,7 @@ int vmw_fallback_wait(struct vmw_private
29909
29910 if (fifo_idle)
29911 down_read(&fifo_state->rwsem);
29912- signal_seq = atomic_read(&dev_priv->fence_seq);
29913+ signal_seq = atomic_read_unchecked(&dev_priv->fence_seq);
29914 ret = 0;
29915
29916 for (;;) {
29917diff -urNp linux-2.6.39/drivers/gpu/vga/vga_switcheroo.c linux-2.6.39/drivers/gpu/vga/vga_switcheroo.c
29918--- linux-2.6.39/drivers/gpu/vga/vga_switcheroo.c 2011-05-19 00:06:34.000000000 -0400
29919+++ linux-2.6.39/drivers/gpu/vga/vga_switcheroo.c 2011-05-22 19:36:31.000000000 -0400
29920@@ -53,7 +53,7 @@ struct vgasr_priv {
29921 int registered_clients;
29922 struct vga_switcheroo_client clients[VGA_SWITCHEROO_MAX_CLIENTS];
29923
29924- struct vga_switcheroo_handler *handler;
29925+ const struct vga_switcheroo_handler *handler;
29926 };
29927
29928 static int vga_switcheroo_debugfs_init(struct vgasr_priv *priv);
29929@@ -62,7 +62,7 @@ static void vga_switcheroo_debugfs_fini(
29930 /* only one switcheroo per system */
29931 static struct vgasr_priv vgasr_priv;
29932
29933-int vga_switcheroo_register_handler(struct vga_switcheroo_handler *handler)
29934+int vga_switcheroo_register_handler(const struct vga_switcheroo_handler *handler)
29935 {
29936 mutex_lock(&vgasr_mutex);
29937 if (vgasr_priv.handler) {
29938diff -urNp linux-2.6.39/drivers/hid/hid-core.c linux-2.6.39/drivers/hid/hid-core.c
29939--- linux-2.6.39/drivers/hid/hid-core.c 2011-05-19 00:06:34.000000000 -0400
29940+++ linux-2.6.39/drivers/hid/hid-core.c 2011-05-22 19:36:31.000000000 -0400
29941@@ -1888,7 +1888,7 @@ static bool hid_ignore(struct hid_device
29942
29943 int hid_add_device(struct hid_device *hdev)
29944 {
29945- static atomic_t id = ATOMIC_INIT(0);
29946+ static atomic_unchecked_t id = ATOMIC_INIT(0);
29947 int ret;
29948
29949 if (WARN_ON(hdev->status & HID_STAT_ADDED))
29950@@ -1903,7 +1903,7 @@ int hid_add_device(struct hid_device *hd
29951 /* XXX hack, any other cleaner solution after the driver core
29952 * is converted to allow more than 20 bytes as the device name? */
29953 dev_set_name(&hdev->dev, "%04X:%04X:%04X.%04X", hdev->bus,
29954- hdev->vendor, hdev->product, atomic_inc_return(&id));
29955+ hdev->vendor, hdev->product, atomic_inc_return_unchecked(&id));
29956
29957 hid_debug_register(hdev, dev_name(&hdev->dev));
29958 ret = device_add(&hdev->dev);
29959diff -urNp linux-2.6.39/drivers/hid/hid-picolcd.c linux-2.6.39/drivers/hid/hid-picolcd.c
29960--- linux-2.6.39/drivers/hid/hid-picolcd.c 2011-05-19 00:06:34.000000000 -0400
29961+++ linux-2.6.39/drivers/hid/hid-picolcd.c 2011-05-22 19:36:31.000000000 -0400
29962@@ -1037,7 +1037,7 @@ static int picolcd_check_lcd_fb(struct l
29963 return fb && fb == picolcd_fbinfo((struct picolcd_data *)lcd_get_data(ldev));
29964 }
29965
29966-static struct lcd_ops picolcd_lcdops = {
29967+static const struct lcd_ops picolcd_lcdops = {
29968 .get_contrast = picolcd_get_contrast,
29969 .set_contrast = picolcd_set_contrast,
29970 .check_fb = picolcd_check_lcd_fb,
29971diff -urNp linux-2.6.39/drivers/hid/usbhid/hiddev.c linux-2.6.39/drivers/hid/usbhid/hiddev.c
29972--- linux-2.6.39/drivers/hid/usbhid/hiddev.c 2011-05-19 00:06:34.000000000 -0400
29973+++ linux-2.6.39/drivers/hid/usbhid/hiddev.c 2011-05-22 19:36:31.000000000 -0400
29974@@ -613,7 +613,7 @@ static long hiddev_ioctl(struct file *fi
29975 break;
29976
29977 case HIDIOCAPPLICATION:
29978- if (arg < 0 || arg >= hid->maxapplication)
29979+ if (arg >= hid->maxapplication)
29980 break;
29981
29982 for (i = 0; i < hid->maxcollection; i++)
29983diff -urNp linux-2.6.39/drivers/hwmon/ibmaem.c linux-2.6.39/drivers/hwmon/ibmaem.c
29984--- linux-2.6.39/drivers/hwmon/ibmaem.c 2011-05-19 00:06:34.000000000 -0400
29985+++ linux-2.6.39/drivers/hwmon/ibmaem.c 2011-05-22 19:36:31.000000000 -0400
29986@@ -238,7 +238,7 @@ struct aem_read_sensor_resp {
29987 struct aem_driver_data {
29988 struct list_head aem_devices;
29989 struct ipmi_smi_watcher bmc_events;
29990- struct ipmi_user_hndl ipmi_hndlrs;
29991+ const struct ipmi_user_hndl ipmi_hndlrs;
29992 };
29993
29994 static void aem_register_bmc(int iface, struct device *dev);
29995diff -urNp linux-2.6.39/drivers/hwmon/ibmpex.c linux-2.6.39/drivers/hwmon/ibmpex.c
29996--- linux-2.6.39/drivers/hwmon/ibmpex.c 2011-05-19 00:06:34.000000000 -0400
29997+++ linux-2.6.39/drivers/hwmon/ibmpex.c 2011-05-22 19:36:31.000000000 -0400
29998@@ -110,7 +110,7 @@ struct ibmpex_bmc_data {
29999 struct ibmpex_driver_data {
30000 struct list_head bmc_data;
30001 struct ipmi_smi_watcher bmc_events;
30002- struct ipmi_user_hndl ipmi_hndlrs;
30003+ const struct ipmi_user_hndl ipmi_hndlrs;
30004 };
30005
30006 static struct ibmpex_driver_data driver_data = {
30007diff -urNp linux-2.6.39/drivers/hwmon/sht15.c linux-2.6.39/drivers/hwmon/sht15.c
30008--- linux-2.6.39/drivers/hwmon/sht15.c 2011-05-19 00:06:34.000000000 -0400
30009+++ linux-2.6.39/drivers/hwmon/sht15.c 2011-05-22 19:36:31.000000000 -0400
30010@@ -113,7 +113,7 @@ struct sht15_data {
30011 int supply_uV;
30012 int supply_uV_valid;
30013 struct work_struct update_supply_work;
30014- atomic_t interrupt_handled;
30015+ atomic_unchecked_t interrupt_handled;
30016 };
30017
30018 /**
30019@@ -246,13 +246,13 @@ static inline int sht15_update_single_va
30020 return ret;
30021
30022 gpio_direction_input(data->pdata->gpio_data);
30023- atomic_set(&data->interrupt_handled, 0);
30024+ atomic_set_unchecked(&data->interrupt_handled, 0);
30025
30026 enable_irq(gpio_to_irq(data->pdata->gpio_data));
30027 if (gpio_get_value(data->pdata->gpio_data) == 0) {
30028 disable_irq_nosync(gpio_to_irq(data->pdata->gpio_data));
30029 /* Only relevant if the interrupt hasn't occurred. */
30030- if (!atomic_read(&data->interrupt_handled))
30031+ if (!atomic_read_unchecked(&data->interrupt_handled))
30032 schedule_work(&data->read_work);
30033 }
30034 ret = wait_event_timeout(data->wait_queue,
30035@@ -399,7 +399,7 @@ static irqreturn_t sht15_interrupt_fired
30036 struct sht15_data *data = d;
30037 /* First disable the interrupt */
30038 disable_irq_nosync(irq);
30039- atomic_inc(&data->interrupt_handled);
30040+ atomic_inc_unchecked(&data->interrupt_handled);
30041 /* Then schedule a reading work struct */
30042 if (data->flag != SHT15_READING_NOTHING)
30043 schedule_work(&data->read_work);
30044@@ -450,11 +450,11 @@ static void sht15_bh_read_data(struct wo
30045 here as could have gone low in meantime so verify
30046 it hasn't!
30047 */
30048- atomic_set(&data->interrupt_handled, 0);
30049+ atomic_set_unchecked(&data->interrupt_handled, 0);
30050 enable_irq(gpio_to_irq(data->pdata->gpio_data));
30051 /* If still not occurred or another handler has been scheduled */
30052 if (gpio_get_value(data->pdata->gpio_data)
30053- || atomic_read(&data->interrupt_handled))
30054+ || atomic_read_unchecked(&data->interrupt_handled))
30055 return;
30056 }
30057 /* Read the data back from the device */
30058diff -urNp linux-2.6.39/drivers/hwmon/w83791d.c linux-2.6.39/drivers/hwmon/w83791d.c
30059--- linux-2.6.39/drivers/hwmon/w83791d.c 2011-05-19 00:06:34.000000000 -0400
30060+++ linux-2.6.39/drivers/hwmon/w83791d.c 2011-05-22 19:36:31.000000000 -0400
30061@@ -329,8 +329,8 @@ static int w83791d_detect(struct i2c_cli
30062 struct i2c_board_info *info);
30063 static int w83791d_remove(struct i2c_client *client);
30064
30065-static int w83791d_read(struct i2c_client *client, u8 register);
30066-static int w83791d_write(struct i2c_client *client, u8 register, u8 value);
30067+static int w83791d_read(struct i2c_client *client, u8 reg);
30068+static int w83791d_write(struct i2c_client *client, u8 reg, u8 value);
30069 static struct w83791d_data *w83791d_update_device(struct device *dev);
30070
30071 #ifdef DEBUG
30072diff -urNp linux-2.6.39/drivers/i2c/busses/i2c-at91.c linux-2.6.39/drivers/i2c/busses/i2c-at91.c
30073--- linux-2.6.39/drivers/i2c/busses/i2c-at91.c 2011-05-19 00:06:34.000000000 -0400
30074+++ linux-2.6.39/drivers/i2c/busses/i2c-at91.c 2011-05-22 19:36:31.000000000 -0400
30075@@ -181,7 +181,7 @@ static u32 at91_func(struct i2c_adapter
30076 return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL;
30077 }
30078
30079-static struct i2c_algorithm at91_algorithm = {
30080+static const struct i2c_algorithm at91_algorithm = {
30081 .master_xfer = at91_xfer,
30082 .functionality = at91_func,
30083 };
30084diff -urNp linux-2.6.39/drivers/i2c/busses/i2c-bfin-twi.c linux-2.6.39/drivers/i2c/busses/i2c-bfin-twi.c
30085--- linux-2.6.39/drivers/i2c/busses/i2c-bfin-twi.c 2011-05-19 00:06:34.000000000 -0400
30086+++ linux-2.6.39/drivers/i2c/busses/i2c-bfin-twi.c 2011-05-22 19:36:31.000000000 -0400
30087@@ -599,7 +599,7 @@ static u32 bfin_twi_functionality(struct
30088 I2C_FUNC_I2C | I2C_FUNC_SMBUS_I2C_BLOCK;
30089 }
30090
30091-static struct i2c_algorithm bfin_twi_algorithm = {
30092+static const struct i2c_algorithm bfin_twi_algorithm = {
30093 .master_xfer = bfin_twi_master_xfer,
30094 .smbus_xfer = bfin_twi_smbus_xfer,
30095 .functionality = bfin_twi_functionality,
30096diff -urNp linux-2.6.39/drivers/i2c/busses/i2c-davinci.c linux-2.6.39/drivers/i2c/busses/i2c-davinci.c
30097--- linux-2.6.39/drivers/i2c/busses/i2c-davinci.c 2011-05-19 00:06:34.000000000 -0400
30098+++ linux-2.6.39/drivers/i2c/busses/i2c-davinci.c 2011-05-22 19:36:31.000000000 -0400
30099@@ -630,7 +630,7 @@ static inline void i2c_davinci_cpufreq_d
30100 }
30101 #endif
30102
30103-static struct i2c_algorithm i2c_davinci_algo = {
30104+static const struct i2c_algorithm i2c_davinci_algo = {
30105 .master_xfer = i2c_davinci_xfer,
30106 .functionality = i2c_davinci_func,
30107 };
30108diff -urNp linux-2.6.39/drivers/i2c/busses/i2c-designware.c linux-2.6.39/drivers/i2c/busses/i2c-designware.c
30109--- linux-2.6.39/drivers/i2c/busses/i2c-designware.c 2011-05-19 00:06:34.000000000 -0400
30110+++ linux-2.6.39/drivers/i2c/busses/i2c-designware.c 2011-05-22 19:36:31.000000000 -0400
30111@@ -689,7 +689,7 @@ tx_aborted:
30112 return IRQ_HANDLED;
30113 }
30114
30115-static struct i2c_algorithm i2c_dw_algo = {
30116+static const struct i2c_algorithm i2c_dw_algo = {
30117 .master_xfer = i2c_dw_xfer,
30118 .functionality = i2c_dw_func,
30119 };
30120diff -urNp linux-2.6.39/drivers/i2c/busses/i2c-eg20t.c linux-2.6.39/drivers/i2c/busses/i2c-eg20t.c
30121--- linux-2.6.39/drivers/i2c/busses/i2c-eg20t.c 2011-05-19 00:06:34.000000000 -0400
30122+++ linux-2.6.39/drivers/i2c/busses/i2c-eg20t.c 2011-05-22 19:36:31.000000000 -0400
30123@@ -708,7 +708,7 @@ static u32 pch_i2c_func(struct i2c_adapt
30124 return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL | I2C_FUNC_10BIT_ADDR;
30125 }
30126
30127-static struct i2c_algorithm pch_algorithm = {
30128+static const struct i2c_algorithm pch_algorithm = {
30129 .master_xfer = pch_i2c_xfer,
30130 .functionality = pch_i2c_func
30131 };
30132diff -urNp linux-2.6.39/drivers/i2c/busses/i2c-imx.c linux-2.6.39/drivers/i2c/busses/i2c-imx.c
30133--- linux-2.6.39/drivers/i2c/busses/i2c-imx.c 2011-05-19 00:06:34.000000000 -0400
30134+++ linux-2.6.39/drivers/i2c/busses/i2c-imx.c 2011-05-22 19:36:31.000000000 -0400
30135@@ -457,7 +457,7 @@ static u32 i2c_imx_func(struct i2c_adapt
30136 return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL;
30137 }
30138
30139-static struct i2c_algorithm i2c_imx_algo = {
30140+static const struct i2c_algorithm i2c_imx_algo = {
30141 .master_xfer = i2c_imx_xfer,
30142 .functionality = i2c_imx_func,
30143 };
30144diff -urNp linux-2.6.39/drivers/i2c/busses/i2c-intel-mid.c linux-2.6.39/drivers/i2c/busses/i2c-intel-mid.c
30145--- linux-2.6.39/drivers/i2c/busses/i2c-intel-mid.c 2011-05-19 00:06:34.000000000 -0400
30146+++ linux-2.6.39/drivers/i2c/busses/i2c-intel-mid.c 2011-05-22 19:36:31.000000000 -0400
30147@@ -917,7 +917,7 @@ err:
30148 return IRQ_HANDLED;
30149 }
30150
30151-static struct i2c_algorithm intel_mid_i2c_algorithm = {
30152+static const struct i2c_algorithm intel_mid_i2c_algorithm = {
30153 .master_xfer = intel_mid_i2c_xfer,
30154 .functionality = intel_mid_i2c_func,
30155 };
30156diff -urNp linux-2.6.39/drivers/i2c/busses/i2c-nforce2.c linux-2.6.39/drivers/i2c/busses/i2c-nforce2.c
30157--- linux-2.6.39/drivers/i2c/busses/i2c-nforce2.c 2011-05-19 00:06:34.000000000 -0400
30158+++ linux-2.6.39/drivers/i2c/busses/i2c-nforce2.c 2011-05-22 19:36:31.000000000 -0400
30159@@ -303,7 +303,7 @@ static u32 nforce2_func(struct i2c_adapt
30160 I2C_FUNC_SMBUS_BLOCK_DATA : 0);
30161 }
30162
30163-static struct i2c_algorithm smbus_algorithm = {
30164+static const struct i2c_algorithm smbus_algorithm = {
30165 .smbus_xfer = nforce2_access,
30166 .functionality = nforce2_func,
30167 };
30168diff -urNp linux-2.6.39/drivers/i2c/busses/i2c-pmcmsp.c linux-2.6.39/drivers/i2c/busses/i2c-pmcmsp.c
30169--- linux-2.6.39/drivers/i2c/busses/i2c-pmcmsp.c 2011-05-19 00:06:34.000000000 -0400
30170+++ linux-2.6.39/drivers/i2c/busses/i2c-pmcmsp.c 2011-05-22 19:36:31.000000000 -0400
30171@@ -615,7 +615,7 @@ static u32 pmcmsptwi_i2c_func(struct i2c
30172
30173 /* -- Initialization -- */
30174
30175-static struct i2c_algorithm pmcmsptwi_algo = {
30176+static const struct i2c_algorithm pmcmsptwi_algo = {
30177 .master_xfer = pmcmsptwi_master_xfer,
30178 .functionality = pmcmsptwi_i2c_func,
30179 };
30180diff -urNp linux-2.6.39/drivers/i2c/busses/i2c-pnx.c linux-2.6.39/drivers/i2c/busses/i2c-pnx.c
30181--- linux-2.6.39/drivers/i2c/busses/i2c-pnx.c 2011-05-19 00:06:34.000000000 -0400
30182+++ linux-2.6.39/drivers/i2c/busses/i2c-pnx.c 2011-05-22 19:36:31.000000000 -0400
30183@@ -535,7 +535,7 @@ static u32 i2c_pnx_func(struct i2c_adapt
30184 return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL;
30185 }
30186
30187-static struct i2c_algorithm pnx_algorithm = {
30188+static const struct i2c_algorithm pnx_algorithm = {
30189 .master_xfer = i2c_pnx_xfer,
30190 .functionality = i2c_pnx_func,
30191 };
30192diff -urNp linux-2.6.39/drivers/i2c/busses/i2c-puv3.c linux-2.6.39/drivers/i2c/busses/i2c-puv3.c
30193--- linux-2.6.39/drivers/i2c/busses/i2c-puv3.c 2011-05-19 00:06:34.000000000 -0400
30194+++ linux-2.6.39/drivers/i2c/busses/i2c-puv3.c 2011-05-22 19:36:31.000000000 -0400
30195@@ -176,7 +176,7 @@ static u32 puv3_i2c_func(struct i2c_adap
30196 return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL;
30197 }
30198
30199-static struct i2c_algorithm puv3_i2c_algorithm = {
30200+static const struct i2c_algorithm puv3_i2c_algorithm = {
30201 .master_xfer = puv3_i2c_xfer,
30202 .functionality = puv3_i2c_func,
30203 };
30204diff -urNp linux-2.6.39/drivers/i2c/busses/i2c-s6000.c linux-2.6.39/drivers/i2c/busses/i2c-s6000.c
30205--- linux-2.6.39/drivers/i2c/busses/i2c-s6000.c 2011-05-19 00:06:34.000000000 -0400
30206+++ linux-2.6.39/drivers/i2c/busses/i2c-s6000.c 2011-05-22 19:36:31.000000000 -0400
30207@@ -243,7 +243,7 @@ static u32 s6i2c_functionality(struct i2
30208 return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL;
30209 }
30210
30211-static struct i2c_algorithm s6i2c_algorithm = {
30212+static const struct i2c_algorithm s6i2c_algorithm = {
30213 .master_xfer = s6i2c_master_xfer,
30214 .functionality = s6i2c_functionality,
30215 };
30216diff -urNp linux-2.6.39/drivers/i2c/busses/i2c-sh_mobile.c linux-2.6.39/drivers/i2c/busses/i2c-sh_mobile.c
30217--- linux-2.6.39/drivers/i2c/busses/i2c-sh_mobile.c 2011-05-19 00:06:34.000000000 -0400
30218+++ linux-2.6.39/drivers/i2c/busses/i2c-sh_mobile.c 2011-05-22 19:36:31.000000000 -0400
30219@@ -529,7 +529,7 @@ static u32 sh_mobile_i2c_func(struct i2c
30220 return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL;
30221 }
30222
30223-static struct i2c_algorithm sh_mobile_i2c_algorithm = {
30224+static const struct i2c_algorithm sh_mobile_i2c_algorithm = {
30225 .functionality = sh_mobile_i2c_func,
30226 .master_xfer = sh_mobile_i2c_xfer,
30227 };
30228diff -urNp linux-2.6.39/drivers/ide/ide-cd.c linux-2.6.39/drivers/ide/ide-cd.c
30229--- linux-2.6.39/drivers/ide/ide-cd.c 2011-05-19 00:06:34.000000000 -0400
30230+++ linux-2.6.39/drivers/ide/ide-cd.c 2011-05-22 19:36:31.000000000 -0400
30231@@ -769,7 +769,7 @@ static void cdrom_do_block_pc(ide_drive_
30232 alignment = queue_dma_alignment(q) | q->dma_pad_mask;
30233 if ((unsigned long)buf & alignment
30234 || blk_rq_bytes(rq) & q->dma_pad_mask
30235- || object_is_on_stack(buf))
30236+ || object_starts_on_stack(buf))
30237 drive->dma = 0;
30238 }
30239 }
30240diff -urNp linux-2.6.39/drivers/ide/ide-floppy.c linux-2.6.39/drivers/ide/ide-floppy.c
30241--- linux-2.6.39/drivers/ide/ide-floppy.c 2011-05-19 00:06:34.000000000 -0400
30242+++ linux-2.6.39/drivers/ide/ide-floppy.c 2011-05-22 19:36:31.000000000 -0400
30243@@ -379,6 +379,8 @@ static int ide_floppy_get_capacity(ide_d
30244 u8 pc_buf[256], header_len, desc_cnt;
30245 int i, rc = 1, blocks, length;
30246
30247+ pax_track_stack();
30248+
30249 ide_debug_log(IDE_DBG_FUNC, "enter");
30250
30251 drive->bios_cyl = 0;
30252diff -urNp linux-2.6.39/drivers/ide/it821x.c linux-2.6.39/drivers/ide/it821x.c
30253--- linux-2.6.39/drivers/ide/it821x.c 2011-05-19 00:06:34.000000000 -0400
30254+++ linux-2.6.39/drivers/ide/it821x.c 2011-05-22 19:36:31.000000000 -0400
30255@@ -508,7 +508,7 @@ static void it821x_quirkproc(ide_drive_t
30256
30257 }
30258
30259-static struct ide_dma_ops it821x_pass_through_dma_ops = {
30260+static const struct ide_dma_ops it821x_pass_through_dma_ops = {
30261 .dma_host_set = ide_dma_host_set,
30262 .dma_setup = ide_dma_setup,
30263 .dma_start = it821x_dma_start,
30264diff -urNp linux-2.6.39/drivers/ide/setup-pci.c linux-2.6.39/drivers/ide/setup-pci.c
30265--- linux-2.6.39/drivers/ide/setup-pci.c 2011-05-19 00:06:34.000000000 -0400
30266+++ linux-2.6.39/drivers/ide/setup-pci.c 2011-05-22 19:36:31.000000000 -0400
30267@@ -542,6 +542,8 @@ int ide_pci_init_two(struct pci_dev *dev
30268 int ret, i, n_ports = dev2 ? 4 : 2;
30269 struct ide_hw hw[4], *hws[] = { NULL, NULL, NULL, NULL };
30270
30271+ pax_track_stack();
30272+
30273 for (i = 0; i < n_ports / 2; i++) {
30274 ret = ide_setup_pci_controller(pdev[i], d, !i);
30275 if (ret < 0)
30276diff -urNp linux-2.6.39/drivers/ide/trm290.c linux-2.6.39/drivers/ide/trm290.c
30277--- linux-2.6.39/drivers/ide/trm290.c 2011-05-19 00:06:34.000000000 -0400
30278+++ linux-2.6.39/drivers/ide/trm290.c 2011-05-22 19:36:31.000000000 -0400
30279@@ -314,7 +314,7 @@ static const struct ide_tp_ops trm290_tp
30280 .output_data = ide_output_data,
30281 };
30282
30283-static struct ide_dma_ops trm290_dma_ops = {
30284+static const struct ide_dma_ops trm290_dma_ops = {
30285 .dma_host_set = trm290_dma_host_set,
30286 .dma_setup = trm290_dma_setup,
30287 .dma_start = trm290_dma_start,
30288diff -urNp linux-2.6.39/drivers/infiniband/core/cm.c linux-2.6.39/drivers/infiniband/core/cm.c
30289--- linux-2.6.39/drivers/infiniband/core/cm.c 2011-05-19 00:06:34.000000000 -0400
30290+++ linux-2.6.39/drivers/infiniband/core/cm.c 2011-05-22 19:36:31.000000000 -0400
30291@@ -113,7 +113,7 @@ static char const counter_group_names[CM
30292
30293 struct cm_counter_group {
30294 struct kobject obj;
30295- atomic_long_t counter[CM_ATTR_COUNT];
30296+ atomic_long_unchecked_t counter[CM_ATTR_COUNT];
30297 };
30298
30299 struct cm_counter_attribute {
30300@@ -1387,7 +1387,7 @@ static void cm_dup_req_handler(struct cm
30301 struct ib_mad_send_buf *msg = NULL;
30302 int ret;
30303
30304- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
30305+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
30306 counter[CM_REQ_COUNTER]);
30307
30308 /* Quick state check to discard duplicate REQs. */
30309@@ -1765,7 +1765,7 @@ static void cm_dup_rep_handler(struct cm
30310 if (!cm_id_priv)
30311 return;
30312
30313- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
30314+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
30315 counter[CM_REP_COUNTER]);
30316 ret = cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg);
30317 if (ret)
30318@@ -1932,7 +1932,7 @@ static int cm_rtu_handler(struct cm_work
30319 if (cm_id_priv->id.state != IB_CM_REP_SENT &&
30320 cm_id_priv->id.state != IB_CM_MRA_REP_RCVD) {
30321 spin_unlock_irq(&cm_id_priv->lock);
30322- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
30323+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
30324 counter[CM_RTU_COUNTER]);
30325 goto out;
30326 }
30327@@ -2115,7 +2115,7 @@ static int cm_dreq_handler(struct cm_wor
30328 cm_id_priv = cm_acquire_id(dreq_msg->remote_comm_id,
30329 dreq_msg->local_comm_id);
30330 if (!cm_id_priv) {
30331- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
30332+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
30333 counter[CM_DREQ_COUNTER]);
30334 cm_issue_drep(work->port, work->mad_recv_wc);
30335 return -EINVAL;
30336@@ -2140,7 +2140,7 @@ static int cm_dreq_handler(struct cm_wor
30337 case IB_CM_MRA_REP_RCVD:
30338 break;
30339 case IB_CM_TIMEWAIT:
30340- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
30341+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
30342 counter[CM_DREQ_COUNTER]);
30343 if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))
30344 goto unlock;
30345@@ -2154,7 +2154,7 @@ static int cm_dreq_handler(struct cm_wor
30346 cm_free_msg(msg);
30347 goto deref;
30348 case IB_CM_DREQ_RCVD:
30349- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
30350+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
30351 counter[CM_DREQ_COUNTER]);
30352 goto unlock;
30353 default:
30354@@ -2521,7 +2521,7 @@ static int cm_mra_handler(struct cm_work
30355 ib_modify_mad(cm_id_priv->av.port->mad_agent,
30356 cm_id_priv->msg, timeout)) {
30357 if (cm_id_priv->id.lap_state == IB_CM_MRA_LAP_RCVD)
30358- atomic_long_inc(&work->port->
30359+ atomic_long_inc_unchecked(&work->port->
30360 counter_group[CM_RECV_DUPLICATES].
30361 counter[CM_MRA_COUNTER]);
30362 goto out;
30363@@ -2530,7 +2530,7 @@ static int cm_mra_handler(struct cm_work
30364 break;
30365 case IB_CM_MRA_REQ_RCVD:
30366 case IB_CM_MRA_REP_RCVD:
30367- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
30368+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
30369 counter[CM_MRA_COUNTER]);
30370 /* fall through */
30371 default:
30372@@ -2692,7 +2692,7 @@ static int cm_lap_handler(struct cm_work
30373 case IB_CM_LAP_IDLE:
30374 break;
30375 case IB_CM_MRA_LAP_SENT:
30376- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
30377+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
30378 counter[CM_LAP_COUNTER]);
30379 if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))
30380 goto unlock;
30381@@ -2708,7 +2708,7 @@ static int cm_lap_handler(struct cm_work
30382 cm_free_msg(msg);
30383 goto deref;
30384 case IB_CM_LAP_RCVD:
30385- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
30386+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
30387 counter[CM_LAP_COUNTER]);
30388 goto unlock;
30389 default:
30390@@ -2992,7 +2992,7 @@ static int cm_sidr_req_handler(struct cm
30391 cur_cm_id_priv = cm_insert_remote_sidr(cm_id_priv);
30392 if (cur_cm_id_priv) {
30393 spin_unlock_irq(&cm.lock);
30394- atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
30395+ atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
30396 counter[CM_SIDR_REQ_COUNTER]);
30397 goto out; /* Duplicate message. */
30398 }
30399@@ -3204,10 +3204,10 @@ static void cm_send_handler(struct ib_ma
30400 if (!msg->context[0] && (attr_index != CM_REJ_COUNTER))
30401 msg->retries = 1;
30402
30403- atomic_long_add(1 + msg->retries,
30404+ atomic_long_add_unchecked(1 + msg->retries,
30405 &port->counter_group[CM_XMIT].counter[attr_index]);
30406 if (msg->retries)
30407- atomic_long_add(msg->retries,
30408+ atomic_long_add_unchecked(msg->retries,
30409 &port->counter_group[CM_XMIT_RETRIES].
30410 counter[attr_index]);
30411
30412@@ -3417,7 +3417,7 @@ static void cm_recv_handler(struct ib_ma
30413 }
30414
30415 attr_id = be16_to_cpu(mad_recv_wc->recv_buf.mad->mad_hdr.attr_id);
30416- atomic_long_inc(&port->counter_group[CM_RECV].
30417+ atomic_long_inc_unchecked(&port->counter_group[CM_RECV].
30418 counter[attr_id - CM_ATTR_ID_OFFSET]);
30419
30420 work = kmalloc(sizeof *work + sizeof(struct ib_sa_path_rec) * paths,
30421@@ -3615,7 +3615,7 @@ static ssize_t cm_show_counter(struct ko
30422 cm_attr = container_of(attr, struct cm_counter_attribute, attr);
30423
30424 return sprintf(buf, "%ld\n",
30425- atomic_long_read(&group->counter[cm_attr->index]));
30426+ atomic_long_read_unchecked(&group->counter[cm_attr->index]));
30427 }
30428
30429 static const struct sysfs_ops cm_counter_ops = {
30430diff -urNp linux-2.6.39/drivers/infiniband/core/fmr_pool.c linux-2.6.39/drivers/infiniband/core/fmr_pool.c
30431--- linux-2.6.39/drivers/infiniband/core/fmr_pool.c 2011-05-19 00:06:34.000000000 -0400
30432+++ linux-2.6.39/drivers/infiniband/core/fmr_pool.c 2011-05-22 19:36:31.000000000 -0400
30433@@ -97,8 +97,8 @@ struct ib_fmr_pool {
30434
30435 struct task_struct *thread;
30436
30437- atomic_t req_ser;
30438- atomic_t flush_ser;
30439+ atomic_unchecked_t req_ser;
30440+ atomic_unchecked_t flush_ser;
30441
30442 wait_queue_head_t force_wait;
30443 };
30444@@ -179,10 +179,10 @@ static int ib_fmr_cleanup_thread(void *p
30445 struct ib_fmr_pool *pool = pool_ptr;
30446
30447 do {
30448- if (atomic_read(&pool->flush_ser) - atomic_read(&pool->req_ser) < 0) {
30449+ if (atomic_read_unchecked(&pool->flush_ser) - atomic_read_unchecked(&pool->req_ser) < 0) {
30450 ib_fmr_batch_release(pool);
30451
30452- atomic_inc(&pool->flush_ser);
30453+ atomic_inc_unchecked(&pool->flush_ser);
30454 wake_up_interruptible(&pool->force_wait);
30455
30456 if (pool->flush_function)
30457@@ -190,7 +190,7 @@ static int ib_fmr_cleanup_thread(void *p
30458 }
30459
30460 set_current_state(TASK_INTERRUPTIBLE);
30461- if (atomic_read(&pool->flush_ser) - atomic_read(&pool->req_ser) >= 0 &&
30462+ if (atomic_read_unchecked(&pool->flush_ser) - atomic_read_unchecked(&pool->req_ser) >= 0 &&
30463 !kthread_should_stop())
30464 schedule();
30465 __set_current_state(TASK_RUNNING);
30466@@ -282,8 +282,8 @@ struct ib_fmr_pool *ib_create_fmr_pool(s
30467 pool->dirty_watermark = params->dirty_watermark;
30468 pool->dirty_len = 0;
30469 spin_lock_init(&pool->pool_lock);
30470- atomic_set(&pool->req_ser, 0);
30471- atomic_set(&pool->flush_ser, 0);
30472+ atomic_set_unchecked(&pool->req_ser, 0);
30473+ atomic_set_unchecked(&pool->flush_ser, 0);
30474 init_waitqueue_head(&pool->force_wait);
30475
30476 pool->thread = kthread_run(ib_fmr_cleanup_thread,
30477@@ -411,11 +411,11 @@ int ib_flush_fmr_pool(struct ib_fmr_pool
30478 }
30479 spin_unlock_irq(&pool->pool_lock);
30480
30481- serial = atomic_inc_return(&pool->req_ser);
30482+ serial = atomic_inc_return_unchecked(&pool->req_ser);
30483 wake_up_process(pool->thread);
30484
30485 if (wait_event_interruptible(pool->force_wait,
30486- atomic_read(&pool->flush_ser) - serial >= 0))
30487+ atomic_read_unchecked(&pool->flush_ser) - serial >= 0))
30488 return -EINTR;
30489
30490 return 0;
30491@@ -525,7 +525,7 @@ int ib_fmr_pool_unmap(struct ib_pool_fmr
30492 } else {
30493 list_add_tail(&fmr->list, &pool->dirty_list);
30494 if (++pool->dirty_len >= pool->dirty_watermark) {
30495- atomic_inc(&pool->req_ser);
30496+ atomic_inc_unchecked(&pool->req_ser);
30497 wake_up_process(pool->thread);
30498 }
30499 }
30500diff -urNp linux-2.6.39/drivers/infiniband/hw/cxgb4/mem.c linux-2.6.39/drivers/infiniband/hw/cxgb4/mem.c
30501--- linux-2.6.39/drivers/infiniband/hw/cxgb4/mem.c 2011-05-19 00:06:34.000000000 -0400
30502+++ linux-2.6.39/drivers/infiniband/hw/cxgb4/mem.c 2011-05-22 19:36:31.000000000 -0400
30503@@ -122,7 +122,7 @@ static int write_tpt_entry(struct c4iw_r
30504 int err;
30505 struct fw_ri_tpte tpt;
30506 u32 stag_idx;
30507- static atomic_t key;
30508+ static atomic_unchecked_t key;
30509
30510 if (c4iw_fatal_error(rdev))
30511 return -EIO;
30512@@ -135,7 +135,7 @@ static int write_tpt_entry(struct c4iw_r
30513 &rdev->resource.tpt_fifo_lock);
30514 if (!stag_idx)
30515 return -ENOMEM;
30516- *stag = (stag_idx << 8) | (atomic_inc_return(&key) & 0xff);
30517+ *stag = (stag_idx << 8) | (atomic_inc_return_unchecked(&key) & 0xff);
30518 }
30519 PDBG("%s stag_state 0x%0x type 0x%0x pdid 0x%0x, stag_idx 0x%x\n",
30520 __func__, stag_state, type, pdid, stag_idx);
30521diff -urNp linux-2.6.39/drivers/infiniband/hw/ipath/ipath_dma.c linux-2.6.39/drivers/infiniband/hw/ipath/ipath_dma.c
30522--- linux-2.6.39/drivers/infiniband/hw/ipath/ipath_dma.c 2011-05-19 00:06:34.000000000 -0400
30523+++ linux-2.6.39/drivers/infiniband/hw/ipath/ipath_dma.c 2011-05-22 19:36:31.000000000 -0400
30524@@ -175,7 +175,7 @@ static void ipath_dma_free_coherent(stru
30525 free_pages((unsigned long) cpu_addr, get_order(size));
30526 }
30527
30528-struct ib_dma_mapping_ops ipath_dma_mapping_ops = {
30529+const struct ib_dma_mapping_ops ipath_dma_mapping_ops = {
30530 ipath_mapping_error,
30531 ipath_dma_map_single,
30532 ipath_dma_unmap_single,
30533diff -urNp linux-2.6.39/drivers/infiniband/hw/ipath/ipath_fs.c linux-2.6.39/drivers/infiniband/hw/ipath/ipath_fs.c
30534--- linux-2.6.39/drivers/infiniband/hw/ipath/ipath_fs.c 2011-05-19 00:06:34.000000000 -0400
30535+++ linux-2.6.39/drivers/infiniband/hw/ipath/ipath_fs.c 2011-05-22 19:36:31.000000000 -0400
30536@@ -113,6 +113,8 @@ static ssize_t atomic_counters_read(stru
30537 struct infinipath_counters counters;
30538 struct ipath_devdata *dd;
30539
30540+ pax_track_stack();
30541+
30542 dd = file->f_path.dentry->d_inode->i_private;
30543 dd->ipath_f_read_counters(dd, &counters);
30544
30545diff -urNp linux-2.6.39/drivers/infiniband/hw/ipath/ipath_rc.c linux-2.6.39/drivers/infiniband/hw/ipath/ipath_rc.c
30546--- linux-2.6.39/drivers/infiniband/hw/ipath/ipath_rc.c 2011-05-19 00:06:34.000000000 -0400
30547+++ linux-2.6.39/drivers/infiniband/hw/ipath/ipath_rc.c 2011-05-22 19:36:31.000000000 -0400
30548@@ -1868,7 +1868,7 @@ void ipath_rc_rcv(struct ipath_ibdev *de
30549 struct ib_atomic_eth *ateth;
30550 struct ipath_ack_entry *e;
30551 u64 vaddr;
30552- atomic64_t *maddr;
30553+ atomic64_unchecked_t *maddr;
30554 u64 sdata;
30555 u32 rkey;
30556 u8 next;
30557@@ -1903,11 +1903,11 @@ void ipath_rc_rcv(struct ipath_ibdev *de
30558 IB_ACCESS_REMOTE_ATOMIC)))
30559 goto nack_acc_unlck;
30560 /* Perform atomic OP and save result. */
30561- maddr = (atomic64_t *) qp->r_sge.sge.vaddr;
30562+ maddr = (atomic64_unchecked_t *) qp->r_sge.sge.vaddr;
30563 sdata = be64_to_cpu(ateth->swap_data);
30564 e = &qp->s_ack_queue[qp->r_head_ack_queue];
30565 e->atomic_data = (opcode == OP(FETCH_ADD)) ?
30566- (u64) atomic64_add_return(sdata, maddr) - sdata :
30567+ (u64) atomic64_add_return_unchecked(sdata, maddr) - sdata :
30568 (u64) cmpxchg((u64 *) qp->r_sge.sge.vaddr,
30569 be64_to_cpu(ateth->compare_data),
30570 sdata);
30571diff -urNp linux-2.6.39/drivers/infiniband/hw/ipath/ipath_ruc.c linux-2.6.39/drivers/infiniband/hw/ipath/ipath_ruc.c
30572--- linux-2.6.39/drivers/infiniband/hw/ipath/ipath_ruc.c 2011-05-19 00:06:34.000000000 -0400
30573+++ linux-2.6.39/drivers/infiniband/hw/ipath/ipath_ruc.c 2011-05-22 19:36:31.000000000 -0400
30574@@ -266,7 +266,7 @@ static void ipath_ruc_loopback(struct ip
30575 unsigned long flags;
30576 struct ib_wc wc;
30577 u64 sdata;
30578- atomic64_t *maddr;
30579+ atomic64_unchecked_t *maddr;
30580 enum ib_wc_status send_status;
30581
30582 /*
30583@@ -382,11 +382,11 @@ again:
30584 IB_ACCESS_REMOTE_ATOMIC)))
30585 goto acc_err;
30586 /* Perform atomic OP and save result. */
30587- maddr = (atomic64_t *) qp->r_sge.sge.vaddr;
30588+ maddr = (atomic64_unchecked_t *) qp->r_sge.sge.vaddr;
30589 sdata = wqe->wr.wr.atomic.compare_add;
30590 *(u64 *) sqp->s_sge.sge.vaddr =
30591 (wqe->wr.opcode == IB_WR_ATOMIC_FETCH_AND_ADD) ?
30592- (u64) atomic64_add_return(sdata, maddr) - sdata :
30593+ (u64) atomic64_add_return_unchecked(sdata, maddr) - sdata :
30594 (u64) cmpxchg((u64 *) qp->r_sge.sge.vaddr,
30595 sdata, wqe->wr.wr.atomic.swap);
30596 goto send_comp;
30597diff -urNp linux-2.6.39/drivers/infiniband/hw/ipath/ipath_verbs.h linux-2.6.39/drivers/infiniband/hw/ipath/ipath_verbs.h
30598--- linux-2.6.39/drivers/infiniband/hw/ipath/ipath_verbs.h 2011-05-19 00:06:34.000000000 -0400
30599+++ linux-2.6.39/drivers/infiniband/hw/ipath/ipath_verbs.h 2011-05-22 19:36:31.000000000 -0400
30600@@ -931,6 +931,6 @@ extern unsigned int ib_ipath_max_srq_wrs
30601
30602 extern const u32 ib_ipath_rnr_table[];
30603
30604-extern struct ib_dma_mapping_ops ipath_dma_mapping_ops;
30605+extern const struct ib_dma_mapping_ops ipath_dma_mapping_ops;
30606
30607 #endif /* IPATH_VERBS_H */
30608diff -urNp linux-2.6.39/drivers/infiniband/hw/nes/nes.c linux-2.6.39/drivers/infiniband/hw/nes/nes.c
30609--- linux-2.6.39/drivers/infiniband/hw/nes/nes.c 2011-05-19 00:06:34.000000000 -0400
30610+++ linux-2.6.39/drivers/infiniband/hw/nes/nes.c 2011-05-22 19:36:31.000000000 -0400
30611@@ -103,7 +103,7 @@ MODULE_PARM_DESC(limit_maxrdreqsz, "Limi
30612 LIST_HEAD(nes_adapter_list);
30613 static LIST_HEAD(nes_dev_list);
30614
30615-atomic_t qps_destroyed;
30616+atomic_unchecked_t qps_destroyed;
30617
30618 static unsigned int ee_flsh_adapter;
30619 static unsigned int sysfs_nonidx_addr;
30620@@ -275,7 +275,7 @@ static void nes_cqp_rem_ref_callback(str
30621 struct nes_qp *nesqp = cqp_request->cqp_callback_pointer;
30622 struct nes_adapter *nesadapter = nesdev->nesadapter;
30623
30624- atomic_inc(&qps_destroyed);
30625+ atomic_inc_unchecked(&qps_destroyed);
30626
30627 /* Free the control structures */
30628
30629diff -urNp linux-2.6.39/drivers/infiniband/hw/nes/nes_cm.c linux-2.6.39/drivers/infiniband/hw/nes/nes_cm.c
30630--- linux-2.6.39/drivers/infiniband/hw/nes/nes_cm.c 2011-05-19 00:06:34.000000000 -0400
30631+++ linux-2.6.39/drivers/infiniband/hw/nes/nes_cm.c 2011-05-22 19:36:31.000000000 -0400
30632@@ -68,14 +68,14 @@ u32 cm_packets_dropped;
30633 u32 cm_packets_retrans;
30634 u32 cm_packets_created;
30635 u32 cm_packets_received;
30636-atomic_t cm_listens_created;
30637-atomic_t cm_listens_destroyed;
30638+atomic_unchecked_t cm_listens_created;
30639+atomic_unchecked_t cm_listens_destroyed;
30640 u32 cm_backlog_drops;
30641-atomic_t cm_loopbacks;
30642-atomic_t cm_nodes_created;
30643-atomic_t cm_nodes_destroyed;
30644-atomic_t cm_accel_dropped_pkts;
30645-atomic_t cm_resets_recvd;
30646+atomic_unchecked_t cm_loopbacks;
30647+atomic_unchecked_t cm_nodes_created;
30648+atomic_unchecked_t cm_nodes_destroyed;
30649+atomic_unchecked_t cm_accel_dropped_pkts;
30650+atomic_unchecked_t cm_resets_recvd;
30651
30652 static inline int mini_cm_accelerated(struct nes_cm_core *,
30653 struct nes_cm_node *);
30654@@ -151,13 +151,13 @@ static struct nes_cm_ops nes_cm_api = {
30655
30656 static struct nes_cm_core *g_cm_core;
30657
30658-atomic_t cm_connects;
30659-atomic_t cm_accepts;
30660-atomic_t cm_disconnects;
30661-atomic_t cm_closes;
30662-atomic_t cm_connecteds;
30663-atomic_t cm_connect_reqs;
30664-atomic_t cm_rejects;
30665+atomic_unchecked_t cm_connects;
30666+atomic_unchecked_t cm_accepts;
30667+atomic_unchecked_t cm_disconnects;
30668+atomic_unchecked_t cm_closes;
30669+atomic_unchecked_t cm_connecteds;
30670+atomic_unchecked_t cm_connect_reqs;
30671+atomic_unchecked_t cm_rejects;
30672
30673
30674 /**
30675@@ -1045,7 +1045,7 @@ static int mini_cm_dec_refcnt_listen(str
30676 kfree(listener);
30677 listener = NULL;
30678 ret = 0;
30679- atomic_inc(&cm_listens_destroyed);
30680+ atomic_inc_unchecked(&cm_listens_destroyed);
30681 } else {
30682 spin_unlock_irqrestore(&cm_core->listen_list_lock, flags);
30683 }
30684@@ -1240,7 +1240,7 @@ static struct nes_cm_node *make_cm_node(
30685 cm_node->rem_mac);
30686
30687 add_hte_node(cm_core, cm_node);
30688- atomic_inc(&cm_nodes_created);
30689+ atomic_inc_unchecked(&cm_nodes_created);
30690
30691 return cm_node;
30692 }
30693@@ -1298,7 +1298,7 @@ static int rem_ref_cm_node(struct nes_cm
30694 }
30695
30696 atomic_dec(&cm_core->node_cnt);
30697- atomic_inc(&cm_nodes_destroyed);
30698+ atomic_inc_unchecked(&cm_nodes_destroyed);
30699 nesqp = cm_node->nesqp;
30700 if (nesqp) {
30701 nesqp->cm_node = NULL;
30702@@ -1365,7 +1365,7 @@ static int process_options(struct nes_cm
30703
30704 static void drop_packet(struct sk_buff *skb)
30705 {
30706- atomic_inc(&cm_accel_dropped_pkts);
30707+ atomic_inc_unchecked(&cm_accel_dropped_pkts);
30708 dev_kfree_skb_any(skb);
30709 }
30710
30711@@ -1428,7 +1428,7 @@ static void handle_rst_pkt(struct nes_cm
30712 {
30713
30714 int reset = 0; /* whether to send reset in case of err.. */
30715- atomic_inc(&cm_resets_recvd);
30716+ atomic_inc_unchecked(&cm_resets_recvd);
30717 nes_debug(NES_DBG_CM, "Received Reset, cm_node = %p, state = %u."
30718 " refcnt=%d\n", cm_node, cm_node->state,
30719 atomic_read(&cm_node->ref_count));
30720@@ -2057,7 +2057,7 @@ static struct nes_cm_node *mini_cm_conne
30721 rem_ref_cm_node(cm_node->cm_core, cm_node);
30722 return NULL;
30723 }
30724- atomic_inc(&cm_loopbacks);
30725+ atomic_inc_unchecked(&cm_loopbacks);
30726 loopbackremotenode->loopbackpartner = cm_node;
30727 loopbackremotenode->tcp_cntxt.rcv_wscale =
30728 NES_CM_DEFAULT_RCV_WND_SCALE;
30729@@ -2332,7 +2332,7 @@ static int mini_cm_recv_pkt(struct nes_c
30730 add_ref_cm_node(cm_node);
30731 } else if (cm_node->state == NES_CM_STATE_TSA) {
30732 rem_ref_cm_node(cm_core, cm_node);
30733- atomic_inc(&cm_accel_dropped_pkts);
30734+ atomic_inc_unchecked(&cm_accel_dropped_pkts);
30735 dev_kfree_skb_any(skb);
30736 break;
30737 }
30738@@ -2638,7 +2638,7 @@ static int nes_cm_disconn_true(struct ne
30739
30740 if ((cm_id) && (cm_id->event_handler)) {
30741 if (issue_disconn) {
30742- atomic_inc(&cm_disconnects);
30743+ atomic_inc_unchecked(&cm_disconnects);
30744 cm_event.event = IW_CM_EVENT_DISCONNECT;
30745 cm_event.status = disconn_status;
30746 cm_event.local_addr = cm_id->local_addr;
30747@@ -2660,7 +2660,7 @@ static int nes_cm_disconn_true(struct ne
30748 }
30749
30750 if (issue_close) {
30751- atomic_inc(&cm_closes);
30752+ atomic_inc_unchecked(&cm_closes);
30753 nes_disconnect(nesqp, 1);
30754
30755 cm_id->provider_data = nesqp;
30756@@ -2791,7 +2791,7 @@ int nes_accept(struct iw_cm_id *cm_id, s
30757
30758 nes_debug(NES_DBG_CM, "QP%u, cm_node=%p, jiffies = %lu listener = %p\n",
30759 nesqp->hwqp.qp_id, cm_node, jiffies, cm_node->listener);
30760- atomic_inc(&cm_accepts);
30761+ atomic_inc_unchecked(&cm_accepts);
30762
30763 nes_debug(NES_DBG_CM, "netdev refcnt = %u.\n",
30764 netdev_refcnt_read(nesvnic->netdev));
30765@@ -3001,7 +3001,7 @@ int nes_reject(struct iw_cm_id *cm_id, c
30766
30767 struct nes_cm_core *cm_core;
30768
30769- atomic_inc(&cm_rejects);
30770+ atomic_inc_unchecked(&cm_rejects);
30771 cm_node = (struct nes_cm_node *) cm_id->provider_data;
30772 loopback = cm_node->loopbackpartner;
30773 cm_core = cm_node->cm_core;
30774@@ -3067,7 +3067,7 @@ int nes_connect(struct iw_cm_id *cm_id,
30775 ntohl(cm_id->local_addr.sin_addr.s_addr),
30776 ntohs(cm_id->local_addr.sin_port));
30777
30778- atomic_inc(&cm_connects);
30779+ atomic_inc_unchecked(&cm_connects);
30780 nesqp->active_conn = 1;
30781
30782 /* cache the cm_id in the qp */
30783@@ -3173,7 +3173,7 @@ int nes_create_listen(struct iw_cm_id *c
30784 g_cm_core->api->stop_listener(g_cm_core, (void *)cm_node);
30785 return err;
30786 }
30787- atomic_inc(&cm_listens_created);
30788+ atomic_inc_unchecked(&cm_listens_created);
30789 }
30790
30791 cm_id->add_ref(cm_id);
30792@@ -3278,7 +3278,7 @@ static void cm_event_connected(struct ne
30793 if (nesqp->destroyed) {
30794 return;
30795 }
30796- atomic_inc(&cm_connecteds);
30797+ atomic_inc_unchecked(&cm_connecteds);
30798 nes_debug(NES_DBG_CM, "QP%u attempting to connect to 0x%08X:0x%04X on"
30799 " local port 0x%04X. jiffies = %lu.\n",
30800 nesqp->hwqp.qp_id,
30801@@ -3493,7 +3493,7 @@ static void cm_event_reset(struct nes_cm
30802
30803 cm_id->add_ref(cm_id);
30804 ret = cm_id->event_handler(cm_id, &cm_event);
30805- atomic_inc(&cm_closes);
30806+ atomic_inc_unchecked(&cm_closes);
30807 cm_event.event = IW_CM_EVENT_CLOSE;
30808 cm_event.status = IW_CM_EVENT_STATUS_OK;
30809 cm_event.provider_data = cm_id->provider_data;
30810@@ -3529,7 +3529,7 @@ static void cm_event_mpa_req(struct nes_
30811 return;
30812 cm_id = cm_node->cm_id;
30813
30814- atomic_inc(&cm_connect_reqs);
30815+ atomic_inc_unchecked(&cm_connect_reqs);
30816 nes_debug(NES_DBG_CM, "cm_node = %p - cm_id = %p, jiffies = %lu\n",
30817 cm_node, cm_id, jiffies);
30818
30819@@ -3567,7 +3567,7 @@ static void cm_event_mpa_reject(struct n
30820 return;
30821 cm_id = cm_node->cm_id;
30822
30823- atomic_inc(&cm_connect_reqs);
30824+ atomic_inc_unchecked(&cm_connect_reqs);
30825 nes_debug(NES_DBG_CM, "cm_node = %p - cm_id = %p, jiffies = %lu\n",
30826 cm_node, cm_id, jiffies);
30827
30828diff -urNp linux-2.6.39/drivers/infiniband/hw/nes/nes.h linux-2.6.39/drivers/infiniband/hw/nes/nes.h
30829--- linux-2.6.39/drivers/infiniband/hw/nes/nes.h 2011-05-19 00:06:34.000000000 -0400
30830+++ linux-2.6.39/drivers/infiniband/hw/nes/nes.h 2011-05-22 19:36:31.000000000 -0400
30831@@ -175,17 +175,17 @@ extern unsigned int nes_debug_level;
30832 extern unsigned int wqm_quanta;
30833 extern struct list_head nes_adapter_list;
30834
30835-extern atomic_t cm_connects;
30836-extern atomic_t cm_accepts;
30837-extern atomic_t cm_disconnects;
30838-extern atomic_t cm_closes;
30839-extern atomic_t cm_connecteds;
30840-extern atomic_t cm_connect_reqs;
30841-extern atomic_t cm_rejects;
30842-extern atomic_t mod_qp_timouts;
30843-extern atomic_t qps_created;
30844-extern atomic_t qps_destroyed;
30845-extern atomic_t sw_qps_destroyed;
30846+extern atomic_unchecked_t cm_connects;
30847+extern atomic_unchecked_t cm_accepts;
30848+extern atomic_unchecked_t cm_disconnects;
30849+extern atomic_unchecked_t cm_closes;
30850+extern atomic_unchecked_t cm_connecteds;
30851+extern atomic_unchecked_t cm_connect_reqs;
30852+extern atomic_unchecked_t cm_rejects;
30853+extern atomic_unchecked_t mod_qp_timouts;
30854+extern atomic_unchecked_t qps_created;
30855+extern atomic_unchecked_t qps_destroyed;
30856+extern atomic_unchecked_t sw_qps_destroyed;
30857 extern u32 mh_detected;
30858 extern u32 mh_pauses_sent;
30859 extern u32 cm_packets_sent;
30860@@ -194,14 +194,14 @@ extern u32 cm_packets_created;
30861 extern u32 cm_packets_received;
30862 extern u32 cm_packets_dropped;
30863 extern u32 cm_packets_retrans;
30864-extern atomic_t cm_listens_created;
30865-extern atomic_t cm_listens_destroyed;
30866+extern atomic_unchecked_t cm_listens_created;
30867+extern atomic_unchecked_t cm_listens_destroyed;
30868 extern u32 cm_backlog_drops;
30869-extern atomic_t cm_loopbacks;
30870-extern atomic_t cm_nodes_created;
30871-extern atomic_t cm_nodes_destroyed;
30872-extern atomic_t cm_accel_dropped_pkts;
30873-extern atomic_t cm_resets_recvd;
30874+extern atomic_unchecked_t cm_loopbacks;
30875+extern atomic_unchecked_t cm_nodes_created;
30876+extern atomic_unchecked_t cm_nodes_destroyed;
30877+extern atomic_unchecked_t cm_accel_dropped_pkts;
30878+extern atomic_unchecked_t cm_resets_recvd;
30879
30880 extern u32 int_mod_timer_init;
30881 extern u32 int_mod_cq_depth_256;
30882diff -urNp linux-2.6.39/drivers/infiniband/hw/nes/nes_nic.c linux-2.6.39/drivers/infiniband/hw/nes/nes_nic.c
30883--- linux-2.6.39/drivers/infiniband/hw/nes/nes_nic.c 2011-05-19 00:06:34.000000000 -0400
30884+++ linux-2.6.39/drivers/infiniband/hw/nes/nes_nic.c 2011-05-22 19:36:31.000000000 -0400
30885@@ -1302,31 +1302,31 @@ static void nes_netdev_get_ethtool_stats
30886 target_stat_values[++index] = mh_detected;
30887 target_stat_values[++index] = mh_pauses_sent;
30888 target_stat_values[++index] = nesvnic->endnode_ipv4_tcp_retransmits;
30889- target_stat_values[++index] = atomic_read(&cm_connects);
30890- target_stat_values[++index] = atomic_read(&cm_accepts);
30891- target_stat_values[++index] = atomic_read(&cm_disconnects);
30892- target_stat_values[++index] = atomic_read(&cm_connecteds);
30893- target_stat_values[++index] = atomic_read(&cm_connect_reqs);
30894- target_stat_values[++index] = atomic_read(&cm_rejects);
30895- target_stat_values[++index] = atomic_read(&mod_qp_timouts);
30896- target_stat_values[++index] = atomic_read(&qps_created);
30897- target_stat_values[++index] = atomic_read(&sw_qps_destroyed);
30898- target_stat_values[++index] = atomic_read(&qps_destroyed);
30899- target_stat_values[++index] = atomic_read(&cm_closes);
30900+ target_stat_values[++index] = atomic_read_unchecked(&cm_connects);
30901+ target_stat_values[++index] = atomic_read_unchecked(&cm_accepts);
30902+ target_stat_values[++index] = atomic_read_unchecked(&cm_disconnects);
30903+ target_stat_values[++index] = atomic_read_unchecked(&cm_connecteds);
30904+ target_stat_values[++index] = atomic_read_unchecked(&cm_connect_reqs);
30905+ target_stat_values[++index] = atomic_read_unchecked(&cm_rejects);
30906+ target_stat_values[++index] = atomic_read_unchecked(&mod_qp_timouts);
30907+ target_stat_values[++index] = atomic_read_unchecked(&qps_created);
30908+ target_stat_values[++index] = atomic_read_unchecked(&sw_qps_destroyed);
30909+ target_stat_values[++index] = atomic_read_unchecked(&qps_destroyed);
30910+ target_stat_values[++index] = atomic_read_unchecked(&cm_closes);
30911 target_stat_values[++index] = cm_packets_sent;
30912 target_stat_values[++index] = cm_packets_bounced;
30913 target_stat_values[++index] = cm_packets_created;
30914 target_stat_values[++index] = cm_packets_received;
30915 target_stat_values[++index] = cm_packets_dropped;
30916 target_stat_values[++index] = cm_packets_retrans;
30917- target_stat_values[++index] = atomic_read(&cm_listens_created);
30918- target_stat_values[++index] = atomic_read(&cm_listens_destroyed);
30919+ target_stat_values[++index] = atomic_read_unchecked(&cm_listens_created);
30920+ target_stat_values[++index] = atomic_read_unchecked(&cm_listens_destroyed);
30921 target_stat_values[++index] = cm_backlog_drops;
30922- target_stat_values[++index] = atomic_read(&cm_loopbacks);
30923- target_stat_values[++index] = atomic_read(&cm_nodes_created);
30924- target_stat_values[++index] = atomic_read(&cm_nodes_destroyed);
30925- target_stat_values[++index] = atomic_read(&cm_accel_dropped_pkts);
30926- target_stat_values[++index] = atomic_read(&cm_resets_recvd);
30927+ target_stat_values[++index] = atomic_read_unchecked(&cm_loopbacks);
30928+ target_stat_values[++index] = atomic_read_unchecked(&cm_nodes_created);
30929+ target_stat_values[++index] = atomic_read_unchecked(&cm_nodes_destroyed);
30930+ target_stat_values[++index] = atomic_read_unchecked(&cm_accel_dropped_pkts);
30931+ target_stat_values[++index] = atomic_read_unchecked(&cm_resets_recvd);
30932 target_stat_values[++index] = nesadapter->free_4kpbl;
30933 target_stat_values[++index] = nesadapter->free_256pbl;
30934 target_stat_values[++index] = int_mod_timer_init;
30935diff -urNp linux-2.6.39/drivers/infiniband/hw/nes/nes_verbs.c linux-2.6.39/drivers/infiniband/hw/nes/nes_verbs.c
30936--- linux-2.6.39/drivers/infiniband/hw/nes/nes_verbs.c 2011-05-19 00:06:34.000000000 -0400
30937+++ linux-2.6.39/drivers/infiniband/hw/nes/nes_verbs.c 2011-05-22 19:36:31.000000000 -0400
30938@@ -46,9 +46,9 @@
30939
30940 #include <rdma/ib_umem.h>
30941
30942-atomic_t mod_qp_timouts;
30943-atomic_t qps_created;
30944-atomic_t sw_qps_destroyed;
30945+atomic_unchecked_t mod_qp_timouts;
30946+atomic_unchecked_t qps_created;
30947+atomic_unchecked_t sw_qps_destroyed;
30948
30949 static void nes_unregister_ofa_device(struct nes_ib_device *nesibdev);
30950
30951@@ -1141,7 +1141,7 @@ static struct ib_qp *nes_create_qp(struc
30952 if (init_attr->create_flags)
30953 return ERR_PTR(-EINVAL);
30954
30955- atomic_inc(&qps_created);
30956+ atomic_inc_unchecked(&qps_created);
30957 switch (init_attr->qp_type) {
30958 case IB_QPT_RC:
30959 if (nes_drv_opt & NES_DRV_OPT_NO_INLINE_DATA) {
30960@@ -1470,7 +1470,7 @@ static int nes_destroy_qp(struct ib_qp *
30961 struct iw_cm_event cm_event;
30962 int ret;
30963
30964- atomic_inc(&sw_qps_destroyed);
30965+ atomic_inc_unchecked(&sw_qps_destroyed);
30966 nesqp->destroyed = 1;
30967
30968 /* Blow away the connection if it exists. */
30969diff -urNp linux-2.6.39/drivers/infiniband/hw/qib/qib.h linux-2.6.39/drivers/infiniband/hw/qib/qib.h
30970--- linux-2.6.39/drivers/infiniband/hw/qib/qib.h 2011-05-19 00:06:34.000000000 -0400
30971+++ linux-2.6.39/drivers/infiniband/hw/qib/qib.h 2011-05-22 19:36:31.000000000 -0400
30972@@ -51,6 +51,7 @@
30973 #include <linux/completion.h>
30974 #include <linux/kref.h>
30975 #include <linux/sched.h>
30976+#include <linux/slab.h>
30977
30978 #include "qib_common.h"
30979 #include "qib_verbs.h"
30980@@ -87,7 +88,7 @@ struct qlogic_ib_stats {
30981 };
30982
30983 extern struct qlogic_ib_stats qib_stats;
30984-extern struct pci_error_handlers qib_pci_err_handler;
30985+extern const struct pci_error_handlers qib_pci_err_handler;
30986 extern struct pci_driver qib_driver;
30987
30988 #define QIB_CHIP_SWVERSION QIB_CHIP_VERS_MAJ
30989diff -urNp linux-2.6.39/drivers/infiniband/hw/qib/qib_mmap.c linux-2.6.39/drivers/infiniband/hw/qib/qib_mmap.c
30990--- linux-2.6.39/drivers/infiniband/hw/qib/qib_mmap.c 2011-05-19 00:06:34.000000000 -0400
30991+++ linux-2.6.39/drivers/infiniband/hw/qib/qib_mmap.c 2011-05-22 19:36:31.000000000 -0400
30992@@ -75,7 +75,7 @@ static void qib_vma_close(struct vm_area
30993 kref_put(&ip->ref, qib_release_mmap_info);
30994 }
30995
30996-static struct vm_operations_struct qib_vm_ops = {
30997+static const struct vm_operations_struct qib_vm_ops = {
30998 .open = qib_vma_open,
30999 .close = qib_vma_close,
31000 };
31001diff -urNp linux-2.6.39/drivers/infiniband/hw/qib/qib_pcie.c linux-2.6.39/drivers/infiniband/hw/qib/qib_pcie.c
31002--- linux-2.6.39/drivers/infiniband/hw/qib/qib_pcie.c 2011-05-19 00:06:34.000000000 -0400
31003+++ linux-2.6.39/drivers/infiniband/hw/qib/qib_pcie.c 2011-05-22 19:36:31.000000000 -0400
31004@@ -735,7 +735,7 @@ qib_pci_resume(struct pci_dev *pdev)
31005 qib_init(dd, 1); /* same as re-init after reset */
31006 }
31007
31008-struct pci_error_handlers qib_pci_err_handler = {
31009+const struct pci_error_handlers qib_pci_err_handler = {
31010 .error_detected = qib_pci_error_detected,
31011 .mmio_enabled = qib_pci_mmio_enabled,
31012 .link_reset = qib_pci_link_reset,
31013diff -urNp linux-2.6.39/drivers/input/gameport/gameport.c linux-2.6.39/drivers/input/gameport/gameport.c
31014--- linux-2.6.39/drivers/input/gameport/gameport.c 2011-05-19 00:06:34.000000000 -0400
31015+++ linux-2.6.39/drivers/input/gameport/gameport.c 2011-05-22 19:36:31.000000000 -0400
31016@@ -488,14 +488,14 @@ EXPORT_SYMBOL(gameport_set_phys);
31017 */
31018 static void gameport_init_port(struct gameport *gameport)
31019 {
31020- static atomic_t gameport_no = ATOMIC_INIT(0);
31021+ static atomic_unchecked_t gameport_no = ATOMIC_INIT(0);
31022
31023 __module_get(THIS_MODULE);
31024
31025 mutex_init(&gameport->drv_mutex);
31026 device_initialize(&gameport->dev);
31027 dev_set_name(&gameport->dev, "gameport%lu",
31028- (unsigned long)atomic_inc_return(&gameport_no) - 1);
31029+ (unsigned long)atomic_inc_return_unchecked(&gameport_no) - 1);
31030 gameport->dev.bus = &gameport_bus;
31031 gameport->dev.release = gameport_release_port;
31032 if (gameport->parent)
31033diff -urNp linux-2.6.39/drivers/input/input.c linux-2.6.39/drivers/input/input.c
31034--- linux-2.6.39/drivers/input/input.c 2011-05-19 00:06:34.000000000 -0400
31035+++ linux-2.6.39/drivers/input/input.c 2011-05-22 19:36:31.000000000 -0400
31036@@ -1815,7 +1815,7 @@ static void input_cleanse_bitmasks(struc
31037 */
31038 int input_register_device(struct input_dev *dev)
31039 {
31040- static atomic_t input_no = ATOMIC_INIT(0);
31041+ static atomic_unchecked_t input_no = ATOMIC_INIT(0);
31042 struct input_handler *handler;
31043 const char *path;
31044 int error;
31045@@ -1852,7 +1852,7 @@ int input_register_device(struct input_d
31046 dev->setkeycode = input_default_setkeycode;
31047
31048 dev_set_name(&dev->dev, "input%ld",
31049- (unsigned long) atomic_inc_return(&input_no) - 1);
31050+ (unsigned long) atomic_inc_return_unchecked(&input_no) - 1);
31051
31052 error = device_add(&dev->dev);
31053 if (error)
31054diff -urNp linux-2.6.39/drivers/input/joystick/sidewinder.c linux-2.6.39/drivers/input/joystick/sidewinder.c
31055--- linux-2.6.39/drivers/input/joystick/sidewinder.c 2011-05-19 00:06:34.000000000 -0400
31056+++ linux-2.6.39/drivers/input/joystick/sidewinder.c 2011-05-22 19:36:31.000000000 -0400
31057@@ -30,6 +30,7 @@
31058 #include <linux/kernel.h>
31059 #include <linux/module.h>
31060 #include <linux/slab.h>
31061+#include <linux/sched.h>
31062 #include <linux/init.h>
31063 #include <linux/input.h>
31064 #include <linux/gameport.h>
31065@@ -428,6 +429,8 @@ static int sw_read(struct sw *sw)
31066 unsigned char buf[SW_LENGTH];
31067 int i;
31068
31069+ pax_track_stack();
31070+
31071 i = sw_read_packet(sw->gameport, buf, sw->length, 0);
31072
31073 if (sw->type == SW_ID_3DP && sw->length == 66 && i != 66) { /* Broken packet, try to fix */
31074diff -urNp linux-2.6.39/drivers/input/joystick/xpad.c linux-2.6.39/drivers/input/joystick/xpad.c
31075--- linux-2.6.39/drivers/input/joystick/xpad.c 2011-05-19 00:06:34.000000000 -0400
31076+++ linux-2.6.39/drivers/input/joystick/xpad.c 2011-05-22 19:36:31.000000000 -0400
31077@@ -689,7 +689,7 @@ static void xpad_led_set(struct led_clas
31078
31079 static int xpad_led_probe(struct usb_xpad *xpad)
31080 {
31081- static atomic_t led_seq = ATOMIC_INIT(0);
31082+ static atomic_unchecked_t led_seq = ATOMIC_INIT(0);
31083 long led_no;
31084 struct xpad_led *led;
31085 struct led_classdev *led_cdev;
31086@@ -702,7 +702,7 @@ static int xpad_led_probe(struct usb_xpa
31087 if (!led)
31088 return -ENOMEM;
31089
31090- led_no = (long)atomic_inc_return(&led_seq) - 1;
31091+ led_no = (long)atomic_inc_return_unchecked(&led_seq) - 1;
31092
31093 snprintf(led->name, sizeof(led->name), "xpad%ld", led_no);
31094 led->xpad = xpad;
31095diff -urNp linux-2.6.39/drivers/input/mousedev.c linux-2.6.39/drivers/input/mousedev.c
31096--- linux-2.6.39/drivers/input/mousedev.c 2011-05-19 00:06:34.000000000 -0400
31097+++ linux-2.6.39/drivers/input/mousedev.c 2011-05-22 19:36:31.000000000 -0400
31098@@ -764,7 +764,7 @@ static ssize_t mousedev_read(struct file
31099
31100 spin_unlock_irq(&client->packet_lock);
31101
31102- if (copy_to_user(buffer, data, count))
31103+ if (count > sizeof(data) || copy_to_user(buffer, data, count))
31104 return -EFAULT;
31105
31106 return count;
31107diff -urNp linux-2.6.39/drivers/input/serio/serio.c linux-2.6.39/drivers/input/serio/serio.c
31108--- linux-2.6.39/drivers/input/serio/serio.c 2011-05-19 00:06:34.000000000 -0400
31109+++ linux-2.6.39/drivers/input/serio/serio.c 2011-05-22 19:36:31.000000000 -0400
31110@@ -497,7 +497,7 @@ static void serio_release_port(struct de
31111 */
31112 static void serio_init_port(struct serio *serio)
31113 {
31114- static atomic_t serio_no = ATOMIC_INIT(0);
31115+ static atomic_unchecked_t serio_no = ATOMIC_INIT(0);
31116
31117 __module_get(THIS_MODULE);
31118
31119@@ -508,7 +508,7 @@ static void serio_init_port(struct serio
31120 mutex_init(&serio->drv_mutex);
31121 device_initialize(&serio->dev);
31122 dev_set_name(&serio->dev, "serio%ld",
31123- (long)atomic_inc_return(&serio_no) - 1);
31124+ (long)atomic_inc_return_unchecked(&serio_no) - 1);
31125 serio->dev.bus = &serio_bus;
31126 serio->dev.release = serio_release_port;
31127 serio->dev.groups = serio_device_attr_groups;
31128diff -urNp linux-2.6.39/drivers/isdn/capi/capi.c linux-2.6.39/drivers/isdn/capi/capi.c
31129--- linux-2.6.39/drivers/isdn/capi/capi.c 2011-05-19 00:06:34.000000000 -0400
31130+++ linux-2.6.39/drivers/isdn/capi/capi.c 2011-05-22 19:36:31.000000000 -0400
31131@@ -89,8 +89,8 @@ struct capiminor {
31132
31133 struct capi20_appl *ap;
31134 u32 ncci;
31135- atomic_t datahandle;
31136- atomic_t msgid;
31137+ atomic_unchecked_t datahandle;
31138+ atomic_unchecked_t msgid;
31139
31140 struct tty_port port;
31141 int ttyinstop;
31142@@ -414,7 +414,7 @@ gen_data_b3_resp_for(struct capiminor *m
31143 capimsg_setu16(s, 2, mp->ap->applid);
31144 capimsg_setu8 (s, 4, CAPI_DATA_B3);
31145 capimsg_setu8 (s, 5, CAPI_RESP);
31146- capimsg_setu16(s, 6, atomic_inc_return(&mp->msgid));
31147+ capimsg_setu16(s, 6, atomic_inc_return_unchecked(&mp->msgid));
31148 capimsg_setu32(s, 8, mp->ncci);
31149 capimsg_setu16(s, 12, datahandle);
31150 }
31151@@ -547,14 +547,14 @@ static void handle_minor_send(struct cap
31152 mp->outbytes -= len;
31153 spin_unlock_bh(&mp->outlock);
31154
31155- datahandle = atomic_inc_return(&mp->datahandle);
31156+ datahandle = atomic_inc_return_unchecked(&mp->datahandle);
31157 skb_push(skb, CAPI_DATA_B3_REQ_LEN);
31158 memset(skb->data, 0, CAPI_DATA_B3_REQ_LEN);
31159 capimsg_setu16(skb->data, 0, CAPI_DATA_B3_REQ_LEN);
31160 capimsg_setu16(skb->data, 2, mp->ap->applid);
31161 capimsg_setu8 (skb->data, 4, CAPI_DATA_B3);
31162 capimsg_setu8 (skb->data, 5, CAPI_REQ);
31163- capimsg_setu16(skb->data, 6, atomic_inc_return(&mp->msgid));
31164+ capimsg_setu16(skb->data, 6, atomic_inc_return_unchecked(&mp->msgid));
31165 capimsg_setu32(skb->data, 8, mp->ncci); /* NCCI */
31166 capimsg_setu32(skb->data, 12, (u32)(long)skb->data);/* Data32 */
31167 capimsg_setu16(skb->data, 16, len); /* Data length */
31168diff -urNp linux-2.6.39/drivers/isdn/gigaset/common.c linux-2.6.39/drivers/isdn/gigaset/common.c
31169--- linux-2.6.39/drivers/isdn/gigaset/common.c 2011-05-19 00:06:34.000000000 -0400
31170+++ linux-2.6.39/drivers/isdn/gigaset/common.c 2011-05-22 19:36:31.000000000 -0400
31171@@ -723,7 +723,7 @@ struct cardstate *gigaset_initcs(struct
31172 cs->commands_pending = 0;
31173 cs->cur_at_seq = 0;
31174 cs->gotfwver = -1;
31175- cs->open_count = 0;
31176+ local_set(&cs->open_count, 0);
31177 cs->dev = NULL;
31178 cs->tty = NULL;
31179 cs->tty_dev = NULL;
31180diff -urNp linux-2.6.39/drivers/isdn/gigaset/gigaset.h linux-2.6.39/drivers/isdn/gigaset/gigaset.h
31181--- linux-2.6.39/drivers/isdn/gigaset/gigaset.h 2011-05-19 00:06:34.000000000 -0400
31182+++ linux-2.6.39/drivers/isdn/gigaset/gigaset.h 2011-05-22 19:36:31.000000000 -0400
31183@@ -35,6 +35,7 @@
31184 #include <linux/tty_driver.h>
31185 #include <linux/list.h>
31186 #include <asm/atomic.h>
31187+#include <asm/local.h>
31188
31189 #define GIG_VERSION {0, 5, 0, 0}
31190 #define GIG_COMPAT {0, 4, 0, 0}
31191@@ -433,7 +434,7 @@ struct cardstate {
31192 spinlock_t cmdlock;
31193 unsigned curlen, cmdbytes;
31194
31195- unsigned open_count;
31196+ local_t open_count;
31197 struct tty_struct *tty;
31198 struct tasklet_struct if_wake_tasklet;
31199 unsigned control_state;
31200diff -urNp linux-2.6.39/drivers/isdn/gigaset/interface.c linux-2.6.39/drivers/isdn/gigaset/interface.c
31201--- linux-2.6.39/drivers/isdn/gigaset/interface.c 2011-05-19 00:06:34.000000000 -0400
31202+++ linux-2.6.39/drivers/isdn/gigaset/interface.c 2011-05-22 19:36:31.000000000 -0400
31203@@ -160,9 +160,7 @@ static int if_open(struct tty_struct *tt
31204 return -ERESTARTSYS;
31205 tty->driver_data = cs;
31206
31207- ++cs->open_count;
31208-
31209- if (cs->open_count == 1) {
31210+ if (local_inc_return(&cs->open_count) == 1) {
31211 spin_lock_irqsave(&cs->lock, flags);
31212 cs->tty = tty;
31213 spin_unlock_irqrestore(&cs->lock, flags);
31214@@ -190,10 +188,10 @@ static void if_close(struct tty_struct *
31215
31216 if (!cs->connected)
31217 gig_dbg(DEBUG_IF, "not connected"); /* nothing to do */
31218- else if (!cs->open_count)
31219+ else if (!local_read(&cs->open_count))
31220 dev_warn(cs->dev, "%s: device not opened\n", __func__);
31221 else {
31222- if (!--cs->open_count) {
31223+ if (!local_dec_return(&cs->open_count)) {
31224 spin_lock_irqsave(&cs->lock, flags);
31225 cs->tty = NULL;
31226 spin_unlock_irqrestore(&cs->lock, flags);
31227@@ -228,7 +226,7 @@ static int if_ioctl(struct tty_struct *t
31228 if (!cs->connected) {
31229 gig_dbg(DEBUG_IF, "not connected");
31230 retval = -ENODEV;
31231- } else if (!cs->open_count)
31232+ } else if (!local_read(&cs->open_count))
31233 dev_warn(cs->dev, "%s: device not opened\n", __func__);
31234 else {
31235 retval = 0;
31236@@ -358,7 +356,7 @@ static int if_write(struct tty_struct *t
31237 retval = -ENODEV;
31238 goto done;
31239 }
31240- if (!cs->open_count) {
31241+ if (!local_read(&cs->open_count)) {
31242 dev_warn(cs->dev, "%s: device not opened\n", __func__);
31243 retval = -ENODEV;
31244 goto done;
31245@@ -411,7 +409,7 @@ static int if_write_room(struct tty_stru
31246 if (!cs->connected) {
31247 gig_dbg(DEBUG_IF, "not connected");
31248 retval = -ENODEV;
31249- } else if (!cs->open_count)
31250+ } else if (!local_read(&cs->open_count))
31251 dev_warn(cs->dev, "%s: device not opened\n", __func__);
31252 else if (cs->mstate != MS_LOCKED) {
31253 dev_warn(cs->dev, "can't write to unlocked device\n");
31254@@ -441,7 +439,7 @@ static int if_chars_in_buffer(struct tty
31255
31256 if (!cs->connected)
31257 gig_dbg(DEBUG_IF, "not connected");
31258- else if (!cs->open_count)
31259+ else if (!local_read(&cs->open_count))
31260 dev_warn(cs->dev, "%s: device not opened\n", __func__);
31261 else if (cs->mstate != MS_LOCKED)
31262 dev_warn(cs->dev, "can't write to unlocked device\n");
31263@@ -469,7 +467,7 @@ static void if_throttle(struct tty_struc
31264
31265 if (!cs->connected)
31266 gig_dbg(DEBUG_IF, "not connected"); /* nothing to do */
31267- else if (!cs->open_count)
31268+ else if (!local_read(&cs->open_count))
31269 dev_warn(cs->dev, "%s: device not opened\n", __func__);
31270 else
31271 gig_dbg(DEBUG_IF, "%s: not implemented\n", __func__);
31272@@ -493,7 +491,7 @@ static void if_unthrottle(struct tty_str
31273
31274 if (!cs->connected)
31275 gig_dbg(DEBUG_IF, "not connected"); /* nothing to do */
31276- else if (!cs->open_count)
31277+ else if (!local_read(&cs->open_count))
31278 dev_warn(cs->dev, "%s: device not opened\n", __func__);
31279 else
31280 gig_dbg(DEBUG_IF, "%s: not implemented\n", __func__);
31281@@ -524,7 +522,7 @@ static void if_set_termios(struct tty_st
31282 goto out;
31283 }
31284
31285- if (!cs->open_count) {
31286+ if (!local_read(&cs->open_count)) {
31287 dev_warn(cs->dev, "%s: device not opened\n", __func__);
31288 goto out;
31289 }
31290diff -urNp linux-2.6.39/drivers/isdn/hardware/avm/b1.c linux-2.6.39/drivers/isdn/hardware/avm/b1.c
31291--- linux-2.6.39/drivers/isdn/hardware/avm/b1.c 2011-05-19 00:06:34.000000000 -0400
31292+++ linux-2.6.39/drivers/isdn/hardware/avm/b1.c 2011-05-22 19:36:31.000000000 -0400
31293@@ -176,7 +176,7 @@ int b1_load_t4file(avmcard *card, capilo
31294 }
31295 if (left) {
31296 if (t4file->user) {
31297- if (copy_from_user(buf, dp, left))
31298+ if (left > sizeof buf || copy_from_user(buf, dp, left))
31299 return -EFAULT;
31300 } else {
31301 memcpy(buf, dp, left);
31302@@ -224,7 +224,7 @@ int b1_load_config(avmcard *card, capilo
31303 }
31304 if (left) {
31305 if (config->user) {
31306- if (copy_from_user(buf, dp, left))
31307+ if (left > sizeof buf || copy_from_user(buf, dp, left))
31308 return -EFAULT;
31309 } else {
31310 memcpy(buf, dp, left);
31311diff -urNp linux-2.6.39/drivers/isdn/hardware/eicon/capidtmf.c linux-2.6.39/drivers/isdn/hardware/eicon/capidtmf.c
31312--- linux-2.6.39/drivers/isdn/hardware/eicon/capidtmf.c 2011-05-19 00:06:34.000000000 -0400
31313+++ linux-2.6.39/drivers/isdn/hardware/eicon/capidtmf.c 2011-05-22 19:36:31.000000000 -0400
31314@@ -498,6 +498,7 @@ void capidtmf_recv_block (t_capidtmf_sta
31315 byte goertzel_result_buffer[CAPIDTMF_RECV_TOTAL_FREQUENCY_COUNT];
31316 short windowed_sample_buffer[CAPIDTMF_RECV_WINDOWED_SAMPLES];
31317
31318+ pax_track_stack();
31319
31320 if (p_state->recv.state & CAPIDTMF_RECV_STATE_DTMF_ACTIVE)
31321 {
31322diff -urNp linux-2.6.39/drivers/isdn/hardware/eicon/capifunc.c linux-2.6.39/drivers/isdn/hardware/eicon/capifunc.c
31323--- linux-2.6.39/drivers/isdn/hardware/eicon/capifunc.c 2011-05-19 00:06:34.000000000 -0400
31324+++ linux-2.6.39/drivers/isdn/hardware/eicon/capifunc.c 2011-05-22 19:36:31.000000000 -0400
31325@@ -1055,6 +1055,8 @@ static int divacapi_connect_didd(void)
31326 IDI_SYNC_REQ req;
31327 DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
31328
31329+ pax_track_stack();
31330+
31331 DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
31332
31333 for (x = 0; x < MAX_DESCRIPTORS; x++) {
31334diff -urNp linux-2.6.39/drivers/isdn/hardware/eicon/diddfunc.c linux-2.6.39/drivers/isdn/hardware/eicon/diddfunc.c
31335--- linux-2.6.39/drivers/isdn/hardware/eicon/diddfunc.c 2011-05-19 00:06:34.000000000 -0400
31336+++ linux-2.6.39/drivers/isdn/hardware/eicon/diddfunc.c 2011-05-22 19:36:31.000000000 -0400
31337@@ -54,6 +54,8 @@ static int DIVA_INIT_FUNCTION connect_di
31338 IDI_SYNC_REQ req;
31339 DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
31340
31341+ pax_track_stack();
31342+
31343 DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
31344
31345 for (x = 0; x < MAX_DESCRIPTORS; x++) {
31346diff -urNp linux-2.6.39/drivers/isdn/hardware/eicon/divasfunc.c linux-2.6.39/drivers/isdn/hardware/eicon/divasfunc.c
31347--- linux-2.6.39/drivers/isdn/hardware/eicon/divasfunc.c 2011-05-19 00:06:34.000000000 -0400
31348+++ linux-2.6.39/drivers/isdn/hardware/eicon/divasfunc.c 2011-05-22 19:36:31.000000000 -0400
31349@@ -161,6 +161,8 @@ static int DIVA_INIT_FUNCTION connect_di
31350 IDI_SYNC_REQ req;
31351 DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
31352
31353+ pax_track_stack();
31354+
31355 DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
31356
31357 for (x = 0; x < MAX_DESCRIPTORS; x++) {
31358diff -urNp linux-2.6.39/drivers/isdn/hardware/eicon/idifunc.c linux-2.6.39/drivers/isdn/hardware/eicon/idifunc.c
31359--- linux-2.6.39/drivers/isdn/hardware/eicon/idifunc.c 2011-05-19 00:06:34.000000000 -0400
31360+++ linux-2.6.39/drivers/isdn/hardware/eicon/idifunc.c 2011-05-22 19:36:31.000000000 -0400
31361@@ -188,6 +188,8 @@ static int DIVA_INIT_FUNCTION connect_di
31362 IDI_SYNC_REQ req;
31363 DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
31364
31365+ pax_track_stack();
31366+
31367 DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
31368
31369 for (x = 0; x < MAX_DESCRIPTORS; x++) {
31370diff -urNp linux-2.6.39/drivers/isdn/hardware/eicon/message.c linux-2.6.39/drivers/isdn/hardware/eicon/message.c
31371--- linux-2.6.39/drivers/isdn/hardware/eicon/message.c 2011-05-19 00:06:34.000000000 -0400
31372+++ linux-2.6.39/drivers/isdn/hardware/eicon/message.c 2011-05-22 19:36:31.000000000 -0400
31373@@ -4889,6 +4889,8 @@ static void sig_ind(PLCI *plci)
31374 dword d;
31375 word w;
31376
31377+ pax_track_stack();
31378+
31379 a = plci->adapter;
31380 Id = ((word)plci->Id<<8)|a->Id;
31381 PUT_WORD(&SS_Ind[4],0x0000);
31382@@ -7484,6 +7486,8 @@ static word add_b1(PLCI *plci, API_PARSE
31383 word j, n, w;
31384 dword d;
31385
31386+ pax_track_stack();
31387+
31388
31389 for(i=0;i<8;i++) bp_parms[i].length = 0;
31390 for(i=0;i<2;i++) global_config[i].length = 0;
31391@@ -7958,6 +7962,8 @@ static word add_b23(PLCI *plci, API_PARS
31392 const byte llc3[] = {4,3,2,2,6,6,0};
31393 const byte header[] = {0,2,3,3,0,0,0};
31394
31395+ pax_track_stack();
31396+
31397 for(i=0;i<8;i++) bp_parms[i].length = 0;
31398 for(i=0;i<6;i++) b2_config_parms[i].length = 0;
31399 for(i=0;i<5;i++) b3_config_parms[i].length = 0;
31400@@ -14760,6 +14766,8 @@ static void group_optimization(DIVA_CAPI
31401 word appl_number_group_type[MAX_APPL];
31402 PLCI *auxplci;
31403
31404+ pax_track_stack();
31405+
31406 set_group_ind_mask (plci); /* all APPLs within this inc. call are allowed to dial in */
31407
31408 if(!a->group_optimization_enabled)
31409diff -urNp linux-2.6.39/drivers/isdn/hardware/eicon/mntfunc.c linux-2.6.39/drivers/isdn/hardware/eicon/mntfunc.c
31410--- linux-2.6.39/drivers/isdn/hardware/eicon/mntfunc.c 2011-05-19 00:06:34.000000000 -0400
31411+++ linux-2.6.39/drivers/isdn/hardware/eicon/mntfunc.c 2011-05-22 19:36:31.000000000 -0400
31412@@ -79,6 +79,8 @@ static int DIVA_INIT_FUNCTION connect_di
31413 IDI_SYNC_REQ req;
31414 DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
31415
31416+ pax_track_stack();
31417+
31418 DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
31419
31420 for (x = 0; x < MAX_DESCRIPTORS; x++) {
31421diff -urNp linux-2.6.39/drivers/isdn/i4l/isdn_common.c linux-2.6.39/drivers/isdn/i4l/isdn_common.c
31422--- linux-2.6.39/drivers/isdn/i4l/isdn_common.c 2011-05-19 00:06:34.000000000 -0400
31423+++ linux-2.6.39/drivers/isdn/i4l/isdn_common.c 2011-05-22 19:36:31.000000000 -0400
31424@@ -1292,6 +1292,8 @@ isdn_ioctl(struct file *file, uint cmd,
31425 } iocpar;
31426 void __user *argp = (void __user *)arg;
31427
31428+ pax_track_stack();
31429+
31430 #define name iocpar.name
31431 #define bname iocpar.bname
31432 #define iocts iocpar.iocts
31433diff -urNp linux-2.6.39/drivers/isdn/i4l/isdn_net.c linux-2.6.39/drivers/isdn/i4l/isdn_net.c
31434--- linux-2.6.39/drivers/isdn/i4l/isdn_net.c 2011-05-19 00:06:34.000000000 -0400
31435+++ linux-2.6.39/drivers/isdn/i4l/isdn_net.c 2011-05-22 19:36:31.000000000 -0400
31436@@ -400,7 +400,7 @@ isdn_net_stat_callback(int idx, isdn_ctr
31437 isdn_net_local *lp = p->local;
31438 #ifdef CONFIG_ISDN_X25
31439 struct concap_proto *cprot = lp->netdev->cprot;
31440- struct concap_proto_ops *pops = cprot ? cprot->pops : NULL;
31441+ const struct concap_proto_ops *pops = cprot ? cprot->pops : NULL;
31442 #endif
31443 switch (cmd) {
31444 case ISDN_STAT_BSENT:
31445@@ -831,7 +831,7 @@ isdn_net_hangup(struct net_device *d)
31446 isdn_ctrl cmd;
31447 #ifdef CONFIG_ISDN_X25
31448 struct concap_proto *cprot = lp->netdev->cprot;
31449- struct concap_proto_ops *pops = cprot ? cprot->pops : NULL;
31450+ const struct concap_proto_ops *pops = cprot ? cprot->pops : NULL;
31451 #endif
31452
31453 if (lp->flags & ISDN_NET_CONNECTED) {
31454diff -urNp linux-2.6.39/drivers/isdn/i4l/isdn_x25iface.c linux-2.6.39/drivers/isdn/i4l/isdn_x25iface.c
31455--- linux-2.6.39/drivers/isdn/i4l/isdn_x25iface.c 2011-05-19 00:06:34.000000000 -0400
31456+++ linux-2.6.39/drivers/isdn/i4l/isdn_x25iface.c 2011-05-22 19:36:31.000000000 -0400
31457@@ -52,7 +52,7 @@ static int isdn_x25iface_connect_ind( st
31458 static int isdn_x25iface_disconn_ind( struct concap_proto * );
31459
31460
31461-static struct concap_proto_ops ix25_pops = {
31462+static const struct concap_proto_ops ix25_pops = {
31463 &isdn_x25iface_proto_new,
31464 &isdn_x25iface_proto_del,
31465 &isdn_x25iface_proto_restart,
31466diff -urNp linux-2.6.39/drivers/isdn/i4l/isdn_x25iface.h linux-2.6.39/drivers/isdn/i4l/isdn_x25iface.h
31467--- linux-2.6.39/drivers/isdn/i4l/isdn_x25iface.h 2011-05-19 00:06:34.000000000 -0400
31468+++ linux-2.6.39/drivers/isdn/i4l/isdn_x25iface.h 2011-05-22 19:36:31.000000000 -0400
31469@@ -23,7 +23,7 @@
31470 #include <linux/isdn.h>
31471 #include <linux/concap.h>
31472
31473-extern struct concap_proto_ops * isdn_x25iface_concap_proto_ops_pt;
31474+extern const struct concap_proto_ops *isdn_x25iface_concap_proto_ops_pt;
31475 extern struct concap_proto * isdn_x25iface_proto_new(void);
31476
31477
31478diff -urNp linux-2.6.39/drivers/isdn/icn/icn.c linux-2.6.39/drivers/isdn/icn/icn.c
31479--- linux-2.6.39/drivers/isdn/icn/icn.c 2011-05-19 00:06:34.000000000 -0400
31480+++ linux-2.6.39/drivers/isdn/icn/icn.c 2011-05-22 19:36:31.000000000 -0400
31481@@ -1045,7 +1045,7 @@ icn_writecmd(const u_char * buf, int len
31482 if (count > len)
31483 count = len;
31484 if (user) {
31485- if (copy_from_user(msg, buf, count))
31486+ if (count > sizeof msg || copy_from_user(msg, buf, count))
31487 return -EFAULT;
31488 } else
31489 memcpy(msg, buf, count);
31490diff -urNp linux-2.6.39/drivers/lguest/core.c linux-2.6.39/drivers/lguest/core.c
31491--- linux-2.6.39/drivers/lguest/core.c 2011-05-19 00:06:34.000000000 -0400
31492+++ linux-2.6.39/drivers/lguest/core.c 2011-05-22 19:36:31.000000000 -0400
31493@@ -92,9 +92,17 @@ static __init int map_switcher(void)
31494 * it's worked so far. The end address needs +1 because __get_vm_area
31495 * allocates an extra guard page, so we need space for that.
31496 */
31497+
31498+#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
31499+ switcher_vma = __get_vm_area(TOTAL_SWITCHER_PAGES * PAGE_SIZE,
31500+ VM_ALLOC | VM_KERNEXEC, SWITCHER_ADDR, SWITCHER_ADDR
31501+ + (TOTAL_SWITCHER_PAGES+1) * PAGE_SIZE);
31502+#else
31503 switcher_vma = __get_vm_area(TOTAL_SWITCHER_PAGES * PAGE_SIZE,
31504 VM_ALLOC, SWITCHER_ADDR, SWITCHER_ADDR
31505 + (TOTAL_SWITCHER_PAGES+1) * PAGE_SIZE);
31506+#endif
31507+
31508 if (!switcher_vma) {
31509 err = -ENOMEM;
31510 printk("lguest: could not map switcher pages high\n");
31511@@ -119,7 +127,7 @@ static __init int map_switcher(void)
31512 * Now the Switcher is mapped at the right address, we can't fail!
31513 * Copy in the compiled-in Switcher code (from <arch>_switcher.S).
31514 */
31515- memcpy(switcher_vma->addr, start_switcher_text,
31516+ memcpy(switcher_vma->addr, ktla_ktva(start_switcher_text),
31517 end_switcher_text - start_switcher_text);
31518
31519 printk(KERN_INFO "lguest: mapped switcher at %p\n",
31520diff -urNp linux-2.6.39/drivers/lguest/lguest_device.c linux-2.6.39/drivers/lguest/lguest_device.c
31521--- linux-2.6.39/drivers/lguest/lguest_device.c 2011-05-19 00:06:34.000000000 -0400
31522+++ linux-2.6.39/drivers/lguest/lguest_device.c 2011-05-22 19:36:31.000000000 -0400
31523@@ -374,7 +374,7 @@ error:
31524 }
31525
31526 /* The ops structure which hooks everything together. */
31527-static struct virtio_config_ops lguest_config_ops = {
31528+static const struct virtio_config_ops lguest_config_ops = {
31529 .get_features = lg_get_features,
31530 .finalize_features = lg_finalize_features,
31531 .get = lg_get,
31532diff -urNp linux-2.6.39/drivers/lguest/x86/core.c linux-2.6.39/drivers/lguest/x86/core.c
31533--- linux-2.6.39/drivers/lguest/x86/core.c 2011-05-19 00:06:34.000000000 -0400
31534+++ linux-2.6.39/drivers/lguest/x86/core.c 2011-05-22 19:36:31.000000000 -0400
31535@@ -59,7 +59,7 @@ static struct {
31536 /* Offset from where switcher.S was compiled to where we've copied it */
31537 static unsigned long switcher_offset(void)
31538 {
31539- return SWITCHER_ADDR - (unsigned long)start_switcher_text;
31540+ return SWITCHER_ADDR - (unsigned long)ktla_ktva(start_switcher_text);
31541 }
31542
31543 /* This cpu's struct lguest_pages. */
31544@@ -100,7 +100,13 @@ static void copy_in_guest_info(struct lg
31545 * These copies are pretty cheap, so we do them unconditionally: */
31546 /* Save the current Host top-level page directory.
31547 */
31548+
31549+#ifdef CONFIG_PAX_PER_CPU_PGD
31550+ pages->state.host_cr3 = read_cr3();
31551+#else
31552 pages->state.host_cr3 = __pa(current->mm->pgd);
31553+#endif
31554+
31555 /*
31556 * Set up the Guest's page tables to see this CPU's pages (and no
31557 * other CPU's pages).
31558@@ -547,7 +553,7 @@ void __init lguest_arch_host_init(void)
31559 * compiled-in switcher code and the high-mapped copy we just made.
31560 */
31561 for (i = 0; i < IDT_ENTRIES; i++)
31562- default_idt_entries[i] += switcher_offset();
31563+ default_idt_entries[i] = ktla_ktva(default_idt_entries[i]) + switcher_offset();
31564
31565 /*
31566 * Set up the Switcher's per-cpu areas.
31567@@ -630,7 +636,7 @@ void __init lguest_arch_host_init(void)
31568 * it will be undisturbed when we switch. To change %cs and jump we
31569 * need this structure to feed to Intel's "lcall" instruction.
31570 */
31571- lguest_entry.offset = (long)switch_to_guest + switcher_offset();
31572+ lguest_entry.offset = (long)ktla_ktva(switch_to_guest) + switcher_offset();
31573 lguest_entry.segment = LGUEST_CS;
31574
31575 /*
31576diff -urNp linux-2.6.39/drivers/lguest/x86/switcher_32.S linux-2.6.39/drivers/lguest/x86/switcher_32.S
31577--- linux-2.6.39/drivers/lguest/x86/switcher_32.S 2011-05-19 00:06:34.000000000 -0400
31578+++ linux-2.6.39/drivers/lguest/x86/switcher_32.S 2011-05-22 19:36:31.000000000 -0400
31579@@ -87,6 +87,7 @@
31580 #include <asm/page.h>
31581 #include <asm/segment.h>
31582 #include <asm/lguest.h>
31583+#include <asm/processor-flags.h>
31584
31585 // We mark the start of the code to copy
31586 // It's placed in .text tho it's never run here
31587@@ -149,6 +150,13 @@ ENTRY(switch_to_guest)
31588 // Changes type when we load it: damn Intel!
31589 // For after we switch over our page tables
31590 // That entry will be read-only: we'd crash.
31591+
31592+#ifdef CONFIG_PAX_KERNEXEC
31593+ mov %cr0, %edx
31594+ xor $X86_CR0_WP, %edx
31595+ mov %edx, %cr0
31596+#endif
31597+
31598 movl $(GDT_ENTRY_TSS*8), %edx
31599 ltr %dx
31600
31601@@ -157,9 +165,15 @@ ENTRY(switch_to_guest)
31602 // Let's clear it again for our return.
31603 // The GDT descriptor of the Host
31604 // Points to the table after two "size" bytes
31605- movl (LGUEST_PAGES_host_gdt_desc+2)(%eax), %edx
31606+ movl (LGUEST_PAGES_host_gdt_desc+2)(%eax), %eax
31607 // Clear "used" from type field (byte 5, bit 2)
31608- andb $0xFD, (GDT_ENTRY_TSS*8 + 5)(%edx)
31609+ andb $0xFD, (GDT_ENTRY_TSS*8 + 5)(%eax)
31610+
31611+#ifdef CONFIG_PAX_KERNEXEC
31612+ mov %cr0, %eax
31613+ xor $X86_CR0_WP, %eax
31614+ mov %eax, %cr0
31615+#endif
31616
31617 // Once our page table's switched, the Guest is live!
31618 // The Host fades as we run this final step.
31619@@ -295,13 +309,12 @@ deliver_to_host:
31620 // I consulted gcc, and it gave
31621 // These instructions, which I gladly credit:
31622 leal (%edx,%ebx,8), %eax
31623- movzwl (%eax),%edx
31624- movl 4(%eax), %eax
31625- xorw %ax, %ax
31626- orl %eax, %edx
31627+ movl 4(%eax), %edx
31628+ movw (%eax), %dx
31629 // Now the address of the handler's in %edx
31630 // We call it now: its "iret" drops us home.
31631- jmp *%edx
31632+ ljmp $__KERNEL_CS, $1f
31633+1: jmp *%edx
31634
31635 // Every interrupt can come to us here
31636 // But we must truly tell each apart.
31637diff -urNp linux-2.6.39/drivers/md/dm.c linux-2.6.39/drivers/md/dm.c
31638--- linux-2.6.39/drivers/md/dm.c 2011-05-19 00:06:34.000000000 -0400
31639+++ linux-2.6.39/drivers/md/dm.c 2011-05-22 19:36:31.000000000 -0400
31640@@ -162,9 +162,9 @@ struct mapped_device {
31641 /*
31642 * Event handling.
31643 */
31644- atomic_t event_nr;
31645+ atomic_unchecked_t event_nr;
31646 wait_queue_head_t eventq;
31647- atomic_t uevent_seq;
31648+ atomic_unchecked_t uevent_seq;
31649 struct list_head uevent_list;
31650 spinlock_t uevent_lock; /* Protect access to uevent_list */
31651
31652@@ -1836,8 +1836,8 @@ static struct mapped_device *alloc_dev(i
31653 rwlock_init(&md->map_lock);
31654 atomic_set(&md->holders, 1);
31655 atomic_set(&md->open_count, 0);
31656- atomic_set(&md->event_nr, 0);
31657- atomic_set(&md->uevent_seq, 0);
31658+ atomic_set_unchecked(&md->event_nr, 0);
31659+ atomic_set_unchecked(&md->uevent_seq, 0);
31660 INIT_LIST_HEAD(&md->uevent_list);
31661 spin_lock_init(&md->uevent_lock);
31662
31663@@ -1971,7 +1971,7 @@ static void event_callback(void *context
31664
31665 dm_send_uevents(&uevents, &disk_to_dev(md->disk)->kobj);
31666
31667- atomic_inc(&md->event_nr);
31668+ atomic_inc_unchecked(&md->event_nr);
31669 wake_up(&md->eventq);
31670 }
31671
31672@@ -2547,18 +2547,18 @@ int dm_kobject_uevent(struct mapped_devi
31673
31674 uint32_t dm_next_uevent_seq(struct mapped_device *md)
31675 {
31676- return atomic_add_return(1, &md->uevent_seq);
31677+ return atomic_add_return_unchecked(1, &md->uevent_seq);
31678 }
31679
31680 uint32_t dm_get_event_nr(struct mapped_device *md)
31681 {
31682- return atomic_read(&md->event_nr);
31683+ return atomic_read_unchecked(&md->event_nr);
31684 }
31685
31686 int dm_wait_event(struct mapped_device *md, int event_nr)
31687 {
31688 return wait_event_interruptible(md->eventq,
31689- (event_nr != atomic_read(&md->event_nr)));
31690+ (event_nr != atomic_read_unchecked(&md->event_nr)));
31691 }
31692
31693 void dm_uevent_add(struct mapped_device *md, struct list_head *elist)
31694diff -urNp linux-2.6.39/drivers/md/dm-crypt.c linux-2.6.39/drivers/md/dm-crypt.c
31695--- linux-2.6.39/drivers/md/dm-crypt.c 2011-05-19 00:06:34.000000000 -0400
31696+++ linux-2.6.39/drivers/md/dm-crypt.c 2011-05-22 19:36:31.000000000 -0400
31697@@ -138,7 +138,7 @@ struct crypt_config {
31698 char *cipher;
31699 char *cipher_string;
31700
31701- struct crypt_iv_operations *iv_gen_ops;
31702+ const struct crypt_iv_operations *iv_gen_ops;
31703 union {
31704 struct iv_essiv_private essiv;
31705 struct iv_benbi_private benbi;
31706@@ -620,15 +620,15 @@ static int crypt_iv_lmk_post(struct cryp
31707 return r;
31708 }
31709
31710-static struct crypt_iv_operations crypt_iv_plain_ops = {
31711+static const struct crypt_iv_operations crypt_iv_plain_ops = {
31712 .generator = crypt_iv_plain_gen
31713 };
31714
31715-static struct crypt_iv_operations crypt_iv_plain64_ops = {
31716+static const struct crypt_iv_operations crypt_iv_plain64_ops = {
31717 .generator = crypt_iv_plain64_gen
31718 };
31719
31720-static struct crypt_iv_operations crypt_iv_essiv_ops = {
31721+static const struct crypt_iv_operations crypt_iv_essiv_ops = {
31722 .ctr = crypt_iv_essiv_ctr,
31723 .dtr = crypt_iv_essiv_dtr,
31724 .init = crypt_iv_essiv_init,
31725@@ -636,17 +636,17 @@ static struct crypt_iv_operations crypt_
31726 .generator = crypt_iv_essiv_gen
31727 };
31728
31729-static struct crypt_iv_operations crypt_iv_benbi_ops = {
31730+static const struct crypt_iv_operations crypt_iv_benbi_ops = {
31731 .ctr = crypt_iv_benbi_ctr,
31732 .dtr = crypt_iv_benbi_dtr,
31733 .generator = crypt_iv_benbi_gen
31734 };
31735
31736-static struct crypt_iv_operations crypt_iv_null_ops = {
31737+static const struct crypt_iv_operations crypt_iv_null_ops = {
31738 .generator = crypt_iv_null_gen
31739 };
31740
31741-static struct crypt_iv_operations crypt_iv_lmk_ops = {
31742+static const struct crypt_iv_operations crypt_iv_lmk_ops = {
31743 .ctr = crypt_iv_lmk_ctr,
31744 .dtr = crypt_iv_lmk_dtr,
31745 .init = crypt_iv_lmk_init,
31746diff -urNp linux-2.6.39/drivers/md/dm-ioctl.c linux-2.6.39/drivers/md/dm-ioctl.c
31747--- linux-2.6.39/drivers/md/dm-ioctl.c 2011-05-19 00:06:34.000000000 -0400
31748+++ linux-2.6.39/drivers/md/dm-ioctl.c 2011-05-22 19:36:31.000000000 -0400
31749@@ -1551,7 +1551,7 @@ static int validate_params(uint cmd, str
31750 cmd == DM_LIST_VERSIONS_CMD)
31751 return 0;
31752
31753- if ((cmd == DM_DEV_CREATE_CMD)) {
31754+ if (cmd == DM_DEV_CREATE_CMD) {
31755 if (!*param->name) {
31756 DMWARN("name not supplied when creating device");
31757 return -EINVAL;
31758diff -urNp linux-2.6.39/drivers/md/dm-raid1.c linux-2.6.39/drivers/md/dm-raid1.c
31759--- linux-2.6.39/drivers/md/dm-raid1.c 2011-05-19 00:06:34.000000000 -0400
31760+++ linux-2.6.39/drivers/md/dm-raid1.c 2011-05-22 19:36:31.000000000 -0400
31761@@ -42,7 +42,7 @@ enum dm_raid1_error {
31762
31763 struct mirror {
31764 struct mirror_set *ms;
31765- atomic_t error_count;
31766+ atomic_unchecked_t error_count;
31767 unsigned long error_type;
31768 struct dm_dev *dev;
31769 sector_t offset;
31770@@ -187,7 +187,7 @@ static struct mirror *get_valid_mirror(s
31771 struct mirror *m;
31772
31773 for (m = ms->mirror; m < ms->mirror + ms->nr_mirrors; m++)
31774- if (!atomic_read(&m->error_count))
31775+ if (!atomic_read_unchecked(&m->error_count))
31776 return m;
31777
31778 return NULL;
31779@@ -219,7 +219,7 @@ static void fail_mirror(struct mirror *m
31780 * simple way to tell if a device has encountered
31781 * errors.
31782 */
31783- atomic_inc(&m->error_count);
31784+ atomic_inc_unchecked(&m->error_count);
31785
31786 if (test_and_set_bit(error_type, &m->error_type))
31787 return;
31788@@ -410,7 +410,7 @@ static struct mirror *choose_mirror(stru
31789 struct mirror *m = get_default_mirror(ms);
31790
31791 do {
31792- if (likely(!atomic_read(&m->error_count)))
31793+ if (likely(!atomic_read_unchecked(&m->error_count)))
31794 return m;
31795
31796 if (m-- == ms->mirror)
31797@@ -424,7 +424,7 @@ static int default_ok(struct mirror *m)
31798 {
31799 struct mirror *default_mirror = get_default_mirror(m->ms);
31800
31801- return !atomic_read(&default_mirror->error_count);
31802+ return !atomic_read_unchecked(&default_mirror->error_count);
31803 }
31804
31805 static int mirror_available(struct mirror_set *ms, struct bio *bio)
31806@@ -561,7 +561,7 @@ static void do_reads(struct mirror_set *
31807 */
31808 if (likely(region_in_sync(ms, region, 1)))
31809 m = choose_mirror(ms, bio->bi_sector);
31810- else if (m && atomic_read(&m->error_count))
31811+ else if (m && atomic_read_unchecked(&m->error_count))
31812 m = NULL;
31813
31814 if (likely(m))
31815@@ -939,7 +939,7 @@ static int get_mirror(struct mirror_set
31816 }
31817
31818 ms->mirror[mirror].ms = ms;
31819- atomic_set(&(ms->mirror[mirror].error_count), 0);
31820+ atomic_set_unchecked(&(ms->mirror[mirror].error_count), 0);
31821 ms->mirror[mirror].error_type = 0;
31822 ms->mirror[mirror].offset = offset;
31823
31824@@ -1347,7 +1347,7 @@ static void mirror_resume(struct dm_targ
31825 */
31826 static char device_status_char(struct mirror *m)
31827 {
31828- if (!atomic_read(&(m->error_count)))
31829+ if (!atomic_read_unchecked(&(m->error_count)))
31830 return 'A';
31831
31832 return (test_bit(DM_RAID1_FLUSH_ERROR, &(m->error_type))) ? 'F' :
31833diff -urNp linux-2.6.39/drivers/md/dm-stripe.c linux-2.6.39/drivers/md/dm-stripe.c
31834--- linux-2.6.39/drivers/md/dm-stripe.c 2011-05-19 00:06:34.000000000 -0400
31835+++ linux-2.6.39/drivers/md/dm-stripe.c 2011-05-22 19:36:31.000000000 -0400
31836@@ -20,7 +20,7 @@ struct stripe {
31837 struct dm_dev *dev;
31838 sector_t physical_start;
31839
31840- atomic_t error_count;
31841+ atomic_unchecked_t error_count;
31842 };
31843
31844 struct stripe_c {
31845@@ -192,7 +192,7 @@ static int stripe_ctr(struct dm_target *
31846 kfree(sc);
31847 return r;
31848 }
31849- atomic_set(&(sc->stripe[i].error_count), 0);
31850+ atomic_set_unchecked(&(sc->stripe[i].error_count), 0);
31851 }
31852
31853 ti->private = sc;
31854@@ -314,7 +314,7 @@ static int stripe_status(struct dm_targe
31855 DMEMIT("%d ", sc->stripes);
31856 for (i = 0; i < sc->stripes; i++) {
31857 DMEMIT("%s ", sc->stripe[i].dev->name);
31858- buffer[i] = atomic_read(&(sc->stripe[i].error_count)) ?
31859+ buffer[i] = atomic_read_unchecked(&(sc->stripe[i].error_count)) ?
31860 'D' : 'A';
31861 }
31862 buffer[i] = '\0';
31863@@ -361,8 +361,8 @@ static int stripe_end_io(struct dm_targe
31864 */
31865 for (i = 0; i < sc->stripes; i++)
31866 if (!strcmp(sc->stripe[i].dev->name, major_minor)) {
31867- atomic_inc(&(sc->stripe[i].error_count));
31868- if (atomic_read(&(sc->stripe[i].error_count)) <
31869+ atomic_inc_unchecked(&(sc->stripe[i].error_count));
31870+ if (atomic_read_unchecked(&(sc->stripe[i].error_count)) <
31871 DM_IO_ERROR_THRESHOLD)
31872 schedule_work(&sc->trigger_event);
31873 }
31874diff -urNp linux-2.6.39/drivers/md/dm-table.c linux-2.6.39/drivers/md/dm-table.c
31875--- linux-2.6.39/drivers/md/dm-table.c 2011-05-19 00:06:34.000000000 -0400
31876+++ linux-2.6.39/drivers/md/dm-table.c 2011-05-22 19:36:31.000000000 -0400
31877@@ -373,7 +373,7 @@ static int device_area_is_invalid(struct
31878 if (!dev_size)
31879 return 0;
31880
31881- if ((start >= dev_size) || (start + len > dev_size)) {
31882+ if ((start >= dev_size) || (len > dev_size - start)) {
31883 DMWARN("%s: %s too small for target: "
31884 "start=%llu, len=%llu, dev_size=%llu",
31885 dm_device_name(ti->table->md), bdevname(bdev, b),
31886diff -urNp linux-2.6.39/drivers/md/md.c linux-2.6.39/drivers/md/md.c
31887--- linux-2.6.39/drivers/md/md.c 2011-05-19 00:06:34.000000000 -0400
31888+++ linux-2.6.39/drivers/md/md.c 2011-05-22 19:36:31.000000000 -0400
31889@@ -226,10 +226,10 @@ EXPORT_SYMBOL_GPL(bio_clone_mddev);
31890 * start build, activate spare
31891 */
31892 static DECLARE_WAIT_QUEUE_HEAD(md_event_waiters);
31893-static atomic_t md_event_count;
31894+static atomic_unchecked_t md_event_count;
31895 void md_new_event(mddev_t *mddev)
31896 {
31897- atomic_inc(&md_event_count);
31898+ atomic_inc_unchecked(&md_event_count);
31899 wake_up(&md_event_waiters);
31900 }
31901 EXPORT_SYMBOL_GPL(md_new_event);
31902@@ -239,7 +239,7 @@ EXPORT_SYMBOL_GPL(md_new_event);
31903 */
31904 static void md_new_event_inintr(mddev_t *mddev)
31905 {
31906- atomic_inc(&md_event_count);
31907+ atomic_inc_unchecked(&md_event_count);
31908 wake_up(&md_event_waiters);
31909 }
31910
31911@@ -1454,7 +1454,7 @@ static int super_1_load(mdk_rdev_t *rdev
31912
31913 rdev->preferred_minor = 0xffff;
31914 rdev->data_offset = le64_to_cpu(sb->data_offset);
31915- atomic_set(&rdev->corrected_errors, le32_to_cpu(sb->cnt_corrected_read));
31916+ atomic_set_unchecked(&rdev->corrected_errors, le32_to_cpu(sb->cnt_corrected_read));
31917
31918 rdev->sb_size = le32_to_cpu(sb->max_dev) * 2 + 256;
31919 bmask = queue_logical_block_size(rdev->bdev->bd_disk->queue)-1;
31920@@ -1632,7 +1632,7 @@ static void super_1_sync(mddev_t *mddev,
31921 else
31922 sb->resync_offset = cpu_to_le64(0);
31923
31924- sb->cnt_corrected_read = cpu_to_le32(atomic_read(&rdev->corrected_errors));
31925+ sb->cnt_corrected_read = cpu_to_le32(atomic_read_unchecked(&rdev->corrected_errors));
31926
31927 sb->raid_disks = cpu_to_le32(mddev->raid_disks);
31928 sb->size = cpu_to_le64(mddev->dev_sectors);
31929@@ -2414,7 +2414,7 @@ __ATTR(state, S_IRUGO|S_IWUSR, state_sho
31930 static ssize_t
31931 errors_show(mdk_rdev_t *rdev, char *page)
31932 {
31933- return sprintf(page, "%d\n", atomic_read(&rdev->corrected_errors));
31934+ return sprintf(page, "%d\n", atomic_read_unchecked(&rdev->corrected_errors));
31935 }
31936
31937 static ssize_t
31938@@ -2423,7 +2423,7 @@ errors_store(mdk_rdev_t *rdev, const cha
31939 char *e;
31940 unsigned long n = simple_strtoul(buf, &e, 10);
31941 if (*buf && (*e == 0 || *e == '\n')) {
31942- atomic_set(&rdev->corrected_errors, n);
31943+ atomic_set_unchecked(&rdev->corrected_errors, n);
31944 return len;
31945 }
31946 return -EINVAL;
31947@@ -2779,8 +2779,8 @@ void md_rdev_init(mdk_rdev_t *rdev)
31948 rdev->last_read_error.tv_sec = 0;
31949 rdev->last_read_error.tv_nsec = 0;
31950 atomic_set(&rdev->nr_pending, 0);
31951- atomic_set(&rdev->read_errors, 0);
31952- atomic_set(&rdev->corrected_errors, 0);
31953+ atomic_set_unchecked(&rdev->read_errors, 0);
31954+ atomic_set_unchecked(&rdev->corrected_errors, 0);
31955
31956 INIT_LIST_HEAD(&rdev->same_set);
31957 init_waitqueue_head(&rdev->blocked_wait);
31958@@ -6383,7 +6383,7 @@ static int md_seq_show(struct seq_file *
31959
31960 spin_unlock(&pers_lock);
31961 seq_printf(seq, "\n");
31962- mi->event = atomic_read(&md_event_count);
31963+ mi->event = atomic_read_unchecked(&md_event_count);
31964 return 0;
31965 }
31966 if (v == (void*)2) {
31967@@ -6472,7 +6472,7 @@ static int md_seq_show(struct seq_file *
31968 chunk_kb ? "KB" : "B");
31969 if (bitmap->file) {
31970 seq_printf(seq, ", file: ");
31971- seq_path(seq, &bitmap->file->f_path, " \t\n");
31972+ seq_path(seq, &bitmap->file->f_path, " \t\n\\");
31973 }
31974
31975 seq_printf(seq, "\n");
31976@@ -6506,7 +6506,7 @@ static int md_seq_open(struct inode *ino
31977 else {
31978 struct seq_file *p = file->private_data;
31979 p->private = mi;
31980- mi->event = atomic_read(&md_event_count);
31981+ mi->event = atomic_read_unchecked(&md_event_count);
31982 }
31983 return error;
31984 }
31985@@ -6522,7 +6522,7 @@ static unsigned int mdstat_poll(struct f
31986 /* always allow read */
31987 mask = POLLIN | POLLRDNORM;
31988
31989- if (mi->event != atomic_read(&md_event_count))
31990+ if (mi->event != atomic_read_unchecked(&md_event_count))
31991 mask |= POLLERR | POLLPRI;
31992 return mask;
31993 }
31994@@ -6566,7 +6566,7 @@ static int is_mddev_idle(mddev_t *mddev,
31995 struct gendisk *disk = rdev->bdev->bd_contains->bd_disk;
31996 curr_events = (int)part_stat_read(&disk->part0, sectors[0]) +
31997 (int)part_stat_read(&disk->part0, sectors[1]) -
31998- atomic_read(&disk->sync_io);
31999+ atomic_read_unchecked(&disk->sync_io);
32000 /* sync IO will cause sync_io to increase before the disk_stats
32001 * as sync_io is counted when a request starts, and
32002 * disk_stats is counted when it completes.
32003diff -urNp linux-2.6.39/drivers/md/md.h linux-2.6.39/drivers/md/md.h
32004--- linux-2.6.39/drivers/md/md.h 2011-05-19 00:06:34.000000000 -0400
32005+++ linux-2.6.39/drivers/md/md.h 2011-05-22 19:36:31.000000000 -0400
32006@@ -97,13 +97,13 @@ struct mdk_rdev_s
32007 * only maintained for arrays that
32008 * support hot removal
32009 */
32010- atomic_t read_errors; /* number of consecutive read errors that
32011+ atomic_unchecked_t read_errors; /* number of consecutive read errors that
32012 * we have tried to ignore.
32013 */
32014 struct timespec last_read_error; /* monotonic time since our
32015 * last read error
32016 */
32017- atomic_t corrected_errors; /* number of corrected read errors,
32018+ atomic_unchecked_t corrected_errors; /* number of corrected read errors,
32019 * for reporting to userspace and storing
32020 * in superblock.
32021 */
32022@@ -342,7 +342,7 @@ static inline void rdev_dec_pending(mdk_
32023
32024 static inline void md_sync_acct(struct block_device *bdev, unsigned long nr_sectors)
32025 {
32026- atomic_add(nr_sectors, &bdev->bd_contains->bd_disk->sync_io);
32027+ atomic_add_unchecked(nr_sectors, &bdev->bd_contains->bd_disk->sync_io);
32028 }
32029
32030 struct mdk_personality
32031diff -urNp linux-2.6.39/drivers/md/raid10.c linux-2.6.39/drivers/md/raid10.c
32032--- linux-2.6.39/drivers/md/raid10.c 2011-05-19 00:06:34.000000000 -0400
32033+++ linux-2.6.39/drivers/md/raid10.c 2011-05-22 19:36:31.000000000 -0400
32034@@ -1209,7 +1209,7 @@ static void end_sync_read(struct bio *bi
32035 if (test_bit(BIO_UPTODATE, &bio->bi_flags))
32036 set_bit(R10BIO_Uptodate, &r10_bio->state);
32037 else {
32038- atomic_add(r10_bio->sectors,
32039+ atomic_add_unchecked(r10_bio->sectors,
32040 &conf->mirrors[d].rdev->corrected_errors);
32041 if (!test_bit(MD_RECOVERY_SYNC, &conf->mddev->recovery))
32042 md_error(r10_bio->mddev,
32043@@ -1417,7 +1417,7 @@ static void check_decay_read_errors(mdde
32044 {
32045 struct timespec cur_time_mon;
32046 unsigned long hours_since_last;
32047- unsigned int read_errors = atomic_read(&rdev->read_errors);
32048+ unsigned int read_errors = atomic_read_unchecked(&rdev->read_errors);
32049
32050 ktime_get_ts(&cur_time_mon);
32051
32052@@ -1439,9 +1439,9 @@ static void check_decay_read_errors(mdde
32053 * overflowing the shift of read_errors by hours_since_last.
32054 */
32055 if (hours_since_last >= 8 * sizeof(read_errors))
32056- atomic_set(&rdev->read_errors, 0);
32057+ atomic_set_unchecked(&rdev->read_errors, 0);
32058 else
32059- atomic_set(&rdev->read_errors, read_errors >> hours_since_last);
32060+ atomic_set_unchecked(&rdev->read_errors, read_errors >> hours_since_last);
32061 }
32062
32063 /*
32064@@ -1476,8 +1476,8 @@ static void fix_read_error(conf_t *conf,
32065 }
32066
32067 check_decay_read_errors(mddev, rdev);
32068- atomic_inc(&rdev->read_errors);
32069- cur_read_error_count = atomic_read(&rdev->read_errors);
32070+ atomic_inc_unchecked(&rdev->read_errors);
32071+ cur_read_error_count = atomic_read_unchecked(&rdev->read_errors);
32072 if (cur_read_error_count > max_read_errors) {
32073 rcu_read_unlock();
32074 printk(KERN_NOTICE
32075@@ -1550,7 +1550,7 @@ static void fix_read_error(conf_t *conf,
32076 test_bit(In_sync, &rdev->flags)) {
32077 atomic_inc(&rdev->nr_pending);
32078 rcu_read_unlock();
32079- atomic_add(s, &rdev->corrected_errors);
32080+ atomic_add_unchecked(s, &rdev->corrected_errors);
32081 if (sync_page_io(rdev,
32082 r10_bio->devs[sl].addr +
32083 sect,
32084diff -urNp linux-2.6.39/drivers/md/raid1.c linux-2.6.39/drivers/md/raid1.c
32085--- linux-2.6.39/drivers/md/raid1.c 2011-05-19 00:06:34.000000000 -0400
32086+++ linux-2.6.39/drivers/md/raid1.c 2011-05-22 19:36:31.000000000 -0400
32087@@ -1342,7 +1342,7 @@ static void sync_request_write(mddev_t *
32088 if (r1_bio->bios[d]->bi_end_io != end_sync_read)
32089 continue;
32090 rdev = conf->mirrors[d].rdev;
32091- atomic_add(s, &rdev->corrected_errors);
32092+ atomic_add_unchecked(s, &rdev->corrected_errors);
32093 if (sync_page_io(rdev,
32094 sect,
32095 s<<9,
32096@@ -1488,7 +1488,7 @@ static void fix_read_error(conf_t *conf,
32097 /* Well, this device is dead */
32098 md_error(mddev, rdev);
32099 else {
32100- atomic_add(s, &rdev->corrected_errors);
32101+ atomic_add_unchecked(s, &rdev->corrected_errors);
32102 printk(KERN_INFO
32103 "md/raid1:%s: read error corrected "
32104 "(%d sectors at %llu on %s)\n",
32105diff -urNp linux-2.6.39/drivers/md/raid5.c linux-2.6.39/drivers/md/raid5.c
32106--- linux-2.6.39/drivers/md/raid5.c 2011-05-19 00:06:34.000000000 -0400
32107+++ linux-2.6.39/drivers/md/raid5.c 2011-05-22 19:36:31.000000000 -0400
32108@@ -550,7 +550,7 @@ static void ops_run_io(struct stripe_hea
32109 bi->bi_next = NULL;
32110 if (rw == WRITE &&
32111 test_bit(R5_ReWrite, &sh->dev[i].flags))
32112- atomic_add(STRIPE_SECTORS,
32113+ atomic_add_unchecked(STRIPE_SECTORS,
32114 &rdev->corrected_errors);
32115 generic_make_request(bi);
32116 } else {
32117@@ -1596,15 +1596,15 @@ static void raid5_end_read_request(struc
32118 clear_bit(R5_ReadError, &sh->dev[i].flags);
32119 clear_bit(R5_ReWrite, &sh->dev[i].flags);
32120 }
32121- if (atomic_read(&conf->disks[i].rdev->read_errors))
32122- atomic_set(&conf->disks[i].rdev->read_errors, 0);
32123+ if (atomic_read_unchecked(&conf->disks[i].rdev->read_errors))
32124+ atomic_set_unchecked(&conf->disks[i].rdev->read_errors, 0);
32125 } else {
32126 const char *bdn = bdevname(conf->disks[i].rdev->bdev, b);
32127 int retry = 0;
32128 rdev = conf->disks[i].rdev;
32129
32130 clear_bit(R5_UPTODATE, &sh->dev[i].flags);
32131- atomic_inc(&rdev->read_errors);
32132+ atomic_inc_unchecked(&rdev->read_errors);
32133 if (conf->mddev->degraded >= conf->max_degraded)
32134 printk_rl(KERN_WARNING
32135 "md/raid:%s: read error not correctable "
32136@@ -1622,7 +1622,7 @@ static void raid5_end_read_request(struc
32137 (unsigned long long)(sh->sector
32138 + rdev->data_offset),
32139 bdn);
32140- else if (atomic_read(&rdev->read_errors)
32141+ else if (atomic_read_unchecked(&rdev->read_errors)
32142 > conf->max_nr_stripes)
32143 printk(KERN_WARNING
32144 "md/raid:%s: Too many read errors, failing device %s.\n",
32145@@ -1947,6 +1947,7 @@ static sector_t compute_blocknr(struct s
32146 sector_t r_sector;
32147 struct stripe_head sh2;
32148
32149+ pax_track_stack();
32150
32151 chunk_offset = sector_div(new_sector, sectors_per_chunk);
32152 stripe = new_sector;
32153diff -urNp linux-2.6.39/drivers/media/common/saa7146_hlp.c linux-2.6.39/drivers/media/common/saa7146_hlp.c
32154--- linux-2.6.39/drivers/media/common/saa7146_hlp.c 2011-05-19 00:06:34.000000000 -0400
32155+++ linux-2.6.39/drivers/media/common/saa7146_hlp.c 2011-05-22 19:36:31.000000000 -0400
32156@@ -353,6 +353,8 @@ static void calculate_clipping_registers
32157
32158 int x[32], y[32], w[32], h[32];
32159
32160+ pax_track_stack();
32161+
32162 /* clear out memory */
32163 memset(&line_list[0], 0x00, sizeof(u32)*32);
32164 memset(&pixel_list[0], 0x00, sizeof(u32)*32);
32165diff -urNp linux-2.6.39/drivers/media/common/saa7146_vbi.c linux-2.6.39/drivers/media/common/saa7146_vbi.c
32166--- linux-2.6.39/drivers/media/common/saa7146_vbi.c 2011-05-19 00:06:34.000000000 -0400
32167+++ linux-2.6.39/drivers/media/common/saa7146_vbi.c 2011-05-22 19:36:31.000000000 -0400
32168@@ -501,7 +501,7 @@ static ssize_t vbi_read(struct file *fil
32169 return ret;
32170 }
32171
32172-struct saa7146_use_ops saa7146_vbi_uops = {
32173+const struct saa7146_use_ops saa7146_vbi_uops = {
32174 .init = vbi_init,
32175 .open = vbi_open,
32176 .release = vbi_close,
32177diff -urNp linux-2.6.39/drivers/media/common/saa7146_video.c linux-2.6.39/drivers/media/common/saa7146_video.c
32178--- linux-2.6.39/drivers/media/common/saa7146_video.c 2011-05-19 00:06:34.000000000 -0400
32179+++ linux-2.6.39/drivers/media/common/saa7146_video.c 2011-05-22 19:36:31.000000000 -0400
32180@@ -1420,7 +1420,7 @@ out:
32181 return ret;
32182 }
32183
32184-struct saa7146_use_ops saa7146_video_uops = {
32185+const struct saa7146_use_ops saa7146_video_uops = {
32186 .init = video_init,
32187 .open = video_open,
32188 .release = video_close,
32189diff -urNp linux-2.6.39/drivers/media/dvb/dm1105/dm1105.c linux-2.6.39/drivers/media/dvb/dm1105/dm1105.c
32190--- linux-2.6.39/drivers/media/dvb/dm1105/dm1105.c 2011-05-19 00:06:34.000000000 -0400
32191+++ linux-2.6.39/drivers/media/dvb/dm1105/dm1105.c 2011-05-22 19:36:31.000000000 -0400
32192@@ -418,7 +418,7 @@ static u32 functionality(struct i2c_adap
32193 return I2C_FUNC_I2C;
32194 }
32195
32196-static struct i2c_algorithm dm1105_algo = {
32197+static const struct i2c_algorithm dm1105_algo = {
32198 .master_xfer = dm1105_i2c_xfer,
32199 .functionality = functionality,
32200 };
32201diff -urNp linux-2.6.39/drivers/media/dvb/dvb-core/dvb_ca_en50221.c linux-2.6.39/drivers/media/dvb/dvb-core/dvb_ca_en50221.c
32202--- linux-2.6.39/drivers/media/dvb/dvb-core/dvb_ca_en50221.c 2011-05-19 00:06:34.000000000 -0400
32203+++ linux-2.6.39/drivers/media/dvb/dvb-core/dvb_ca_en50221.c 2011-05-22 19:36:31.000000000 -0400
32204@@ -590,6 +590,8 @@ static int dvb_ca_en50221_read_data(stru
32205 u8 buf[HOST_LINK_BUF_SIZE];
32206 int i;
32207
32208+ pax_track_stack();
32209+
32210 dprintk("%s\n", __func__);
32211
32212 /* check if we have space for a link buf in the rx_buffer */
32213@@ -1285,6 +1287,8 @@ static ssize_t dvb_ca_en50221_io_write(s
32214 unsigned long timeout;
32215 int written;
32216
32217+ pax_track_stack();
32218+
32219 dprintk("%s\n", __func__);
32220
32221 /* Incoming packet has a 2 byte header. hdr[0] = slot_id, hdr[1] = connection_id */
32222diff -urNp linux-2.6.39/drivers/media/dvb/dvb-core/dvbdev.c linux-2.6.39/drivers/media/dvb/dvb-core/dvbdev.c
32223--- linux-2.6.39/drivers/media/dvb/dvb-core/dvbdev.c 2011-05-19 00:06:34.000000000 -0400
32224+++ linux-2.6.39/drivers/media/dvb/dvb-core/dvbdev.c 2011-05-22 19:36:31.000000000 -0400
32225@@ -192,7 +192,7 @@ int dvb_register_device(struct dvb_adapt
32226 const struct dvb_device *template, void *priv, int type)
32227 {
32228 struct dvb_device *dvbdev;
32229- struct file_operations *dvbdevfops;
32230+ struct file_operations *dvbdevfops; /* cannot be const, see this function */
32231 struct device *clsdev;
32232 int minor;
32233 int id;
32234diff -urNp linux-2.6.39/drivers/media/dvb/dvb-usb/dib0700_core.c linux-2.6.39/drivers/media/dvb/dvb-usb/dib0700_core.c
32235--- linux-2.6.39/drivers/media/dvb/dvb-usb/dib0700_core.c 2011-05-19 00:06:34.000000000 -0400
32236+++ linux-2.6.39/drivers/media/dvb/dvb-usb/dib0700_core.c 2011-05-22 19:36:31.000000000 -0400
32237@@ -391,6 +391,8 @@ int dib0700_download_firmware(struct usb
32238
32239 u8 buf[260];
32240
32241+ pax_track_stack();
32242+
32243 while ((ret = dvb_usb_get_hexline(fw, &hx, &pos)) > 0) {
32244 deb_fwdata("writing to address 0x%08x (buffer: 0x%02x %02x)\n",
32245 hx.addr, hx.len, hx.chk);
32246diff -urNp linux-2.6.39/drivers/media/dvb/dvb-usb/lmedm04.c linux-2.6.39/drivers/media/dvb/dvb-usb/lmedm04.c
32247--- linux-2.6.39/drivers/media/dvb/dvb-usb/lmedm04.c 2011-05-19 00:06:34.000000000 -0400
32248+++ linux-2.6.39/drivers/media/dvb/dvb-usb/lmedm04.c 2011-05-22 19:36:31.000000000 -0400
32249@@ -663,6 +663,7 @@ static int lme2510_download_firmware(str
32250 packet_size = 0x31;
32251 len_in = 1;
32252
32253+ pax_track_stack();
32254
32255 info("FRM Starting Firmware Download");
32256
32257@@ -715,6 +716,8 @@ static void lme_coldreset(struct usb_dev
32258 int ret = 0, len_in;
32259 u8 data[512] = {0};
32260
32261+ pax_track_stack();
32262+
32263 data[0] = 0x0a;
32264 len_in = 1;
32265 info("FRM Firmware Cold Reset");
32266diff -urNp linux-2.6.39/drivers/media/dvb/frontends/dib7000p.c linux-2.6.39/drivers/media/dvb/frontends/dib7000p.c
32267--- linux-2.6.39/drivers/media/dvb/frontends/dib7000p.c 2011-05-19 00:06:34.000000000 -0400
32268+++ linux-2.6.39/drivers/media/dvb/frontends/dib7000p.c 2011-05-22 19:36:31.000000000 -0400
32269@@ -1913,7 +1913,7 @@ static u32 dib7000p_i2c_func(struct i2c_
32270 return I2C_FUNC_I2C;
32271 }
32272
32273-static struct i2c_algorithm dib7090_tuner_xfer_algo = {
32274+static const struct i2c_algorithm dib7090_tuner_xfer_algo = {
32275 .master_xfer = dib7090_tuner_xfer,
32276 .functionality = dib7000p_i2c_func,
32277 };
32278diff -urNp linux-2.6.39/drivers/media/dvb/frontends/dib9000.c linux-2.6.39/drivers/media/dvb/frontends/dib9000.c
32279--- linux-2.6.39/drivers/media/dvb/frontends/dib9000.c 2011-05-19 00:06:34.000000000 -0400
32280+++ linux-2.6.39/drivers/media/dvb/frontends/dib9000.c 2011-05-22 19:36:31.000000000 -0400
32281@@ -1649,12 +1649,12 @@ static u32 dib9000_i2c_func(struct i2c_a
32282 return I2C_FUNC_I2C;
32283 }
32284
32285-static struct i2c_algorithm dib9000_tuner_algo = {
32286+static const struct i2c_algorithm dib9000_tuner_algo = {
32287 .master_xfer = dib9000_tuner_xfer,
32288 .functionality = dib9000_i2c_func,
32289 };
32290
32291-static struct i2c_algorithm dib9000_component_bus_algo = {
32292+static const struct i2c_algorithm dib9000_component_bus_algo = {
32293 .master_xfer = dib9000_fw_component_bus_xfer,
32294 .functionality = dib9000_i2c_func,
32295 };
32296diff -urNp linux-2.6.39/drivers/media/dvb/frontends/dibx000_common.c linux-2.6.39/drivers/media/dvb/frontends/dibx000_common.c
32297--- linux-2.6.39/drivers/media/dvb/frontends/dibx000_common.c 2011-05-19 00:06:34.000000000 -0400
32298+++ linux-2.6.39/drivers/media/dvb/frontends/dibx000_common.c 2011-05-22 19:36:31.000000000 -0400
32299@@ -212,12 +212,12 @@ static int dibx000_i2c_master_xfer_gpio3
32300 return num;
32301 }
32302
32303-static struct i2c_algorithm dibx000_i2c_master_gpio12_xfer_algo = {
32304+static const struct i2c_algorithm dibx000_i2c_master_gpio12_xfer_algo = {
32305 .master_xfer = dibx000_i2c_master_xfer_gpio12,
32306 .functionality = dibx000_i2c_func,
32307 };
32308
32309-static struct i2c_algorithm dibx000_i2c_master_gpio34_xfer_algo = {
32310+static const struct i2c_algorithm dibx000_i2c_master_gpio34_xfer_algo = {
32311 .master_xfer = dibx000_i2c_master_xfer_gpio34,
32312 .functionality = dibx000_i2c_func,
32313 };
32314@@ -270,7 +270,7 @@ static int dibx000_i2c_gated_gpio67_xfer
32315 return i2c_transfer(mst->i2c_adap, m, 2 + num) == 2 + num ? num : -EIO;
32316 }
32317
32318-static struct i2c_algorithm dibx000_i2c_gated_gpio67_algo = {
32319+static const struct i2c_algorithm dibx000_i2c_gated_gpio67_algo = {
32320 .master_xfer = dibx000_i2c_gated_gpio67_xfer,
32321 .functionality = dibx000_i2c_func,
32322 };
32323@@ -301,7 +301,7 @@ static int dibx000_i2c_gated_tuner_xfer(
32324 return i2c_transfer(mst->i2c_adap, m, 2 + num) == 2 + num ? num : -EIO;
32325 }
32326
32327-static struct i2c_algorithm dibx000_i2c_gated_tuner_algo = {
32328+static const struct i2c_algorithm dibx000_i2c_gated_tuner_algo = {
32329 .master_xfer = dibx000_i2c_gated_tuner_xfer,
32330 .functionality = dibx000_i2c_func,
32331 };
32332@@ -354,7 +354,7 @@ void dibx000_reset_i2c_master(struct dib
32333 EXPORT_SYMBOL(dibx000_reset_i2c_master);
32334
32335 static int i2c_adapter_init(struct i2c_adapter *i2c_adap,
32336- struct i2c_algorithm *algo, const char *name,
32337+ const struct i2c_algorithm *algo, const char *name,
32338 struct dibx000_i2c_master *mst)
32339 {
32340 strncpy(i2c_adap->name, name, sizeof(i2c_adap->name));
32341diff -urNp linux-2.6.39/drivers/media/dvb/frontends/mb86a16.c linux-2.6.39/drivers/media/dvb/frontends/mb86a16.c
32342--- linux-2.6.39/drivers/media/dvb/frontends/mb86a16.c 2011-05-19 00:06:34.000000000 -0400
32343+++ linux-2.6.39/drivers/media/dvb/frontends/mb86a16.c 2011-05-22 19:36:31.000000000 -0400
32344@@ -1060,6 +1060,8 @@ static int mb86a16_set_fe(struct mb86a16
32345 int ret = -1;
32346 int sync;
32347
32348+ pax_track_stack();
32349+
32350 dprintk(verbose, MB86A16_INFO, 1, "freq=%d Mhz, symbrt=%d Ksps", state->frequency, state->srate);
32351
32352 fcp = 3000;
32353diff -urNp linux-2.6.39/drivers/media/dvb/frontends/or51211.c linux-2.6.39/drivers/media/dvb/frontends/or51211.c
32354--- linux-2.6.39/drivers/media/dvb/frontends/or51211.c 2011-05-19 00:06:34.000000000 -0400
32355+++ linux-2.6.39/drivers/media/dvb/frontends/or51211.c 2011-05-22 19:36:31.000000000 -0400
32356@@ -113,6 +113,8 @@ static int or51211_load_firmware (struct
32357 u8 tudata[585];
32358 int i;
32359
32360+ pax_track_stack();
32361+
32362 dprintk("Firmware is %zd bytes\n",fw->size);
32363
32364 /* Get eprom data */
32365diff -urNp linux-2.6.39/drivers/media/dvb/frontends/s5h1420.c linux-2.6.39/drivers/media/dvb/frontends/s5h1420.c
32366--- linux-2.6.39/drivers/media/dvb/frontends/s5h1420.c 2011-05-19 00:06:34.000000000 -0400
32367+++ linux-2.6.39/drivers/media/dvb/frontends/s5h1420.c 2011-05-22 19:36:31.000000000 -0400
32368@@ -870,7 +870,7 @@ static int s5h1420_tuner_i2c_tuner_xfer(
32369 return i2c_transfer(state->i2c, m, 1+num) == 1 + num ? num : -EIO;
32370 }
32371
32372-static struct i2c_algorithm s5h1420_tuner_i2c_algo = {
32373+static const struct i2c_algorithm s5h1420_tuner_i2c_algo = {
32374 .master_xfer = s5h1420_tuner_i2c_tuner_xfer,
32375 .functionality = s5h1420_tuner_i2c_func,
32376 };
32377diff -urNp linux-2.6.39/drivers/media/dvb/mantis/mantis_i2c.c linux-2.6.39/drivers/media/dvb/mantis/mantis_i2c.c
32378--- linux-2.6.39/drivers/media/dvb/mantis/mantis_i2c.c 2011-05-19 00:06:34.000000000 -0400
32379+++ linux-2.6.39/drivers/media/dvb/mantis/mantis_i2c.c 2011-05-22 19:36:31.000000000 -0400
32380@@ -212,7 +212,7 @@ static u32 mantis_i2c_func(struct i2c_ad
32381 return I2C_FUNC_SMBUS_EMUL;
32382 }
32383
32384-static struct i2c_algorithm mantis_algo = {
32385+static const struct i2c_algorithm mantis_algo = {
32386 .master_xfer = mantis_i2c_xfer,
32387 .functionality = mantis_i2c_func,
32388 };
32389diff -urNp linux-2.6.39/drivers/media/dvb/ttusb-dec/ttusb_dec.c linux-2.6.39/drivers/media/dvb/ttusb-dec/ttusb_dec.c
32390--- linux-2.6.39/drivers/media/dvb/ttusb-dec/ttusb_dec.c 2011-05-19 00:06:34.000000000 -0400
32391+++ linux-2.6.39/drivers/media/dvb/ttusb-dec/ttusb_dec.c 2011-05-22 19:36:31.000000000 -0400
32392@@ -1614,7 +1614,7 @@ static int fe_send_command(struct dvb_fr
32393 return ttusb_dec_send_command(dec, command, param_length, params, result_length, cmd_result);
32394 }
32395
32396-static struct ttusbdecfe_config fe_config = {
32397+static const struct ttusbdecfe_config fe_config = {
32398 .send_command = fe_send_command
32399 };
32400
32401diff -urNp linux-2.6.39/drivers/media/radio/radio-cadet.c linux-2.6.39/drivers/media/radio/radio-cadet.c
32402--- linux-2.6.39/drivers/media/radio/radio-cadet.c 2011-05-19 00:06:34.000000000 -0400
32403+++ linux-2.6.39/drivers/media/radio/radio-cadet.c 2011-05-22 19:36:31.000000000 -0400
32404@@ -349,7 +349,7 @@ static ssize_t cadet_read(struct file *f
32405 readbuf[i++] = dev->rdsbuf[dev->rdsout++];
32406 mutex_unlock(&dev->lock);
32407
32408- if (copy_to_user(data, readbuf, i))
32409+ if (i > sizeof readbuf || copy_to_user(data, readbuf, i))
32410 return -EFAULT;
32411 return i;
32412 }
32413diff -urNp linux-2.6.39/drivers/media/radio/radio-si4713.c linux-2.6.39/drivers/media/radio/radio-si4713.c
32414--- linux-2.6.39/drivers/media/radio/radio-si4713.c 2011-05-19 00:06:34.000000000 -0400
32415+++ linux-2.6.39/drivers/media/radio/radio-si4713.c 2011-05-22 19:36:31.000000000 -0400
32416@@ -231,7 +231,7 @@ static long radio_si4713_default(struct
32417 ioctl, cmd, arg);
32418 }
32419
32420-static struct v4l2_ioctl_ops radio_si4713_ioctl_ops = {
32421+static const struct v4l2_ioctl_ops radio_si4713_ioctl_ops = {
32422 .vidioc_enumaudout = radio_si4713_enumaudout,
32423 .vidioc_g_audout = radio_si4713_g_audout,
32424 .vidioc_s_audout = radio_si4713_s_audout,
32425diff -urNp linux-2.6.39/drivers/media/rc/ir-lirc-codec.c linux-2.6.39/drivers/media/rc/ir-lirc-codec.c
32426--- linux-2.6.39/drivers/media/rc/ir-lirc-codec.c 2011-05-19 00:06:34.000000000 -0400
32427+++ linux-2.6.39/drivers/media/rc/ir-lirc-codec.c 2011-05-22 19:36:31.000000000 -0400
32428@@ -277,7 +277,7 @@ static void ir_lirc_close(void *data)
32429 return;
32430 }
32431
32432-static struct file_operations lirc_fops = {
32433+static const struct file_operations lirc_fops = {
32434 .owner = THIS_MODULE,
32435 .write = ir_lirc_transmit_ir,
32436 .unlocked_ioctl = ir_lirc_ioctl,
32437diff -urNp linux-2.6.39/drivers/media/rc/lirc_dev.c linux-2.6.39/drivers/media/rc/lirc_dev.c
32438--- linux-2.6.39/drivers/media/rc/lirc_dev.c 2011-05-19 00:06:34.000000000 -0400
32439+++ linux-2.6.39/drivers/media/rc/lirc_dev.c 2011-05-22 19:36:31.000000000 -0400
32440@@ -151,7 +151,7 @@ static int lirc_thread(void *irctl)
32441 }
32442
32443
32444-static struct file_operations lirc_dev_fops = {
32445+static const struct file_operations lirc_dev_fops = {
32446 .owner = THIS_MODULE,
32447 .read = lirc_dev_fop_read,
32448 .write = lirc_dev_fop_write,
32449diff -urNp linux-2.6.39/drivers/media/rc/rc-main.c linux-2.6.39/drivers/media/rc/rc-main.c
32450--- linux-2.6.39/drivers/media/rc/rc-main.c 2011-05-19 00:06:34.000000000 -0400
32451+++ linux-2.6.39/drivers/media/rc/rc-main.c 2011-05-22 19:36:31.000000000 -0400
32452@@ -996,7 +996,7 @@ EXPORT_SYMBOL_GPL(rc_free_device);
32453
32454 int rc_register_device(struct rc_dev *dev)
32455 {
32456- static atomic_t devno = ATOMIC_INIT(0);
32457+ static atomic_unchecked_t devno = ATOMIC_INIT(0);
32458 struct rc_map *rc_map;
32459 const char *path;
32460 int rc;
32461@@ -1019,7 +1019,7 @@ int rc_register_device(struct rc_dev *de
32462 if (dev->close)
32463 dev->input_dev->close = ir_close;
32464
32465- dev->devno = (unsigned long)(atomic_inc_return(&devno) - 1);
32466+ dev->devno = (unsigned long)(atomic_inc_return_unchecked(&devno) - 1);
32467 dev_set_name(&dev->dev, "rc%ld", dev->devno);
32468 dev_set_drvdata(&dev->dev, dev);
32469 rc = device_add(&dev->dev);
32470diff -urNp linux-2.6.39/drivers/media/video/au0828/au0828.h linux-2.6.39/drivers/media/video/au0828/au0828.h
32471--- linux-2.6.39/drivers/media/video/au0828/au0828.h 2011-05-19 00:06:34.000000000 -0400
32472+++ linux-2.6.39/drivers/media/video/au0828/au0828.h 2011-05-22 19:36:31.000000000 -0400
32473@@ -191,7 +191,7 @@ struct au0828_dev {
32474
32475 /* I2C */
32476 struct i2c_adapter i2c_adap;
32477- struct i2c_algorithm i2c_algo;
32478+ struct i2c_algorithm i2c_algo;
32479 struct i2c_client i2c_client;
32480 u32 i2c_rc;
32481
32482diff -urNp linux-2.6.39/drivers/media/video/cafe_ccic.c linux-2.6.39/drivers/media/video/cafe_ccic.c
32483--- linux-2.6.39/drivers/media/video/cafe_ccic.c 2011-05-19 00:06:34.000000000 -0400
32484+++ linux-2.6.39/drivers/media/video/cafe_ccic.c 2011-05-22 19:36:31.000000000 -0400
32485@@ -520,7 +520,7 @@ static u32 cafe_smbus_func(struct i2c_ad
32486 I2C_FUNC_SMBUS_WRITE_BYTE_DATA;
32487 }
32488
32489-static struct i2c_algorithm cafe_smbus_algo = {
32490+static const struct i2c_algorithm cafe_smbus_algo = {
32491 .smbus_xfer = cafe_smbus_xfer,
32492 .functionality = cafe_smbus_func
32493 };
32494diff -urNp linux-2.6.39/drivers/media/video/cx18/cx18-alsa-pcm.c linux-2.6.39/drivers/media/video/cx18/cx18-alsa-pcm.c
32495--- linux-2.6.39/drivers/media/video/cx18/cx18-alsa-pcm.c 2011-05-19 00:06:34.000000000 -0400
32496+++ linux-2.6.39/drivers/media/video/cx18/cx18-alsa-pcm.c 2011-05-22 19:36:31.000000000 -0400
32497@@ -314,7 +314,7 @@ static struct page *snd_pcm_get_vmalloc_
32498 return vmalloc_to_page(pageptr);
32499 }
32500
32501-static struct snd_pcm_ops snd_cx18_pcm_capture_ops = {
32502+static const struct snd_pcm_ops snd_cx18_pcm_capture_ops = {
32503 .open = snd_cx18_pcm_capture_open,
32504 .close = snd_cx18_pcm_capture_close,
32505 .ioctl = snd_cx18_pcm_ioctl,
32506diff -urNp linux-2.6.39/drivers/media/video/cx18/cx18-driver.c linux-2.6.39/drivers/media/video/cx18/cx18-driver.c
32507--- linux-2.6.39/drivers/media/video/cx18/cx18-driver.c 2011-05-19 00:06:34.000000000 -0400
32508+++ linux-2.6.39/drivers/media/video/cx18/cx18-driver.c 2011-05-22 19:36:31.000000000 -0400
32509@@ -61,7 +61,7 @@ static struct pci_device_id cx18_pci_tbl
32510
32511 MODULE_DEVICE_TABLE(pci, cx18_pci_tbl);
32512
32513-static atomic_t cx18_instance = ATOMIC_INIT(0);
32514+static atomic_unchecked_t cx18_instance = ATOMIC_INIT(0);
32515
32516 /* Parameter declarations */
32517 static int cardtype[CX18_MAX_CARDS];
32518@@ -327,6 +327,8 @@ void cx18_read_eeprom(struct cx18 *cx, s
32519 struct i2c_client c;
32520 u8 eedata[256];
32521
32522+ pax_track_stack();
32523+
32524 memset(&c, 0, sizeof(c));
32525 strlcpy(c.name, "cx18 tveeprom tmp", sizeof(c.name));
32526 c.adapter = &cx->i2c_adap[0];
32527@@ -892,7 +894,7 @@ static int __devinit cx18_probe(struct p
32528 struct cx18 *cx;
32529
32530 /* FIXME - module parameter arrays constrain max instances */
32531- i = atomic_inc_return(&cx18_instance) - 1;
32532+ i = atomic_inc_return_unchecked(&cx18_instance) - 1;
32533 if (i >= CX18_MAX_CARDS) {
32534 printk(KERN_ERR "cx18: cannot manage card %d, driver has a "
32535 "limit of 0 - %d\n", i, CX18_MAX_CARDS - 1);
32536diff -urNp linux-2.6.39/drivers/media/video/cx231xx/cx231xx-audio.c linux-2.6.39/drivers/media/video/cx231xx/cx231xx-audio.c
32537--- linux-2.6.39/drivers/media/video/cx231xx/cx231xx-audio.c 2011-05-19 00:06:34.000000000 -0400
32538+++ linux-2.6.39/drivers/media/video/cx231xx/cx231xx-audio.c 2011-05-22 19:36:31.000000000 -0400
32539@@ -613,7 +613,7 @@ static struct page *snd_pcm_get_vmalloc_
32540 return vmalloc_to_page(pageptr);
32541 }
32542
32543-static struct snd_pcm_ops snd_cx231xx_pcm_capture = {
32544+static const struct snd_pcm_ops snd_cx231xx_pcm_capture = {
32545 .open = snd_cx231xx_capture_open,
32546 .close = snd_cx231xx_pcm_close,
32547 .ioctl = snd_pcm_lib_ioctl,
32548diff -urNp linux-2.6.39/drivers/media/video/cx231xx/cx231xx-i2c.c linux-2.6.39/drivers/media/video/cx231xx/cx231xx-i2c.c
32549--- linux-2.6.39/drivers/media/video/cx231xx/cx231xx-i2c.c 2011-05-19 00:06:34.000000000 -0400
32550+++ linux-2.6.39/drivers/media/video/cx231xx/cx231xx-i2c.c 2011-05-22 19:36:31.000000000 -0400
32551@@ -435,7 +435,7 @@ static u32 functionality(struct i2c_adap
32552 return I2C_FUNC_SMBUS_EMUL | I2C_FUNC_I2C;
32553 }
32554
32555-static struct i2c_algorithm cx231xx_algo = {
32556+static const struct i2c_algorithm cx231xx_algo = {
32557 .master_xfer = cx231xx_i2c_xfer,
32558 .functionality = functionality,
32559 };
32560diff -urNp linux-2.6.39/drivers/media/video/cx23885/cx23885-input.c linux-2.6.39/drivers/media/video/cx23885/cx23885-input.c
32561--- linux-2.6.39/drivers/media/video/cx23885/cx23885-input.c 2011-05-19 00:06:34.000000000 -0400
32562+++ linux-2.6.39/drivers/media/video/cx23885/cx23885-input.c 2011-05-22 19:36:31.000000000 -0400
32563@@ -53,6 +53,8 @@ static void cx23885_input_process_measur
32564 bool handle = false;
32565 struct ir_raw_event ir_core_event[64];
32566
32567+ pax_track_stack();
32568+
32569 do {
32570 num = 0;
32571 v4l2_subdev_call(dev->sd_ir, ir, rx_read, (u8 *) ir_core_event,
32572diff -urNp linux-2.6.39/drivers/media/video/cx88/cx88-alsa.c linux-2.6.39/drivers/media/video/cx88/cx88-alsa.c
32573--- linux-2.6.39/drivers/media/video/cx88/cx88-alsa.c 2011-05-19 00:06:34.000000000 -0400
32574+++ linux-2.6.39/drivers/media/video/cx88/cx88-alsa.c 2011-05-22 19:36:31.000000000 -0400
32575@@ -519,7 +519,7 @@ static struct page *snd_cx88_page(struct
32576 /*
32577 * operators
32578 */
32579-static struct snd_pcm_ops snd_cx88_pcm_ops = {
32580+static const struct snd_pcm_ops snd_cx88_pcm_ops = {
32581 .open = snd_cx88_pcm_open,
32582 .close = snd_cx88_close,
32583 .ioctl = snd_pcm_lib_ioctl,
32584diff -urNp linux-2.6.39/drivers/media/video/davinci/ccdc_hw_device.h linux-2.6.39/drivers/media/video/davinci/ccdc_hw_device.h
32585--- linux-2.6.39/drivers/media/video/davinci/ccdc_hw_device.h 2011-05-19 00:06:34.000000000 -0400
32586+++ linux-2.6.39/drivers/media/video/davinci/ccdc_hw_device.h 2011-05-22 19:36:31.000000000 -0400
32587@@ -99,7 +99,7 @@ struct ccdc_hw_device {
32588 /* module owner */
32589 struct module *owner;
32590 /* hw ops */
32591- struct ccdc_hw_ops hw_ops;
32592+ const struct ccdc_hw_ops hw_ops;
32593 };
32594
32595 /* Used by CCDC module to register & unregister with vpfe capture driver */
32596diff -urNp linux-2.6.39/drivers/media/video/davinci/vpss.c linux-2.6.39/drivers/media/video/davinci/vpss.c
32597--- linux-2.6.39/drivers/media/video/davinci/vpss.c 2011-05-19 00:06:34.000000000 -0400
32598+++ linux-2.6.39/drivers/media/video/davinci/vpss.c 2011-05-22 19:36:31.000000000 -0400
32599@@ -103,7 +103,7 @@ struct vpss_oper_config {
32600 __iomem void *vpss_regs_base1;
32601 enum vpss_platform_type platform;
32602 spinlock_t vpss_lock;
32603- struct vpss_hw_ops hw_ops;
32604+ const struct vpss_hw_ops hw_ops;
32605 };
32606
32607 static struct vpss_oper_config oper_cfg;
32608diff -urNp linux-2.6.39/drivers/media/video/em28xx/em28xx-audio.c linux-2.6.39/drivers/media/video/em28xx/em28xx-audio.c
32609--- linux-2.6.39/drivers/media/video/em28xx/em28xx-audio.c 2011-05-19 00:06:34.000000000 -0400
32610+++ linux-2.6.39/drivers/media/video/em28xx/em28xx-audio.c 2011-05-22 19:36:31.000000000 -0400
32611@@ -432,7 +432,7 @@ static struct page *snd_pcm_get_vmalloc_
32612 return vmalloc_to_page(pageptr);
32613 }
32614
32615-static struct snd_pcm_ops snd_em28xx_pcm_capture = {
32616+static const struct snd_pcm_ops snd_em28xx_pcm_capture = {
32617 .open = snd_em28xx_capture_open,
32618 .close = snd_em28xx_pcm_close,
32619 .ioctl = snd_pcm_lib_ioctl,
32620diff -urNp linux-2.6.39/drivers/media/video/em28xx/em28xx-i2c.c linux-2.6.39/drivers/media/video/em28xx/em28xx-i2c.c
32621--- linux-2.6.39/drivers/media/video/em28xx/em28xx-i2c.c 2011-05-19 00:06:34.000000000 -0400
32622+++ linux-2.6.39/drivers/media/video/em28xx/em28xx-i2c.c 2011-05-22 19:36:31.000000000 -0400
32623@@ -451,7 +451,7 @@ static u32 functionality(struct i2c_adap
32624 return I2C_FUNC_SMBUS_EMUL;
32625 }
32626
32627-static struct i2c_algorithm em28xx_algo = {
32628+static const struct i2c_algorithm em28xx_algo = {
32629 .master_xfer = em28xx_i2c_xfer,
32630 .functionality = functionality,
32631 };
32632diff -urNp linux-2.6.39/drivers/media/video/hdpvr/hdpvr-i2c.c linux-2.6.39/drivers/media/video/hdpvr/hdpvr-i2c.c
32633--- linux-2.6.39/drivers/media/video/hdpvr/hdpvr-i2c.c 2011-05-19 00:06:34.000000000 -0400
32634+++ linux-2.6.39/drivers/media/video/hdpvr/hdpvr-i2c.c 2011-05-22 19:36:31.000000000 -0400
32635@@ -179,7 +179,7 @@ static u32 hdpvr_functionality(struct i2
32636 return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL;
32637 }
32638
32639-static struct i2c_algorithm hdpvr_algo = {
32640+static const struct i2c_algorithm hdpvr_algo = {
32641 .master_xfer = hdpvr_transfer,
32642 .functionality = hdpvr_functionality,
32643 };
32644diff -urNp linux-2.6.39/drivers/media/video/imx074.c linux-2.6.39/drivers/media/video/imx074.c
32645--- linux-2.6.39/drivers/media/video/imx074.c 2011-05-19 00:06:34.000000000 -0400
32646+++ linux-2.6.39/drivers/media/video/imx074.c 2011-05-22 19:36:31.000000000 -0400
32647@@ -267,7 +267,7 @@ static int imx074_g_chip_ident(struct v4
32648 return 0;
32649 }
32650
32651-static struct v4l2_subdev_video_ops imx074_subdev_video_ops = {
32652+static const struct v4l2_subdev_video_ops imx074_subdev_video_ops = {
32653 .s_stream = imx074_s_stream,
32654 .s_mbus_fmt = imx074_s_fmt,
32655 .g_mbus_fmt = imx074_g_fmt,
32656@@ -277,7 +277,7 @@ static struct v4l2_subdev_video_ops imx0
32657 .cropcap = imx074_cropcap,
32658 };
32659
32660-static struct v4l2_subdev_core_ops imx074_subdev_core_ops = {
32661+static const struct v4l2_subdev_core_ops imx074_subdev_core_ops = {
32662 .g_chip_ident = imx074_g_chip_ident,
32663 };
32664
32665diff -urNp linux-2.6.39/drivers/media/video/ivtv/ivtv-driver.c linux-2.6.39/drivers/media/video/ivtv/ivtv-driver.c
32666--- linux-2.6.39/drivers/media/video/ivtv/ivtv-driver.c 2011-05-19 00:06:34.000000000 -0400
32667+++ linux-2.6.39/drivers/media/video/ivtv/ivtv-driver.c 2011-05-22 19:36:31.000000000 -0400
32668@@ -80,7 +80,7 @@ static struct pci_device_id ivtv_pci_tbl
32669 MODULE_DEVICE_TABLE(pci,ivtv_pci_tbl);
32670
32671 /* ivtv instance counter */
32672-static atomic_t ivtv_instance = ATOMIC_INIT(0);
32673+static atomic_unchecked_t ivtv_instance = ATOMIC_INIT(0);
32674
32675 /* Parameter declarations */
32676 static int cardtype[IVTV_MAX_CARDS];
32677diff -urNp linux-2.6.39/drivers/media/video/mt9m001.c linux-2.6.39/drivers/media/video/mt9m001.c
32678--- linux-2.6.39/drivers/media/video/mt9m001.c 2011-05-19 00:06:34.000000000 -0400
32679+++ linux-2.6.39/drivers/media/video/mt9m001.c 2011-05-22 19:36:31.000000000 -0400
32680@@ -691,7 +691,7 @@ static int mt9m001_g_skip_top_lines(stru
32681 return 0;
32682 }
32683
32684-static struct v4l2_subdev_core_ops mt9m001_subdev_core_ops = {
32685+static const struct v4l2_subdev_core_ops mt9m001_subdev_core_ops = {
32686 .g_ctrl = mt9m001_g_ctrl,
32687 .s_ctrl = mt9m001_s_ctrl,
32688 .g_chip_ident = mt9m001_g_chip_ident,
32689@@ -714,7 +714,7 @@ static int mt9m001_enum_fmt(struct v4l2_
32690 return 0;
32691 }
32692
32693-static struct v4l2_subdev_video_ops mt9m001_subdev_video_ops = {
32694+static const struct v4l2_subdev_video_ops mt9m001_subdev_video_ops = {
32695 .s_stream = mt9m001_s_stream,
32696 .s_mbus_fmt = mt9m001_s_fmt,
32697 .g_mbus_fmt = mt9m001_g_fmt,
32698@@ -725,7 +725,7 @@ static struct v4l2_subdev_video_ops mt9m
32699 .enum_mbus_fmt = mt9m001_enum_fmt,
32700 };
32701
32702-static struct v4l2_subdev_sensor_ops mt9m001_subdev_sensor_ops = {
32703+static const struct v4l2_subdev_sensor_ops mt9m001_subdev_sensor_ops = {
32704 .g_skip_top_lines = mt9m001_g_skip_top_lines,
32705 };
32706
32707diff -urNp linux-2.6.39/drivers/media/video/mt9t031.c linux-2.6.39/drivers/media/video/mt9t031.c
32708--- linux-2.6.39/drivers/media/video/mt9t031.c 2011-05-19 00:06:34.000000000 -0400
32709+++ linux-2.6.39/drivers/media/video/mt9t031.c 2011-05-22 19:36:31.000000000 -0400
32710@@ -725,7 +725,7 @@ static int mt9t031_runtime_resume(struct
32711 return 0;
32712 }
32713
32714-static struct dev_pm_ops mt9t031_dev_pm_ops = {
32715+static const struct dev_pm_ops mt9t031_dev_pm_ops = {
32716 .runtime_suspend = mt9t031_runtime_suspend,
32717 .runtime_resume = mt9t031_runtime_resume,
32718 };
32719@@ -788,7 +788,7 @@ static int mt9t031_g_skip_top_lines(stru
32720 return 0;
32721 }
32722
32723-static struct v4l2_subdev_core_ops mt9t031_subdev_core_ops = {
32724+static const struct v4l2_subdev_core_ops mt9t031_subdev_core_ops = {
32725 .g_ctrl = mt9t031_g_ctrl,
32726 .s_ctrl = mt9t031_s_ctrl,
32727 .g_chip_ident = mt9t031_g_chip_ident,
32728@@ -808,7 +808,7 @@ static int mt9t031_enum_fmt(struct v4l2_
32729 return 0;
32730 }
32731
32732-static struct v4l2_subdev_video_ops mt9t031_subdev_video_ops = {
32733+static const struct v4l2_subdev_video_ops mt9t031_subdev_video_ops = {
32734 .s_stream = mt9t031_s_stream,
32735 .s_mbus_fmt = mt9t031_s_fmt,
32736 .g_mbus_fmt = mt9t031_g_fmt,
32737@@ -819,7 +819,7 @@ static struct v4l2_subdev_video_ops mt9t
32738 .enum_mbus_fmt = mt9t031_enum_fmt,
32739 };
32740
32741-static struct v4l2_subdev_sensor_ops mt9t031_subdev_sensor_ops = {
32742+static const struct v4l2_subdev_sensor_ops mt9t031_subdev_sensor_ops = {
32743 .g_skip_top_lines = mt9t031_g_skip_top_lines,
32744 };
32745
32746diff -urNp linux-2.6.39/drivers/media/video/mt9v022.c linux-2.6.39/drivers/media/video/mt9v022.c
32747--- linux-2.6.39/drivers/media/video/mt9v022.c 2011-05-19 00:06:34.000000000 -0400
32748+++ linux-2.6.39/drivers/media/video/mt9v022.c 2011-05-22 19:36:31.000000000 -0400
32749@@ -825,7 +825,7 @@ static int mt9v022_g_skip_top_lines(stru
32750 return 0;
32751 }
32752
32753-static struct v4l2_subdev_core_ops mt9v022_subdev_core_ops = {
32754+static const struct v4l2_subdev_core_ops mt9v022_subdev_core_ops = {
32755 .g_ctrl = mt9v022_g_ctrl,
32756 .s_ctrl = mt9v022_s_ctrl,
32757 .g_chip_ident = mt9v022_g_chip_ident,
32758@@ -848,7 +848,7 @@ static int mt9v022_enum_fmt(struct v4l2_
32759 return 0;
32760 }
32761
32762-static struct v4l2_subdev_video_ops mt9v022_subdev_video_ops = {
32763+static const struct v4l2_subdev_video_ops mt9v022_subdev_video_ops = {
32764 .s_stream = mt9v022_s_stream,
32765 .s_mbus_fmt = mt9v022_s_fmt,
32766 .g_mbus_fmt = mt9v022_g_fmt,
32767@@ -859,7 +859,7 @@ static struct v4l2_subdev_video_ops mt9v
32768 .enum_mbus_fmt = mt9v022_enum_fmt,
32769 };
32770
32771-static struct v4l2_subdev_sensor_ops mt9v022_subdev_sensor_ops = {
32772+static const struct v4l2_subdev_sensor_ops mt9v022_subdev_sensor_ops = {
32773 .g_skip_top_lines = mt9v022_g_skip_top_lines,
32774 };
32775
32776diff -urNp linux-2.6.39/drivers/media/video/mx2_camera.c linux-2.6.39/drivers/media/video/mx2_camera.c
32777--- linux-2.6.39/drivers/media/video/mx2_camera.c 2011-05-19 00:06:34.000000000 -0400
32778+++ linux-2.6.39/drivers/media/video/mx2_camera.c 2011-05-22 19:36:31.000000000 -0400
32779@@ -668,7 +668,7 @@ static void mx2_videobuf_release(struct
32780 free_buffer(vq, buf);
32781 }
32782
32783-static struct videobuf_queue_ops mx2_videobuf_ops = {
32784+static const struct videobuf_queue_ops mx2_videobuf_ops = {
32785 .buf_setup = mx2_videobuf_setup,
32786 .buf_prepare = mx2_videobuf_prepare,
32787 .buf_queue = mx2_videobuf_queue,
32788diff -urNp linux-2.6.39/drivers/media/video/omap24xxcam.c linux-2.6.39/drivers/media/video/omap24xxcam.c
32789--- linux-2.6.39/drivers/media/video/omap24xxcam.c 2011-05-19 00:06:34.000000000 -0400
32790+++ linux-2.6.39/drivers/media/video/omap24xxcam.c 2011-05-22 19:36:31.000000000 -0400
32791@@ -403,7 +403,7 @@ static void omap24xxcam_vbq_complete(str
32792 spin_unlock_irqrestore(&cam->core_enable_disable_lock, flags);
32793
32794 do_gettimeofday(&vb->ts);
32795- vb->field_count = atomic_add_return(2, &fh->field_count);
32796+ vb->field_count = atomic_add_return_unchecked(2, &fh->field_count);
32797 if (csr & csr_error) {
32798 vb->state = VIDEOBUF_ERROR;
32799 if (!atomic_read(&fh->cam->in_reset)) {
32800diff -urNp linux-2.6.39/drivers/media/video/omap24xxcam.h linux-2.6.39/drivers/media/video/omap24xxcam.h
32801--- linux-2.6.39/drivers/media/video/omap24xxcam.h 2011-05-19 00:06:34.000000000 -0400
32802+++ linux-2.6.39/drivers/media/video/omap24xxcam.h 2011-05-22 19:36:31.000000000 -0400
32803@@ -533,7 +533,7 @@ struct omap24xxcam_fh {
32804 spinlock_t vbq_lock; /* spinlock for the videobuf queue */
32805 struct videobuf_queue vbq;
32806 struct v4l2_pix_format pix; /* serialise pix by vbq->lock */
32807- atomic_t field_count; /* field counter for videobuf_buffer */
32808+ atomic_unchecked_t field_count; /* field counter for videobuf_buffer */
32809 /* accessing cam here doesn't need serialisation: it's constant */
32810 struct omap24xxcam_device *cam;
32811 };
32812diff -urNp linux-2.6.39/drivers/media/video/omap3isp/isp.h linux-2.6.39/drivers/media/video/omap3isp/isp.h
32813--- linux-2.6.39/drivers/media/video/omap3isp/isp.h 2011-05-19 00:06:34.000000000 -0400
32814+++ linux-2.6.39/drivers/media/video/omap3isp/isp.h 2011-05-22 19:36:31.000000000 -0400
32815@@ -290,7 +290,7 @@ struct isp_device {
32816
32817 struct iommu *iommu;
32818
32819- struct isp_platform_callback platform_cb;
32820+ const struct isp_platform_callback platform_cb;
32821 };
32822
32823 #define v4l2_dev_to_isp_device(dev) \
32824diff -urNp linux-2.6.39/drivers/media/video/ov2640.c linux-2.6.39/drivers/media/video/ov2640.c
32825--- linux-2.6.39/drivers/media/video/ov2640.c 2011-05-19 00:06:34.000000000 -0400
32826+++ linux-2.6.39/drivers/media/video/ov2640.c 2011-05-22 19:36:31.000000000 -0400
32827@@ -1080,7 +1080,7 @@ static struct soc_camera_ops ov2640_ops
32828 .num_controls = ARRAY_SIZE(ov2640_controls),
32829 };
32830
32831-static struct v4l2_subdev_core_ops ov2640_subdev_core_ops = {
32832+static const struct v4l2_subdev_core_ops ov2640_subdev_core_ops = {
32833 .g_ctrl = ov2640_g_ctrl,
32834 .s_ctrl = ov2640_s_ctrl,
32835 .g_chip_ident = ov2640_g_chip_ident,
32836@@ -1090,7 +1090,7 @@ static struct v4l2_subdev_core_ops ov264
32837 #endif
32838 };
32839
32840-static struct v4l2_subdev_video_ops ov2640_subdev_video_ops = {
32841+static const struct v4l2_subdev_video_ops ov2640_subdev_video_ops = {
32842 .s_stream = ov2640_s_stream,
32843 .g_mbus_fmt = ov2640_g_fmt,
32844 .s_mbus_fmt = ov2640_s_fmt,
32845diff -urNp linux-2.6.39/drivers/media/video/ov772x.c linux-2.6.39/drivers/media/video/ov772x.c
32846--- linux-2.6.39/drivers/media/video/ov772x.c 2011-05-19 00:06:34.000000000 -0400
32847+++ linux-2.6.39/drivers/media/video/ov772x.c 2011-05-22 19:36:31.000000000 -0400
32848@@ -1079,7 +1079,7 @@ static struct soc_camera_ops ov772x_ops
32849 .num_controls = ARRAY_SIZE(ov772x_controls),
32850 };
32851
32852-static struct v4l2_subdev_core_ops ov772x_subdev_core_ops = {
32853+static const struct v4l2_subdev_core_ops ov772x_subdev_core_ops = {
32854 .g_ctrl = ov772x_g_ctrl,
32855 .s_ctrl = ov772x_s_ctrl,
32856 .g_chip_ident = ov772x_g_chip_ident,
32857@@ -1099,7 +1099,7 @@ static int ov772x_enum_fmt(struct v4l2_s
32858 return 0;
32859 }
32860
32861-static struct v4l2_subdev_video_ops ov772x_subdev_video_ops = {
32862+static const struct v4l2_subdev_video_ops ov772x_subdev_video_ops = {
32863 .s_stream = ov772x_s_stream,
32864 .g_mbus_fmt = ov772x_g_fmt,
32865 .s_mbus_fmt = ov772x_s_fmt,
32866diff -urNp linux-2.6.39/drivers/media/video/pvrusb2/pvrusb2-eeprom.c linux-2.6.39/drivers/media/video/pvrusb2/pvrusb2-eeprom.c
32867--- linux-2.6.39/drivers/media/video/pvrusb2/pvrusb2-eeprom.c 2011-05-19 00:06:34.000000000 -0400
32868+++ linux-2.6.39/drivers/media/video/pvrusb2/pvrusb2-eeprom.c 2011-05-22 19:36:31.000000000 -0400
32869@@ -120,6 +120,8 @@ int pvr2_eeprom_analyze(struct pvr2_hdw
32870 u8 *eeprom;
32871 struct tveeprom tvdata;
32872
32873+ pax_track_stack();
32874+
32875 memset(&tvdata,0,sizeof(tvdata));
32876
32877 eeprom = pvr2_eeprom_fetch(hdw);
32878diff -urNp linux-2.6.39/drivers/media/video/pvrusb2/pvrusb2-i2c-core.c linux-2.6.39/drivers/media/video/pvrusb2/pvrusb2-i2c-core.c
32879--- linux-2.6.39/drivers/media/video/pvrusb2/pvrusb2-i2c-core.c 2011-05-19 00:06:34.000000000 -0400
32880+++ linux-2.6.39/drivers/media/video/pvrusb2/pvrusb2-i2c-core.c 2011-05-22 19:36:31.000000000 -0400
32881@@ -527,7 +527,7 @@ static u32 pvr2_i2c_functionality(struct
32882 return I2C_FUNC_SMBUS_EMUL | I2C_FUNC_I2C;
32883 }
32884
32885-static struct i2c_algorithm pvr2_i2c_algo_template = {
32886+static const struct i2c_algorithm pvr2_i2c_algo_template = {
32887 .master_xfer = pvr2_i2c_xfer,
32888 .functionality = pvr2_i2c_functionality,
32889 };
32890diff -urNp linux-2.6.39/drivers/media/video/rj54n1cb0c.c linux-2.6.39/drivers/media/video/rj54n1cb0c.c
32891--- linux-2.6.39/drivers/media/video/rj54n1cb0c.c 2011-05-19 00:06:34.000000000 -0400
32892+++ linux-2.6.39/drivers/media/video/rj54n1cb0c.c 2011-05-22 19:36:31.000000000 -0400
32893@@ -1327,7 +1327,7 @@ static int rj54n1_s_ctrl(struct v4l2_sub
32894 return 0;
32895 }
32896
32897-static struct v4l2_subdev_core_ops rj54n1_subdev_core_ops = {
32898+static const struct v4l2_subdev_core_ops rj54n1_subdev_core_ops = {
32899 .g_ctrl = rj54n1_g_ctrl,
32900 .s_ctrl = rj54n1_s_ctrl,
32901 .g_chip_ident = rj54n1_g_chip_ident,
32902@@ -1337,7 +1337,7 @@ static struct v4l2_subdev_core_ops rj54n
32903 #endif
32904 };
32905
32906-static struct v4l2_subdev_video_ops rj54n1_subdev_video_ops = {
32907+static const struct v4l2_subdev_video_ops rj54n1_subdev_video_ops = {
32908 .s_stream = rj54n1_s_stream,
32909 .s_mbus_fmt = rj54n1_s_fmt,
32910 .g_mbus_fmt = rj54n1_g_fmt,
32911diff -urNp linux-2.6.39/drivers/media/video/s5p-fimc/fimc-capture.c linux-2.6.39/drivers/media/video/s5p-fimc/fimc-capture.c
32912--- linux-2.6.39/drivers/media/video/s5p-fimc/fimc-capture.c 2011-05-19 00:06:34.000000000 -0400
32913+++ linux-2.6.39/drivers/media/video/s5p-fimc/fimc-capture.c 2011-05-22 19:36:31.000000000 -0400
32914@@ -376,7 +376,7 @@ static void fimc_unlock(struct vb2_queue
32915 mutex_unlock(&ctx->fimc_dev->lock);
32916 }
32917
32918-static struct vb2_ops fimc_capture_qops = {
32919+static const struct vb2_ops fimc_capture_qops = {
32920 .queue_setup = queue_setup,
32921 .buf_prepare = buffer_prepare,
32922 .buf_queue = buffer_queue,
32923diff -urNp linux-2.6.39/drivers/media/video/s5p-fimc/fimc-core.c linux-2.6.39/drivers/media/video/s5p-fimc/fimc-core.c
32924--- linux-2.6.39/drivers/media/video/s5p-fimc/fimc-core.c 2011-05-19 00:06:34.000000000 -0400
32925+++ linux-2.6.39/drivers/media/video/s5p-fimc/fimc-core.c 2011-05-22 19:36:31.000000000 -0400
32926@@ -768,7 +768,7 @@ static void fimc_unlock(struct vb2_queue
32927 mutex_unlock(&ctx->fimc_dev->lock);
32928 }
32929
32930-static struct vb2_ops fimc_qops = {
32931+static const struct vb2_ops fimc_qops = {
32932 .queue_setup = fimc_queue_setup,
32933 .buf_prepare = fimc_buf_prepare,
32934 .buf_queue = fimc_buf_queue,
32935diff -urNp linux-2.6.39/drivers/media/video/saa7134/saa6752hs.c linux-2.6.39/drivers/media/video/saa7134/saa6752hs.c
32936--- linux-2.6.39/drivers/media/video/saa7134/saa6752hs.c 2011-05-19 00:06:34.000000000 -0400
32937+++ linux-2.6.39/drivers/media/video/saa7134/saa6752hs.c 2011-05-22 19:36:31.000000000 -0400
32938@@ -682,6 +682,8 @@ static int saa6752hs_init(struct v4l2_su
32939 unsigned char localPAT[256];
32940 unsigned char localPMT[256];
32941
32942+ pax_track_stack();
32943+
32944 /* Set video format - must be done first as it resets other settings */
32945 set_reg8(client, 0x41, h->video_format);
32946
32947diff -urNp linux-2.6.39/drivers/media/video/saa7134/saa7134-alsa.c linux-2.6.39/drivers/media/video/saa7134/saa7134-alsa.c
32948--- linux-2.6.39/drivers/media/video/saa7134/saa7134-alsa.c 2011-05-19 00:06:34.000000000 -0400
32949+++ linux-2.6.39/drivers/media/video/saa7134/saa7134-alsa.c 2011-05-22 19:36:31.000000000 -0400
32950@@ -808,7 +808,7 @@ static struct page *snd_card_saa7134_pag
32951 * ALSA capture callbacks definition
32952 */
32953
32954-static struct snd_pcm_ops snd_card_saa7134_capture_ops = {
32955+static const struct snd_pcm_ops snd_card_saa7134_capture_ops = {
32956 .open = snd_card_saa7134_capture_open,
32957 .close = snd_card_saa7134_capture_close,
32958 .ioctl = snd_pcm_lib_ioctl,
32959diff -urNp linux-2.6.39/drivers/media/video/saa7164/saa7164-cmd.c linux-2.6.39/drivers/media/video/saa7164/saa7164-cmd.c
32960--- linux-2.6.39/drivers/media/video/saa7164/saa7164-cmd.c 2011-05-19 00:06:34.000000000 -0400
32961+++ linux-2.6.39/drivers/media/video/saa7164/saa7164-cmd.c 2011-05-22 19:36:31.000000000 -0400
32962@@ -88,6 +88,8 @@ int saa7164_irq_dequeue(struct saa7164_d
32963 u8 tmp[512];
32964 dprintk(DBGLVL_CMD, "%s()\n", __func__);
32965
32966+ pax_track_stack();
32967+
32968 /* While any outstand message on the bus exists... */
32969 do {
32970
32971@@ -141,6 +143,8 @@ int saa7164_cmd_dequeue(struct saa7164_d
32972 u8 tmp[512];
32973 dprintk(DBGLVL_CMD, "%s()\n", __func__);
32974
32975+ pax_track_stack();
32976+
32977 while (loop) {
32978
32979 struct tmComResInfo tRsp = { 0, 0, 0, 0, 0, 0 };
32980diff -urNp linux-2.6.39/drivers/media/video/sh_mobile_csi2.c linux-2.6.39/drivers/media/video/sh_mobile_csi2.c
32981--- linux-2.6.39/drivers/media/video/sh_mobile_csi2.c 2011-05-19 00:06:34.000000000 -0400
32982+++ linux-2.6.39/drivers/media/video/sh_mobile_csi2.c 2011-05-22 19:36:31.000000000 -0400
32983@@ -127,12 +127,12 @@ static int sh_csi2_s_fmt(struct v4l2_sub
32984 return 0;
32985 }
32986
32987-static struct v4l2_subdev_video_ops sh_csi2_subdev_video_ops = {
32988+static const struct v4l2_subdev_video_ops sh_csi2_subdev_video_ops = {
32989 .s_mbus_fmt = sh_csi2_s_fmt,
32990 .try_mbus_fmt = sh_csi2_try_fmt,
32991 };
32992
32993-static struct v4l2_subdev_core_ops sh_csi2_subdev_core_ops;
32994+static const struct v4l2_subdev_core_ops sh_csi2_subdev_core_ops;
32995
32996 static struct v4l2_subdev_ops sh_csi2_subdev_ops = {
32997 .core = &sh_csi2_subdev_core_ops,
32998diff -urNp linux-2.6.39/drivers/media/video/soc_camera_platform.c linux-2.6.39/drivers/media/video/soc_camera_platform.c
32999--- linux-2.6.39/drivers/media/video/soc_camera_platform.c 2011-05-19 00:06:34.000000000 -0400
33000+++ linux-2.6.39/drivers/media/video/soc_camera_platform.c 2011-05-22 19:36:31.000000000 -0400
33001@@ -70,7 +70,7 @@ static int soc_camera_platform_fill_fmt(
33002 return 0;
33003 }
33004
33005-static struct v4l2_subdev_core_ops platform_subdev_core_ops;
33006+static const struct v4l2_subdev_core_ops platform_subdev_core_ops;
33007
33008 static int soc_camera_platform_enum_fmt(struct v4l2_subdev *sd, unsigned int index,
33009 enum v4l2_mbus_pixelcode *code)
33010@@ -115,7 +115,7 @@ static int soc_camera_platform_cropcap(s
33011 return 0;
33012 }
33013
33014-static struct v4l2_subdev_video_ops platform_subdev_video_ops = {
33015+static const struct v4l2_subdev_video_ops platform_subdev_video_ops = {
33016 .s_stream = soc_camera_platform_s_stream,
33017 .enum_mbus_fmt = soc_camera_platform_enum_fmt,
33018 .cropcap = soc_camera_platform_cropcap,
33019diff -urNp linux-2.6.39/drivers/media/video/tlg2300/pd-alsa.c linux-2.6.39/drivers/media/video/tlg2300/pd-alsa.c
33020--- linux-2.6.39/drivers/media/video/tlg2300/pd-alsa.c 2011-05-19 00:06:34.000000000 -0400
33021+++ linux-2.6.39/drivers/media/video/tlg2300/pd-alsa.c 2011-05-22 19:36:31.000000000 -0400
33022@@ -265,7 +265,7 @@ static struct page *snd_pcm_pd_get_page(
33023 return vmalloc_to_page(pageptr);
33024 }
33025
33026-static struct snd_pcm_ops pcm_capture_ops = {
33027+static const struct snd_pcm_ops pcm_capture_ops = {
33028 .open = snd_pd_capture_open,
33029 .close = snd_pd_pcm_close,
33030 .ioctl = snd_pcm_lib_ioctl,
33031diff -urNp linux-2.6.39/drivers/media/video/tw9910.c linux-2.6.39/drivers/media/video/tw9910.c
33032--- linux-2.6.39/drivers/media/video/tw9910.c 2011-05-19 00:06:34.000000000 -0400
33033+++ linux-2.6.39/drivers/media/video/tw9910.c 2011-05-22 19:36:31.000000000 -0400
33034@@ -894,7 +894,7 @@ static struct soc_camera_ops tw9910_ops
33035 .enum_input = tw9910_enum_input,
33036 };
33037
33038-static struct v4l2_subdev_core_ops tw9910_subdev_core_ops = {
33039+static const struct v4l2_subdev_core_ops tw9910_subdev_core_ops = {
33040 .g_chip_ident = tw9910_g_chip_ident,
33041 .s_std = tw9910_s_std,
33042 #ifdef CONFIG_VIDEO_ADV_DEBUG
33043@@ -913,7 +913,7 @@ static int tw9910_enum_fmt(struct v4l2_s
33044 return 0;
33045 }
33046
33047-static struct v4l2_subdev_video_ops tw9910_subdev_video_ops = {
33048+static const struct v4l2_subdev_video_ops tw9910_subdev_video_ops = {
33049 .s_stream = tw9910_s_stream,
33050 .g_mbus_fmt = tw9910_g_fmt,
33051 .s_mbus_fmt = tw9910_s_fmt,
33052diff -urNp linux-2.6.39/drivers/media/video/usbvision/usbvision-core.c linux-2.6.39/drivers/media/video/usbvision/usbvision-core.c
33053--- linux-2.6.39/drivers/media/video/usbvision/usbvision-core.c 2011-05-19 00:06:34.000000000 -0400
33054+++ linux-2.6.39/drivers/media/video/usbvision/usbvision-core.c 2011-05-22 19:36:31.000000000 -0400
33055@@ -799,6 +799,8 @@ static enum parse_state usbvision_parse_
33056 unsigned char rv, gv, bv;
33057 static unsigned char *Y, *U, *V;
33058
33059+ pax_track_stack();
33060+
33061 frame = usbvision->cur_frame;
33062 image_size = frame->frmwidth * frame->frmheight;
33063 if ((frame->v4l2_format.format == V4L2_PIX_FMT_YUV422P) ||
33064diff -urNp linux-2.6.39/drivers/media/video/usbvision/usbvision-i2c.c linux-2.6.39/drivers/media/video/usbvision/usbvision-i2c.c
33065--- linux-2.6.39/drivers/media/video/usbvision/usbvision-i2c.c 2011-05-19 00:06:34.000000000 -0400
33066+++ linux-2.6.39/drivers/media/video/usbvision/usbvision-i2c.c 2011-05-22 19:36:31.000000000 -0400
33067@@ -189,7 +189,7 @@ static u32 functionality(struct i2c_adap
33068
33069 /* -----exported algorithm data: ------------------------------------- */
33070
33071-static struct i2c_algorithm usbvision_algo = {
33072+static const struct i2c_algorithm usbvision_algo = {
33073 .master_xfer = usbvision_i2c_xfer,
33074 .smbus_xfer = NULL,
33075 .functionality = functionality,
33076diff -urNp linux-2.6.39/drivers/media/video/v4l2-device.c linux-2.6.39/drivers/media/video/v4l2-device.c
33077--- linux-2.6.39/drivers/media/video/v4l2-device.c 2011-05-19 00:06:34.000000000 -0400
33078+++ linux-2.6.39/drivers/media/video/v4l2-device.c 2011-05-22 19:36:31.000000000 -0400
33079@@ -71,9 +71,9 @@ int v4l2_device_put(struct v4l2_device *
33080 EXPORT_SYMBOL_GPL(v4l2_device_put);
33081
33082 int v4l2_device_set_name(struct v4l2_device *v4l2_dev, const char *basename,
33083- atomic_t *instance)
33084+ atomic_unchecked_t *instance)
33085 {
33086- int num = atomic_inc_return(instance) - 1;
33087+ int num = atomic_inc_return_unchecked(instance) - 1;
33088 int len = strlen(basename);
33089
33090 if (basename[len - 1] >= '0' && basename[len - 1] <= '9')
33091diff -urNp linux-2.6.39/drivers/media/video/videobuf-dma-sg.c linux-2.6.39/drivers/media/video/videobuf-dma-sg.c
33092--- linux-2.6.39/drivers/media/video/videobuf-dma-sg.c 2011-05-19 00:06:34.000000000 -0400
33093+++ linux-2.6.39/drivers/media/video/videobuf-dma-sg.c 2011-05-22 19:36:31.000000000 -0400
33094@@ -606,6 +606,8 @@ void *videobuf_sg_alloc(size_t size)
33095 {
33096 struct videobuf_queue q;
33097
33098+ pax_track_stack();
33099+
33100 /* Required to make generic handler to call __videobuf_alloc */
33101 q.int_ops = &sg_ops;
33102
33103diff -urNp linux-2.6.39/drivers/message/fusion/mptbase.c linux-2.6.39/drivers/message/fusion/mptbase.c
33104--- linux-2.6.39/drivers/message/fusion/mptbase.c 2011-05-19 00:06:34.000000000 -0400
33105+++ linux-2.6.39/drivers/message/fusion/mptbase.c 2011-05-22 19:41:37.000000000 -0400
33106@@ -143,7 +143,7 @@ static int MptDriverClass[MPT_MAX_PRO
33107 static MPT_EVHANDLER MptEvHandlers[MPT_MAX_PROTOCOL_DRIVERS];
33108 /* Reset handler lookup table */
33109 static MPT_RESETHANDLER MptResetHandlers[MPT_MAX_PROTOCOL_DRIVERS];
33110-static struct mpt_pci_driver *MptDeviceDriverHandlers[MPT_MAX_PROTOCOL_DRIVERS];
33111+static const struct mpt_pci_driver *MptDeviceDriverHandlers[MPT_MAX_PROTOCOL_DRIVERS];
33112
33113 #ifdef CONFIG_PROC_FS
33114 static struct proc_dir_entry *mpt_proc_root_dir;
33115@@ -772,7 +772,7 @@ mpt_reset_deregister(u8 cb_idx)
33116 * @cb_idx: MPT protocol driver index
33117 */
33118 int
33119-mpt_device_driver_register(struct mpt_pci_driver * dd_cbfunc, u8 cb_idx)
33120+mpt_device_driver_register(const struct mpt_pci_driver * dd_cbfunc, u8 cb_idx)
33121 {
33122 MPT_ADAPTER *ioc;
33123 const struct pci_device_id *id;
33124@@ -801,7 +801,7 @@ mpt_device_driver_register(struct mpt_pc
33125 void
33126 mpt_device_driver_deregister(u8 cb_idx)
33127 {
33128- struct mpt_pci_driver *dd_cbfunc;
33129+ const struct mpt_pci_driver *dd_cbfunc;
33130 MPT_ADAPTER *ioc;
33131
33132 if (!cb_idx || cb_idx >= MPT_MAX_PROTOCOL_DRIVERS)
33133@@ -6683,8 +6683,13 @@ static int mpt_iocinfo_proc_show(struct
33134 seq_printf(m, " MaxChainDepth = 0x%02x frames\n", ioc->facts.MaxChainDepth);
33135 seq_printf(m, " MinBlockSize = 0x%02x bytes\n", 4*ioc->facts.BlockSize);
33136
33137+#ifdef CONFIG_GRKERNSEC_HIDESYM
33138+ seq_printf(m, " RequestFrames @ 0x%p (Dma @ 0x%p)\n", NULL, NULL);
33139+#else
33140 seq_printf(m, " RequestFrames @ 0x%p (Dma @ 0x%p)\n",
33141 (void *)ioc->req_frames, (void *)(ulong)ioc->req_frames_dma);
33142+#endif
33143+
33144 /*
33145 * Rounding UP to nearest 4-kB boundary here...
33146 */
33147diff -urNp linux-2.6.39/drivers/message/fusion/mptbase.h linux-2.6.39/drivers/message/fusion/mptbase.h
33148--- linux-2.6.39/drivers/message/fusion/mptbase.h 2011-05-19 00:06:34.000000000 -0400
33149+++ linux-2.6.39/drivers/message/fusion/mptbase.h 2011-05-22 19:36:31.000000000 -0400
33150@@ -908,7 +908,7 @@ extern int mpt_event_register(u8 cb_idx
33151 extern void mpt_event_deregister(u8 cb_idx);
33152 extern int mpt_reset_register(u8 cb_idx, MPT_RESETHANDLER reset_func);
33153 extern void mpt_reset_deregister(u8 cb_idx);
33154-extern int mpt_device_driver_register(struct mpt_pci_driver * dd_cbfunc, u8 cb_idx);
33155+extern int mpt_device_driver_register(const struct mpt_pci_driver * dd_cbfunc, u8 cb_idx);
33156 extern void mpt_device_driver_deregister(u8 cb_idx);
33157 extern MPT_FRAME_HDR *mpt_get_msg_frame(u8 cb_idx, MPT_ADAPTER *ioc);
33158 extern void mpt_free_msg_frame(MPT_ADAPTER *ioc, MPT_FRAME_HDR *mf);
33159diff -urNp linux-2.6.39/drivers/message/fusion/mptctl.c linux-2.6.39/drivers/message/fusion/mptctl.c
33160--- linux-2.6.39/drivers/message/fusion/mptctl.c 2011-05-19 00:06:34.000000000 -0400
33161+++ linux-2.6.39/drivers/message/fusion/mptctl.c 2011-05-22 19:36:31.000000000 -0400
33162@@ -3000,7 +3000,7 @@ mptctl_remove(struct pci_dev *pdev)
33163 {
33164 }
33165
33166-static struct mpt_pci_driver mptctl_driver = {
33167+static const struct mpt_pci_driver mptctl_driver = {
33168 .probe = mptctl_probe,
33169 .remove = mptctl_remove,
33170 };
33171diff -urNp linux-2.6.39/drivers/message/fusion/mptsas.c linux-2.6.39/drivers/message/fusion/mptsas.c
33172--- linux-2.6.39/drivers/message/fusion/mptsas.c 2011-05-19 00:06:34.000000000 -0400
33173+++ linux-2.6.39/drivers/message/fusion/mptsas.c 2011-05-22 19:36:31.000000000 -0400
33174@@ -439,6 +439,23 @@ mptsas_is_end_device(struct mptsas_devin
33175 return 0;
33176 }
33177
33178+static inline void
33179+mptsas_set_rphy(MPT_ADAPTER *ioc, struct mptsas_phyinfo *phy_info, struct sas_rphy *rphy)
33180+{
33181+ if (phy_info->port_details) {
33182+ phy_info->port_details->rphy = rphy;
33183+ dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "sas_rphy_add: rphy=%p\n",
33184+ ioc->name, rphy));
33185+ }
33186+
33187+ if (rphy) {
33188+ dsaswideprintk(ioc, dev_printk(KERN_DEBUG,
33189+ &rphy->dev, MYIOC_s_FMT "add:", ioc->name));
33190+ dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "rphy=%p release=%p\n",
33191+ ioc->name, rphy, rphy->dev.release));
33192+ }
33193+}
33194+
33195 /* no mutex */
33196 static void
33197 mptsas_port_delete(MPT_ADAPTER *ioc, struct mptsas_portinfo_details * port_details)
33198@@ -477,23 +494,6 @@ mptsas_get_rphy(struct mptsas_phyinfo *p
33199 return NULL;
33200 }
33201
33202-static inline void
33203-mptsas_set_rphy(MPT_ADAPTER *ioc, struct mptsas_phyinfo *phy_info, struct sas_rphy *rphy)
33204-{
33205- if (phy_info->port_details) {
33206- phy_info->port_details->rphy = rphy;
33207- dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "sas_rphy_add: rphy=%p\n",
33208- ioc->name, rphy));
33209- }
33210-
33211- if (rphy) {
33212- dsaswideprintk(ioc, dev_printk(KERN_DEBUG,
33213- &rphy->dev, MYIOC_s_FMT "add:", ioc->name));
33214- dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "rphy=%p release=%p\n",
33215- ioc->name, rphy, rphy->dev.release));
33216- }
33217-}
33218-
33219 static inline struct sas_port *
33220 mptsas_get_port(struct mptsas_phyinfo *phy_info)
33221 {
33222diff -urNp linux-2.6.39/drivers/message/fusion/mptscsih.c linux-2.6.39/drivers/message/fusion/mptscsih.c
33223--- linux-2.6.39/drivers/message/fusion/mptscsih.c 2011-05-19 00:06:34.000000000 -0400
33224+++ linux-2.6.39/drivers/message/fusion/mptscsih.c 2011-05-22 19:36:31.000000000 -0400
33225@@ -1268,15 +1268,16 @@ mptscsih_info(struct Scsi_Host *SChost)
33226
33227 h = shost_priv(SChost);
33228
33229- if (h) {
33230- if (h->info_kbuf == NULL)
33231- if ((h->info_kbuf = kmalloc(0x1000 /* 4Kb */, GFP_KERNEL)) == NULL)
33232- return h->info_kbuf;
33233- h->info_kbuf[0] = '\0';
33234+ if (!h)
33235+ return NULL;
33236
33237- mpt_print_ioc_summary(h->ioc, h->info_kbuf, &size, 0, 0);
33238- h->info_kbuf[size-1] = '\0';
33239- }
33240+ if (h->info_kbuf == NULL)
33241+ if ((h->info_kbuf = kmalloc(0x1000 /* 4Kb */, GFP_KERNEL)) == NULL)
33242+ return h->info_kbuf;
33243+ h->info_kbuf[0] = '\0';
33244+
33245+ mpt_print_ioc_summary(h->ioc, h->info_kbuf, &size, 0, 0);
33246+ h->info_kbuf[size-1] = '\0';
33247
33248 return h->info_kbuf;
33249 }
33250diff -urNp linux-2.6.39/drivers/message/i2o/i2o_config.c linux-2.6.39/drivers/message/i2o/i2o_config.c
33251--- linux-2.6.39/drivers/message/i2o/i2o_config.c 2011-05-19 00:06:34.000000000 -0400
33252+++ linux-2.6.39/drivers/message/i2o/i2o_config.c 2011-05-22 19:36:31.000000000 -0400
33253@@ -781,6 +781,8 @@ static int i2o_cfg_passthru(unsigned lon
33254 struct i2o_message *msg;
33255 unsigned int iop;
33256
33257+ pax_track_stack();
33258+
33259 if (get_user(iop, &cmd->iop) || get_user(user_msg, &cmd->msg))
33260 return -EFAULT;
33261
33262diff -urNp linux-2.6.39/drivers/message/i2o/i2o_proc.c linux-2.6.39/drivers/message/i2o/i2o_proc.c
33263--- linux-2.6.39/drivers/message/i2o/i2o_proc.c 2011-05-19 00:06:34.000000000 -0400
33264+++ linux-2.6.39/drivers/message/i2o/i2o_proc.c 2011-05-22 19:36:31.000000000 -0400
33265@@ -255,13 +255,6 @@ static char *scsi_devices[] = {
33266 "Array Controller Device"
33267 };
33268
33269-static char *chtostr(u8 * chars, int n)
33270-{
33271- char tmp[256];
33272- tmp[0] = 0;
33273- return strncat(tmp, (char *)chars, n);
33274-}
33275-
33276 static int i2o_report_query_status(struct seq_file *seq, int block_status,
33277 char *group)
33278 {
33279@@ -838,8 +831,7 @@ static int i2o_seq_show_ddm_table(struct
33280
33281 seq_printf(seq, "%-#7x", ddm_table.i2o_vendor_id);
33282 seq_printf(seq, "%-#8x", ddm_table.module_id);
33283- seq_printf(seq, "%-29s",
33284- chtostr(ddm_table.module_name_version, 28));
33285+ seq_printf(seq, "%-.28s", ddm_table.module_name_version);
33286 seq_printf(seq, "%9d ", ddm_table.data_size);
33287 seq_printf(seq, "%8d", ddm_table.code_size);
33288
33289@@ -940,8 +932,8 @@ static int i2o_seq_show_drivers_stored(s
33290
33291 seq_printf(seq, "%-#7x", dst->i2o_vendor_id);
33292 seq_printf(seq, "%-#8x", dst->module_id);
33293- seq_printf(seq, "%-29s", chtostr(dst->module_name_version, 28));
33294- seq_printf(seq, "%-9s", chtostr(dst->date, 8));
33295+ seq_printf(seq, "%-.28s", dst->module_name_version);
33296+ seq_printf(seq, "%-.8s", dst->date);
33297 seq_printf(seq, "%8d ", dst->module_size);
33298 seq_printf(seq, "%8d ", dst->mpb_size);
33299 seq_printf(seq, "0x%04x", dst->module_flags);
33300@@ -1272,14 +1264,10 @@ static int i2o_seq_show_dev_identity(str
33301 seq_printf(seq, "Device Class : %s\n", i2o_get_class_name(work16[0]));
33302 seq_printf(seq, "Owner TID : %0#5x\n", work16[2]);
33303 seq_printf(seq, "Parent TID : %0#5x\n", work16[3]);
33304- seq_printf(seq, "Vendor info : %s\n",
33305- chtostr((u8 *) (work32 + 2), 16));
33306- seq_printf(seq, "Product info : %s\n",
33307- chtostr((u8 *) (work32 + 6), 16));
33308- seq_printf(seq, "Description : %s\n",
33309- chtostr((u8 *) (work32 + 10), 16));
33310- seq_printf(seq, "Product rev. : %s\n",
33311- chtostr((u8 *) (work32 + 14), 8));
33312+ seq_printf(seq, "Vendor info : %.16s\n", (u8 *) (work32 + 2));
33313+ seq_printf(seq, "Product info : %.16s\n", (u8 *) (work32 + 6));
33314+ seq_printf(seq, "Description : %.16s\n", (u8 *) (work32 + 10));
33315+ seq_printf(seq, "Product rev. : %.8s\n", (u8 *) (work32 + 14));
33316
33317 seq_printf(seq, "Serial number : ");
33318 print_serial_number(seq, (u8 *) (work32 + 16),
33319@@ -1324,10 +1312,8 @@ static int i2o_seq_show_ddm_identity(str
33320 }
33321
33322 seq_printf(seq, "Registering DDM TID : 0x%03x\n", result.ddm_tid);
33323- seq_printf(seq, "Module name : %s\n",
33324- chtostr(result.module_name, 24));
33325- seq_printf(seq, "Module revision : %s\n",
33326- chtostr(result.module_rev, 8));
33327+ seq_printf(seq, "Module name : %.24s\n", result.module_name);
33328+ seq_printf(seq, "Module revision : %.8s\n", result.module_rev);
33329
33330 seq_printf(seq, "Serial number : ");
33331 print_serial_number(seq, result.serial_number, sizeof(result) - 36);
33332@@ -1358,14 +1344,10 @@ static int i2o_seq_show_uinfo(struct seq
33333 return 0;
33334 }
33335
33336- seq_printf(seq, "Device name : %s\n",
33337- chtostr(result.device_name, 64));
33338- seq_printf(seq, "Service name : %s\n",
33339- chtostr(result.service_name, 64));
33340- seq_printf(seq, "Physical name : %s\n",
33341- chtostr(result.physical_location, 64));
33342- seq_printf(seq, "Instance number : %s\n",
33343- chtostr(result.instance_number, 4));
33344+ seq_printf(seq, "Device name : %.64s\n", result.device_name);
33345+ seq_printf(seq, "Service name : %.64s\n", result.service_name);
33346+ seq_printf(seq, "Physical name : %.64s\n", result.physical_location);
33347+ seq_printf(seq, "Instance number : %.4s\n", result.instance_number);
33348
33349 return 0;
33350 }
33351diff -urNp linux-2.6.39/drivers/message/i2o/iop.c linux-2.6.39/drivers/message/i2o/iop.c
33352--- linux-2.6.39/drivers/message/i2o/iop.c 2011-05-19 00:06:34.000000000 -0400
33353+++ linux-2.6.39/drivers/message/i2o/iop.c 2011-05-22 19:36:31.000000000 -0400
33354@@ -111,10 +111,10 @@ u32 i2o_cntxt_list_add(struct i2o_contro
33355
33356 spin_lock_irqsave(&c->context_list_lock, flags);
33357
33358- if (unlikely(atomic_inc_and_test(&c->context_list_counter)))
33359- atomic_inc(&c->context_list_counter);
33360+ if (unlikely(atomic_inc_and_test_unchecked(&c->context_list_counter)))
33361+ atomic_inc_unchecked(&c->context_list_counter);
33362
33363- entry->context = atomic_read(&c->context_list_counter);
33364+ entry->context = atomic_read_unchecked(&c->context_list_counter);
33365
33366 list_add(&entry->list, &c->context_list);
33367
33368@@ -1077,7 +1077,7 @@ struct i2o_controller *i2o_iop_alloc(voi
33369
33370 #if BITS_PER_LONG == 64
33371 spin_lock_init(&c->context_list_lock);
33372- atomic_set(&c->context_list_counter, 0);
33373+ atomic_set_unchecked(&c->context_list_counter, 0);
33374 INIT_LIST_HEAD(&c->context_list);
33375 #endif
33376
33377diff -urNp linux-2.6.39/drivers/mfd/ab3100-core.c linux-2.6.39/drivers/mfd/ab3100-core.c
33378--- linux-2.6.39/drivers/mfd/ab3100-core.c 2011-05-19 00:06:34.000000000 -0400
33379+++ linux-2.6.39/drivers/mfd/ab3100-core.c 2011-05-22 19:36:31.000000000 -0400
33380@@ -385,7 +385,7 @@ static int ab3100_event_registers_startu
33381 return 0;
33382 }
33383
33384-static struct abx500_ops ab3100_ops = {
33385+static const struct abx500_ops ab3100_ops = {
33386 .get_chip_id = ab3100_get_chip_id,
33387 .set_register = set_register_interruptible,
33388 .get_register = get_register_interruptible,
33389diff -urNp linux-2.6.39/drivers/mfd/ab3550-core.c linux-2.6.39/drivers/mfd/ab3550-core.c
33390--- linux-2.6.39/drivers/mfd/ab3550-core.c 2011-05-19 00:06:34.000000000 -0400
33391+++ linux-2.6.39/drivers/mfd/ab3550-core.c 2011-05-22 19:36:31.000000000 -0400
33392@@ -676,7 +676,7 @@ static int ab3550_startup_irq_enabled(st
33393 return val;
33394 }
33395
33396-static struct abx500_ops ab3550_ops = {
33397+static const struct abx500_ops ab3550_ops = {
33398 .get_chip_id = ab3550_get_chip_id,
33399 .get_register = ab3550_get_register_interruptible,
33400 .set_register = ab3550_set_register_interruptible,
33401diff -urNp linux-2.6.39/drivers/mfd/ab8500-core.c linux-2.6.39/drivers/mfd/ab8500-core.c
33402--- linux-2.6.39/drivers/mfd/ab8500-core.c 2011-05-19 00:06:34.000000000 -0400
33403+++ linux-2.6.39/drivers/mfd/ab8500-core.c 2011-05-22 19:36:31.000000000 -0400
33404@@ -223,7 +223,7 @@ static int ab8500_mask_and_set_register(
33405
33406 }
33407
33408-static struct abx500_ops ab8500_ops = {
33409+static const struct abx500_ops ab8500_ops = {
33410 .get_chip_id = ab8500_get_chip_id,
33411 .get_register = ab8500_get_register,
33412 .set_register = ab8500_set_register,
33413diff -urNp linux-2.6.39/drivers/mfd/abx500-core.c linux-2.6.39/drivers/mfd/abx500-core.c
33414--- linux-2.6.39/drivers/mfd/abx500-core.c 2011-05-19 00:06:34.000000000 -0400
33415+++ linux-2.6.39/drivers/mfd/abx500-core.c 2011-05-22 19:36:31.000000000 -0400
33416@@ -18,7 +18,7 @@ struct abx500_device_entry {
33417 struct device *dev;
33418 };
33419
33420-static void lookup_ops(struct device *dev, struct abx500_ops **ops)
33421+static void lookup_ops(struct device *dev, const struct abx500_ops **ops)
33422 {
33423 struct abx500_device_entry *dev_entry;
33424
33425@@ -31,7 +31,7 @@ static void lookup_ops(struct device *de
33426 }
33427 }
33428
33429-int abx500_register_ops(struct device *dev, struct abx500_ops *ops)
33430+int abx500_register_ops(struct device *dev, const struct abx500_ops *ops)
33431 {
33432 struct abx500_device_entry *dev_entry;
33433
33434@@ -65,7 +65,7 @@ EXPORT_SYMBOL(abx500_remove_ops);
33435 int abx500_set_register_interruptible(struct device *dev, u8 bank, u8 reg,
33436 u8 value)
33437 {
33438- struct abx500_ops *ops;
33439+ const struct abx500_ops *ops;
33440
33441 lookup_ops(dev->parent, &ops);
33442 if ((ops != NULL) && (ops->set_register != NULL))
33443@@ -78,7 +78,7 @@ EXPORT_SYMBOL(abx500_set_register_interr
33444 int abx500_get_register_interruptible(struct device *dev, u8 bank, u8 reg,
33445 u8 *value)
33446 {
33447- struct abx500_ops *ops;
33448+ const struct abx500_ops *ops;
33449
33450 lookup_ops(dev->parent, &ops);
33451 if ((ops != NULL) && (ops->get_register != NULL))
33452@@ -91,7 +91,7 @@ EXPORT_SYMBOL(abx500_get_register_interr
33453 int abx500_get_register_page_interruptible(struct device *dev, u8 bank,
33454 u8 first_reg, u8 *regvals, u8 numregs)
33455 {
33456- struct abx500_ops *ops;
33457+ const struct abx500_ops *ops;
33458
33459 lookup_ops(dev->parent, &ops);
33460 if ((ops != NULL) && (ops->get_register_page != NULL))
33461@@ -105,7 +105,7 @@ EXPORT_SYMBOL(abx500_get_register_page_i
33462 int abx500_mask_and_set_register_interruptible(struct device *dev, u8 bank,
33463 u8 reg, u8 bitmask, u8 bitvalues)
33464 {
33465- struct abx500_ops *ops;
33466+ const struct abx500_ops *ops;
33467
33468 lookup_ops(dev->parent, &ops);
33469 if ((ops != NULL) && (ops->mask_and_set_register != NULL))
33470@@ -118,7 +118,7 @@ EXPORT_SYMBOL(abx500_mask_and_set_regist
33471
33472 int abx500_get_chip_id(struct device *dev)
33473 {
33474- struct abx500_ops *ops;
33475+ const struct abx500_ops *ops;
33476
33477 lookup_ops(dev->parent, &ops);
33478 if ((ops != NULL) && (ops->get_chip_id != NULL))
33479@@ -130,7 +130,7 @@ EXPORT_SYMBOL(abx500_get_chip_id);
33480
33481 int abx500_event_registers_startup_state_get(struct device *dev, u8 *event)
33482 {
33483- struct abx500_ops *ops;
33484+ const struct abx500_ops *ops;
33485
33486 lookup_ops(dev->parent, &ops);
33487 if ((ops != NULL) && (ops->event_registers_startup_state_get != NULL))
33488@@ -142,7 +142,7 @@ EXPORT_SYMBOL(abx500_event_registers_sta
33489
33490 int abx500_startup_irq_enabled(struct device *dev, unsigned int irq)
33491 {
33492- struct abx500_ops *ops;
33493+ const struct abx500_ops *ops;
33494
33495 lookup_ops(dev->parent, &ops);
33496 if ((ops != NULL) && (ops->startup_irq_enabled != NULL))
33497diff -urNp linux-2.6.39/drivers/mfd/janz-cmodio.c linux-2.6.39/drivers/mfd/janz-cmodio.c
33498--- linux-2.6.39/drivers/mfd/janz-cmodio.c 2011-05-19 00:06:34.000000000 -0400
33499+++ linux-2.6.39/drivers/mfd/janz-cmodio.c 2011-05-22 19:36:31.000000000 -0400
33500@@ -13,6 +13,7 @@
33501
33502 #include <linux/kernel.h>
33503 #include <linux/module.h>
33504+#include <linux/slab.h>
33505 #include <linux/init.h>
33506 #include <linux/pci.h>
33507 #include <linux/interrupt.h>
33508diff -urNp linux-2.6.39/drivers/mfd/mcp-sa11x0.c linux-2.6.39/drivers/mfd/mcp-sa11x0.c
33509--- linux-2.6.39/drivers/mfd/mcp-sa11x0.c 2011-05-19 00:06:34.000000000 -0400
33510+++ linux-2.6.39/drivers/mfd/mcp-sa11x0.c 2011-05-22 19:36:31.000000000 -0400
33511@@ -128,7 +128,7 @@ static void mcp_sa11x0_disable(struct mc
33512 /*
33513 * Our methods.
33514 */
33515-static struct mcp_ops mcp_sa11x0 = {
33516+static const struct mcp_ops mcp_sa11x0 = {
33517 .set_telecom_divisor = mcp_sa11x0_set_telecom_divisor,
33518 .set_audio_divisor = mcp_sa11x0_set_audio_divisor,
33519 .reg_write = mcp_sa11x0_write,
33520diff -urNp linux-2.6.39/drivers/mfd/wm8350-i2c.c linux-2.6.39/drivers/mfd/wm8350-i2c.c
33521--- linux-2.6.39/drivers/mfd/wm8350-i2c.c 2011-05-19 00:06:34.000000000 -0400
33522+++ linux-2.6.39/drivers/mfd/wm8350-i2c.c 2011-05-22 19:36:31.000000000 -0400
33523@@ -44,6 +44,8 @@ static int wm8350_i2c_write_device(struc
33524 u8 msg[(WM8350_MAX_REGISTER << 1) + 1];
33525 int ret;
33526
33527+ pax_track_stack();
33528+
33529 if (bytes > ((WM8350_MAX_REGISTER << 1) + 1))
33530 return -EINVAL;
33531
33532diff -urNp linux-2.6.39/drivers/misc/enclosure.c linux-2.6.39/drivers/misc/enclosure.c
33533--- linux-2.6.39/drivers/misc/enclosure.c 2011-05-19 00:06:34.000000000 -0400
33534+++ linux-2.6.39/drivers/misc/enclosure.c 2011-05-22 19:36:31.000000000 -0400
33535@@ -161,7 +161,7 @@ enclosure_register(struct device *dev, c
33536 }
33537 EXPORT_SYMBOL_GPL(enclosure_register);
33538
33539-static struct enclosure_component_callbacks enclosure_null_callbacks;
33540+static const struct enclosure_component_callbacks enclosure_null_callbacks;
33541
33542 /**
33543 * enclosure_unregister - remove an enclosure
33544diff -urNp linux-2.6.39/drivers/misc/kgdbts.c linux-2.6.39/drivers/misc/kgdbts.c
33545--- linux-2.6.39/drivers/misc/kgdbts.c 2011-05-19 00:06:34.000000000 -0400
33546+++ linux-2.6.39/drivers/misc/kgdbts.c 2011-05-22 19:36:31.000000000 -0400
33547@@ -118,7 +118,7 @@
33548 } while (0)
33549 #define MAX_CONFIG_LEN 40
33550
33551-static struct kgdb_io kgdbts_io_ops;
33552+static const struct kgdb_io kgdbts_io_ops;
33553 static char get_buf[BUFMAX];
33554 static int get_buf_cnt;
33555 static char put_buf[BUFMAX];
33556@@ -1103,7 +1103,7 @@ static void kgdbts_post_exp_handler(void
33557 module_put(THIS_MODULE);
33558 }
33559
33560-static struct kgdb_io kgdbts_io_ops = {
33561+static const struct kgdb_io kgdbts_io_ops = {
33562 .name = "kgdbts",
33563 .read_char = kgdbts_get_char,
33564 .write_char = kgdbts_put_char,
33565diff -urNp linux-2.6.39/drivers/misc/lis3lv02d/lis3lv02d.c linux-2.6.39/drivers/misc/lis3lv02d/lis3lv02d.c
33566--- linux-2.6.39/drivers/misc/lis3lv02d/lis3lv02d.c 2011-05-19 00:06:34.000000000 -0400
33567+++ linux-2.6.39/drivers/misc/lis3lv02d/lis3lv02d.c 2011-05-22 19:36:31.000000000 -0400
33568@@ -435,7 +435,7 @@ static irqreturn_t lis302dl_interrupt(in
33569 * the lid is closed. This leads to interrupts as soon as a little move
33570 * is done.
33571 */
33572- atomic_inc(&lis3_dev.count);
33573+ atomic_inc_unchecked(&lis3_dev.count);
33574
33575 wake_up_interruptible(&lis3_dev.misc_wait);
33576 kill_fasync(&lis3_dev.async_queue, SIGIO, POLL_IN);
33577@@ -518,7 +518,7 @@ static int lis3lv02d_misc_open(struct in
33578 if (lis3_dev.pm_dev)
33579 pm_runtime_get_sync(lis3_dev.pm_dev);
33580
33581- atomic_set(&lis3_dev.count, 0);
33582+ atomic_set_unchecked(&lis3_dev.count, 0);
33583 return 0;
33584 }
33585
33586@@ -545,7 +545,7 @@ static ssize_t lis3lv02d_misc_read(struc
33587 add_wait_queue(&lis3_dev.misc_wait, &wait);
33588 while (true) {
33589 set_current_state(TASK_INTERRUPTIBLE);
33590- data = atomic_xchg(&lis3_dev.count, 0);
33591+ data = atomic_xchg_unchecked(&lis3_dev.count, 0);
33592 if (data)
33593 break;
33594
33595@@ -583,7 +583,7 @@ out:
33596 static unsigned int lis3lv02d_misc_poll(struct file *file, poll_table *wait)
33597 {
33598 poll_wait(file, &lis3_dev.misc_wait, wait);
33599- if (atomic_read(&lis3_dev.count))
33600+ if (atomic_read_unchecked(&lis3_dev.count))
33601 return POLLIN | POLLRDNORM;
33602 return 0;
33603 }
33604diff -urNp linux-2.6.39/drivers/misc/lis3lv02d/lis3lv02d.h linux-2.6.39/drivers/misc/lis3lv02d/lis3lv02d.h
33605--- linux-2.6.39/drivers/misc/lis3lv02d/lis3lv02d.h 2011-05-19 00:06:34.000000000 -0400
33606+++ linux-2.6.39/drivers/misc/lis3lv02d/lis3lv02d.h 2011-05-22 19:36:31.000000000 -0400
33607@@ -265,7 +265,7 @@ struct lis3lv02d {
33608 struct input_polled_dev *idev; /* input device */
33609 struct platform_device *pdev; /* platform device */
33610 struct regulator_bulk_data regulators[2];
33611- atomic_t count; /* interrupt count after last read */
33612+ atomic_unchecked_t count; /* interrupt count after last read */
33613 union axis_conversion ac; /* hw -> logical axis */
33614 int mapped_btns[3];
33615
33616diff -urNp linux-2.6.39/drivers/misc/sgi-gru/gruhandles.c linux-2.6.39/drivers/misc/sgi-gru/gruhandles.c
33617--- linux-2.6.39/drivers/misc/sgi-gru/gruhandles.c 2011-05-19 00:06:34.000000000 -0400
33618+++ linux-2.6.39/drivers/misc/sgi-gru/gruhandles.c 2011-05-22 19:36:31.000000000 -0400
33619@@ -44,8 +44,8 @@ static void update_mcs_stats(enum mcs_op
33620 unsigned long nsec;
33621
33622 nsec = CLKS2NSEC(clks);
33623- atomic_long_inc(&mcs_op_statistics[op].count);
33624- atomic_long_add(nsec, &mcs_op_statistics[op].total);
33625+ atomic_long_inc_unchecked(&mcs_op_statistics[op].count);
33626+ atomic_long_add_unchecked(nsec, &mcs_op_statistics[op].total);
33627 if (mcs_op_statistics[op].max < nsec)
33628 mcs_op_statistics[op].max = nsec;
33629 }
33630diff -urNp linux-2.6.39/drivers/misc/sgi-gru/gruprocfs.c linux-2.6.39/drivers/misc/sgi-gru/gruprocfs.c
33631--- linux-2.6.39/drivers/misc/sgi-gru/gruprocfs.c 2011-05-19 00:06:34.000000000 -0400
33632+++ linux-2.6.39/drivers/misc/sgi-gru/gruprocfs.c 2011-05-22 19:36:31.000000000 -0400
33633@@ -32,9 +32,9 @@
33634
33635 #define printstat(s, f) printstat_val(s, &gru_stats.f, #f)
33636
33637-static void printstat_val(struct seq_file *s, atomic_long_t *v, char *id)
33638+static void printstat_val(struct seq_file *s, atomic_long_unchecked_t *v, char *id)
33639 {
33640- unsigned long val = atomic_long_read(v);
33641+ unsigned long val = atomic_long_read_unchecked(v);
33642
33643 seq_printf(s, "%16lu %s\n", val, id);
33644 }
33645@@ -134,8 +134,8 @@ static int mcs_statistics_show(struct se
33646
33647 seq_printf(s, "%-20s%12s%12s%12s\n", "#id", "count", "aver-clks", "max-clks");
33648 for (op = 0; op < mcsop_last; op++) {
33649- count = atomic_long_read(&mcs_op_statistics[op].count);
33650- total = atomic_long_read(&mcs_op_statistics[op].total);
33651+ count = atomic_long_read_unchecked(&mcs_op_statistics[op].count);
33652+ total = atomic_long_read_unchecked(&mcs_op_statistics[op].total);
33653 max = mcs_op_statistics[op].max;
33654 seq_printf(s, "%-20s%12ld%12ld%12ld\n", id[op], count,
33655 count ? total / count : 0, max);
33656diff -urNp linux-2.6.39/drivers/misc/sgi-gru/grutables.h linux-2.6.39/drivers/misc/sgi-gru/grutables.h
33657--- linux-2.6.39/drivers/misc/sgi-gru/grutables.h 2011-05-19 00:06:34.000000000 -0400
33658+++ linux-2.6.39/drivers/misc/sgi-gru/grutables.h 2011-05-22 19:36:31.000000000 -0400
33659@@ -167,82 +167,82 @@ extern unsigned int gru_max_gids;
33660 * GRU statistics.
33661 */
33662 struct gru_stats_s {
33663- atomic_long_t vdata_alloc;
33664- atomic_long_t vdata_free;
33665- atomic_long_t gts_alloc;
33666- atomic_long_t gts_free;
33667- atomic_long_t gms_alloc;
33668- atomic_long_t gms_free;
33669- atomic_long_t gts_double_allocate;
33670- atomic_long_t assign_context;
33671- atomic_long_t assign_context_failed;
33672- atomic_long_t free_context;
33673- atomic_long_t load_user_context;
33674- atomic_long_t load_kernel_context;
33675- atomic_long_t lock_kernel_context;
33676- atomic_long_t unlock_kernel_context;
33677- atomic_long_t steal_user_context;
33678- atomic_long_t steal_kernel_context;
33679- atomic_long_t steal_context_failed;
33680- atomic_long_t nopfn;
33681- atomic_long_t asid_new;
33682- atomic_long_t asid_next;
33683- atomic_long_t asid_wrap;
33684- atomic_long_t asid_reuse;
33685- atomic_long_t intr;
33686- atomic_long_t intr_cbr;
33687- atomic_long_t intr_tfh;
33688- atomic_long_t intr_spurious;
33689- atomic_long_t intr_mm_lock_failed;
33690- atomic_long_t call_os;
33691- atomic_long_t call_os_wait_queue;
33692- atomic_long_t user_flush_tlb;
33693- atomic_long_t user_unload_context;
33694- atomic_long_t user_exception;
33695- atomic_long_t set_context_option;
33696- atomic_long_t check_context_retarget_intr;
33697- atomic_long_t check_context_unload;
33698- atomic_long_t tlb_dropin;
33699- atomic_long_t tlb_preload_page;
33700- atomic_long_t tlb_dropin_fail_no_asid;
33701- atomic_long_t tlb_dropin_fail_upm;
33702- atomic_long_t tlb_dropin_fail_invalid;
33703- atomic_long_t tlb_dropin_fail_range_active;
33704- atomic_long_t tlb_dropin_fail_idle;
33705- atomic_long_t tlb_dropin_fail_fmm;
33706- atomic_long_t tlb_dropin_fail_no_exception;
33707- atomic_long_t tfh_stale_on_fault;
33708- atomic_long_t mmu_invalidate_range;
33709- atomic_long_t mmu_invalidate_page;
33710- atomic_long_t flush_tlb;
33711- atomic_long_t flush_tlb_gru;
33712- atomic_long_t flush_tlb_gru_tgh;
33713- atomic_long_t flush_tlb_gru_zero_asid;
33714-
33715- atomic_long_t copy_gpa;
33716- atomic_long_t read_gpa;
33717-
33718- atomic_long_t mesq_receive;
33719- atomic_long_t mesq_receive_none;
33720- atomic_long_t mesq_send;
33721- atomic_long_t mesq_send_failed;
33722- atomic_long_t mesq_noop;
33723- atomic_long_t mesq_send_unexpected_error;
33724- atomic_long_t mesq_send_lb_overflow;
33725- atomic_long_t mesq_send_qlimit_reached;
33726- atomic_long_t mesq_send_amo_nacked;
33727- atomic_long_t mesq_send_put_nacked;
33728- atomic_long_t mesq_page_overflow;
33729- atomic_long_t mesq_qf_locked;
33730- atomic_long_t mesq_qf_noop_not_full;
33731- atomic_long_t mesq_qf_switch_head_failed;
33732- atomic_long_t mesq_qf_unexpected_error;
33733- atomic_long_t mesq_noop_unexpected_error;
33734- atomic_long_t mesq_noop_lb_overflow;
33735- atomic_long_t mesq_noop_qlimit_reached;
33736- atomic_long_t mesq_noop_amo_nacked;
33737- atomic_long_t mesq_noop_put_nacked;
33738- atomic_long_t mesq_noop_page_overflow;
33739+ atomic_long_unchecked_t vdata_alloc;
33740+ atomic_long_unchecked_t vdata_free;
33741+ atomic_long_unchecked_t gts_alloc;
33742+ atomic_long_unchecked_t gts_free;
33743+ atomic_long_unchecked_t gms_alloc;
33744+ atomic_long_unchecked_t gms_free;
33745+ atomic_long_unchecked_t gts_double_allocate;
33746+ atomic_long_unchecked_t assign_context;
33747+ atomic_long_unchecked_t assign_context_failed;
33748+ atomic_long_unchecked_t free_context;
33749+ atomic_long_unchecked_t load_user_context;
33750+ atomic_long_unchecked_t load_kernel_context;
33751+ atomic_long_unchecked_t lock_kernel_context;
33752+ atomic_long_unchecked_t unlock_kernel_context;
33753+ atomic_long_unchecked_t steal_user_context;
33754+ atomic_long_unchecked_t steal_kernel_context;
33755+ atomic_long_unchecked_t steal_context_failed;
33756+ atomic_long_unchecked_t nopfn;
33757+ atomic_long_unchecked_t asid_new;
33758+ atomic_long_unchecked_t asid_next;
33759+ atomic_long_unchecked_t asid_wrap;
33760+ atomic_long_unchecked_t asid_reuse;
33761+ atomic_long_unchecked_t intr;
33762+ atomic_long_unchecked_t intr_cbr;
33763+ atomic_long_unchecked_t intr_tfh;
33764+ atomic_long_unchecked_t intr_spurious;
33765+ atomic_long_unchecked_t intr_mm_lock_failed;
33766+ atomic_long_unchecked_t call_os;
33767+ atomic_long_unchecked_t call_os_wait_queue;
33768+ atomic_long_unchecked_t user_flush_tlb;
33769+ atomic_long_unchecked_t user_unload_context;
33770+ atomic_long_unchecked_t user_exception;
33771+ atomic_long_unchecked_t set_context_option;
33772+ atomic_long_unchecked_t check_context_retarget_intr;
33773+ atomic_long_unchecked_t check_context_unload;
33774+ atomic_long_unchecked_t tlb_dropin;
33775+ atomic_long_unchecked_t tlb_preload_page;
33776+ atomic_long_unchecked_t tlb_dropin_fail_no_asid;
33777+ atomic_long_unchecked_t tlb_dropin_fail_upm;
33778+ atomic_long_unchecked_t tlb_dropin_fail_invalid;
33779+ atomic_long_unchecked_t tlb_dropin_fail_range_active;
33780+ atomic_long_unchecked_t tlb_dropin_fail_idle;
33781+ atomic_long_unchecked_t tlb_dropin_fail_fmm;
33782+ atomic_long_unchecked_t tlb_dropin_fail_no_exception;
33783+ atomic_long_unchecked_t tfh_stale_on_fault;
33784+ atomic_long_unchecked_t mmu_invalidate_range;
33785+ atomic_long_unchecked_t mmu_invalidate_page;
33786+ atomic_long_unchecked_t flush_tlb;
33787+ atomic_long_unchecked_t flush_tlb_gru;
33788+ atomic_long_unchecked_t flush_tlb_gru_tgh;
33789+ atomic_long_unchecked_t flush_tlb_gru_zero_asid;
33790+
33791+ atomic_long_unchecked_t copy_gpa;
33792+ atomic_long_unchecked_t read_gpa;
33793+
33794+ atomic_long_unchecked_t mesq_receive;
33795+ atomic_long_unchecked_t mesq_receive_none;
33796+ atomic_long_unchecked_t mesq_send;
33797+ atomic_long_unchecked_t mesq_send_failed;
33798+ atomic_long_unchecked_t mesq_noop;
33799+ atomic_long_unchecked_t mesq_send_unexpected_error;
33800+ atomic_long_unchecked_t mesq_send_lb_overflow;
33801+ atomic_long_unchecked_t mesq_send_qlimit_reached;
33802+ atomic_long_unchecked_t mesq_send_amo_nacked;
33803+ atomic_long_unchecked_t mesq_send_put_nacked;
33804+ atomic_long_unchecked_t mesq_page_overflow;
33805+ atomic_long_unchecked_t mesq_qf_locked;
33806+ atomic_long_unchecked_t mesq_qf_noop_not_full;
33807+ atomic_long_unchecked_t mesq_qf_switch_head_failed;
33808+ atomic_long_unchecked_t mesq_qf_unexpected_error;
33809+ atomic_long_unchecked_t mesq_noop_unexpected_error;
33810+ atomic_long_unchecked_t mesq_noop_lb_overflow;
33811+ atomic_long_unchecked_t mesq_noop_qlimit_reached;
33812+ atomic_long_unchecked_t mesq_noop_amo_nacked;
33813+ atomic_long_unchecked_t mesq_noop_put_nacked;
33814+ atomic_long_unchecked_t mesq_noop_page_overflow;
33815
33816 };
33817
33818@@ -251,8 +251,8 @@ enum mcs_op {cchop_allocate, cchop_start
33819 tghop_invalidate, mcsop_last};
33820
33821 struct mcs_op_statistic {
33822- atomic_long_t count;
33823- atomic_long_t total;
33824+ atomic_long_unchecked_t count;
33825+ atomic_long_unchecked_t total;
33826 unsigned long max;
33827 };
33828
33829@@ -275,7 +275,7 @@ extern struct mcs_op_statistic mcs_op_st
33830
33831 #define STAT(id) do { \
33832 if (gru_options & OPT_STATS) \
33833- atomic_long_inc(&gru_stats.id); \
33834+ atomic_long_inc_unchecked(&gru_stats.id); \
33835 } while (0)
33836
33837 #ifdef CONFIG_SGI_GRU_DEBUG
33838diff -urNp linux-2.6.39/drivers/misc/sgi-xp/xpc_sn2.c linux-2.6.39/drivers/misc/sgi-xp/xpc_sn2.c
33839--- linux-2.6.39/drivers/misc/sgi-xp/xpc_sn2.c 2011-05-19 00:06:34.000000000 -0400
33840+++ linux-2.6.39/drivers/misc/sgi-xp/xpc_sn2.c 2011-05-22 19:36:31.000000000 -0400
33841@@ -2351,7 +2351,7 @@ xpc_received_payload_sn2(struct xpc_chan
33842 xpc_acknowledge_msgs_sn2(ch, get, msg->flags);
33843 }
33844
33845-static struct xpc_arch_operations xpc_arch_ops_sn2 = {
33846+static const struct xpc_arch_operations xpc_arch_ops_sn2 = {
33847 .setup_partitions = xpc_setup_partitions_sn2,
33848 .teardown_partitions = xpc_teardown_partitions_sn2,
33849 .process_activate_IRQ_rcvd = xpc_process_activate_IRQ_rcvd_sn2,
33850diff -urNp linux-2.6.39/drivers/misc/sgi-xp/xpc_uv.c linux-2.6.39/drivers/misc/sgi-xp/xpc_uv.c
33851--- linux-2.6.39/drivers/misc/sgi-xp/xpc_uv.c 2011-05-19 00:06:34.000000000 -0400
33852+++ linux-2.6.39/drivers/misc/sgi-xp/xpc_uv.c 2011-05-22 19:36:31.000000000 -0400
33853@@ -1674,7 +1674,7 @@ xpc_received_payload_uv(struct xpc_chann
33854 XPC_DEACTIVATE_PARTITION(&xpc_partitions[ch->partid], ret);
33855 }
33856
33857-static struct xpc_arch_operations xpc_arch_ops_uv = {
33858+static const struct xpc_arch_operations xpc_arch_ops_uv = {
33859 .setup_partitions = xpc_setup_partitions_uv,
33860 .teardown_partitions = xpc_teardown_partitions_uv,
33861 .process_activate_IRQ_rcvd = xpc_process_activate_IRQ_rcvd_uv,
33862diff -urNp linux-2.6.39/drivers/misc/spear13xx_pcie_gadget.c linux-2.6.39/drivers/misc/spear13xx_pcie_gadget.c
33863--- linux-2.6.39/drivers/misc/spear13xx_pcie_gadget.c 2011-05-19 00:06:34.000000000 -0400
33864+++ linux-2.6.39/drivers/misc/spear13xx_pcie_gadget.c 2011-05-22 19:36:31.000000000 -0400
33865@@ -644,7 +644,7 @@ static ssize_t pcie_gadget_target_attr_s
33866 return ret;
33867 }
33868
33869-static struct configfs_item_operations pcie_gadget_target_item_ops = {
33870+static const struct configfs_item_operations pcie_gadget_target_item_ops = {
33871 .show_attribute = pcie_gadget_target_attr_show,
33872 .store_attribute = pcie_gadget_target_attr_store,
33873 };
33874diff -urNp linux-2.6.39/drivers/mmc/host/davinci_mmc.c linux-2.6.39/drivers/mmc/host/davinci_mmc.c
33875--- linux-2.6.39/drivers/mmc/host/davinci_mmc.c 2011-05-19 00:06:34.000000000 -0400
33876+++ linux-2.6.39/drivers/mmc/host/davinci_mmc.c 2011-05-22 19:36:31.000000000 -0400
33877@@ -1133,7 +1133,7 @@ static void mmc_davinci_enable_sdio_irq(
33878 }
33879 }
33880
33881-static struct mmc_host_ops mmc_davinci_ops = {
33882+static const struct mmc_host_ops mmc_davinci_ops = {
33883 .request = mmc_davinci_request,
33884 .set_ios = mmc_davinci_set_ios,
33885 .get_cd = mmc_davinci_get_cd,
33886diff -urNp linux-2.6.39/drivers/mmc/host/dw_mmc.c linux-2.6.39/drivers/mmc/host/dw_mmc.c
33887--- linux-2.6.39/drivers/mmc/host/dw_mmc.c 2011-05-19 00:06:34.000000000 -0400
33888+++ linux-2.6.39/drivers/mmc/host/dw_mmc.c 2011-05-22 19:36:31.000000000 -0400
33889@@ -417,7 +417,7 @@ static int dw_mci_idmac_init(struct dw_m
33890 return 0;
33891 }
33892
33893-static struct dw_mci_dma_ops dw_mci_idmac_ops = {
33894+static const struct dw_mci_dma_ops dw_mci_idmac_ops = {
33895 .init = dw_mci_idmac_init,
33896 .start = dw_mci_idmac_start_dma,
33897 .stop = dw_mci_idmac_stop_dma,
33898diff -urNp linux-2.6.39/drivers/mmc/host/s3cmci.c linux-2.6.39/drivers/mmc/host/s3cmci.c
33899--- linux-2.6.39/drivers/mmc/host/s3cmci.c 2011-05-19 00:06:34.000000000 -0400
33900+++ linux-2.6.39/drivers/mmc/host/s3cmci.c 2011-05-22 19:36:31.000000000 -0400
33901@@ -1349,7 +1349,7 @@ static void s3cmci_enable_sdio_irq(struc
33902 s3cmci_check_sdio_irq(host);
33903 }
33904
33905-static struct mmc_host_ops s3cmci_ops = {
33906+static const struct mmc_host_ops s3cmci_ops = {
33907 .request = s3cmci_request,
33908 .set_ios = s3cmci_set_ios,
33909 .get_ro = s3cmci_get_ro,
33910diff -urNp linux-2.6.39/drivers/mmc/host/sdhci-cns3xxx.c linux-2.6.39/drivers/mmc/host/sdhci-cns3xxx.c
33911--- linux-2.6.39/drivers/mmc/host/sdhci-cns3xxx.c 2011-05-19 00:06:34.000000000 -0400
33912+++ linux-2.6.39/drivers/mmc/host/sdhci-cns3xxx.c 2011-05-22 19:36:31.000000000 -0400
33913@@ -81,7 +81,7 @@ out:
33914 host->clock = clock;
33915 }
33916
33917-static struct sdhci_ops sdhci_cns3xxx_ops = {
33918+static const struct sdhci_ops sdhci_cns3xxx_ops = {
33919 .get_max_clock = sdhci_cns3xxx_get_max_clk,
33920 .set_clock = sdhci_cns3xxx_set_clock,
33921 };
33922diff -urNp linux-2.6.39/drivers/mmc/host/sdhci-dove.c linux-2.6.39/drivers/mmc/host/sdhci-dove.c
33923--- linux-2.6.39/drivers/mmc/host/sdhci-dove.c 2011-05-19 00:06:34.000000000 -0400
33924+++ linux-2.6.39/drivers/mmc/host/sdhci-dove.c 2011-05-22 19:36:31.000000000 -0400
33925@@ -56,7 +56,7 @@ static u32 sdhci_dove_readl(struct sdhci
33926 return ret;
33927 }
33928
33929-static struct sdhci_ops sdhci_dove_ops = {
33930+static const struct sdhci_ops sdhci_dove_ops = {
33931 .read_w = sdhci_dove_readw,
33932 .read_l = sdhci_dove_readl,
33933 };
33934diff -urNp linux-2.6.39/drivers/mmc/host/sdhci-esdhc-imx.c linux-2.6.39/drivers/mmc/host/sdhci-esdhc-imx.c
33935--- linux-2.6.39/drivers/mmc/host/sdhci-esdhc-imx.c 2011-05-19 00:06:34.000000000 -0400
33936+++ linux-2.6.39/drivers/mmc/host/sdhci-esdhc-imx.c 2011-05-22 19:36:31.000000000 -0400
33937@@ -201,7 +201,7 @@ static unsigned int esdhc_pltfm_get_ro(s
33938 return -ENOSYS;
33939 }
33940
33941-static struct sdhci_ops sdhci_esdhc_ops = {
33942+static const struct sdhci_ops sdhci_esdhc_ops = {
33943 .read_l = esdhc_readl_le,
33944 .read_w = esdhc_readw_le,
33945 .write_l = esdhc_writel_le,
33946diff -urNp linux-2.6.39/drivers/mmc/host/sdhci-of.h linux-2.6.39/drivers/mmc/host/sdhci-of.h
33947--- linux-2.6.39/drivers/mmc/host/sdhci-of.h 2011-05-19 00:06:34.000000000 -0400
33948+++ linux-2.6.39/drivers/mmc/host/sdhci-of.h 2011-05-22 19:36:31.000000000 -0400
33949@@ -21,7 +21,7 @@
33950
33951 struct sdhci_of_data {
33952 unsigned int quirks;
33953- struct sdhci_ops ops;
33954+ const struct sdhci_ops ops;
33955 };
33956
33957 struct sdhci_of_host {
33958diff -urNp linux-2.6.39/drivers/mmc/host/sdhci-pci.c linux-2.6.39/drivers/mmc/host/sdhci-pci.c
33959--- linux-2.6.39/drivers/mmc/host/sdhci-pci.c 2011-05-19 00:06:34.000000000 -0400
33960+++ linux-2.6.39/drivers/mmc/host/sdhci-pci.c 2011-05-22 19:36:31.000000000 -0400
33961@@ -786,7 +786,7 @@ static int sdhci_pci_enable_dma(struct s
33962 return 0;
33963 }
33964
33965-static struct sdhci_ops sdhci_pci_ops = {
33966+static const struct sdhci_ops sdhci_pci_ops = {
33967 .enable_dma = sdhci_pci_enable_dma,
33968 };
33969
33970diff -urNp linux-2.6.39/drivers/mmc/host/sdhci-pltfm.c linux-2.6.39/drivers/mmc/host/sdhci-pltfm.c
33971--- linux-2.6.39/drivers/mmc/host/sdhci-pltfm.c 2011-05-19 00:06:34.000000000 -0400
33972+++ linux-2.6.39/drivers/mmc/host/sdhci-pltfm.c 2011-05-22 19:36:31.000000000 -0400
33973@@ -41,7 +41,7 @@
33974 * *
33975 \*****************************************************************************/
33976
33977-static struct sdhci_ops sdhci_pltfm_ops = {
33978+static const struct sdhci_ops sdhci_pltfm_ops = {
33979 };
33980
33981 /*****************************************************************************\
33982diff -urNp linux-2.6.39/drivers/mmc/host/sdhci-pxa.c linux-2.6.39/drivers/mmc/host/sdhci-pxa.c
33983--- linux-2.6.39/drivers/mmc/host/sdhci-pxa.c 2011-05-19 00:06:34.000000000 -0400
33984+++ linux-2.6.39/drivers/mmc/host/sdhci-pxa.c 2011-05-22 19:36:31.000000000 -0400
33985@@ -69,7 +69,7 @@ static void set_clock(struct sdhci_host
33986 }
33987 }
33988
33989-static struct sdhci_ops sdhci_pxa_ops = {
33990+static const struct sdhci_ops sdhci_pxa_ops = {
33991 .set_clock = set_clock,
33992 };
33993
33994diff -urNp linux-2.6.39/drivers/mmc/host/sdhci-s3c.c linux-2.6.39/drivers/mmc/host/sdhci-s3c.c
33995--- linux-2.6.39/drivers/mmc/host/sdhci-s3c.c 2011-05-19 00:06:34.000000000 -0400
33996+++ linux-2.6.39/drivers/mmc/host/sdhci-s3c.c 2011-05-22 19:36:31.000000000 -0400
33997@@ -309,7 +309,7 @@ static int sdhci_s3c_platform_8bit_width
33998 return 0;
33999 }
34000
34001-static struct sdhci_ops sdhci_s3c_ops = {
34002+static const struct sdhci_ops sdhci_s3c_ops = {
34003 .get_max_clock = sdhci_s3c_get_max_clk,
34004 .set_clock = sdhci_s3c_set_clock,
34005 .get_min_clock = sdhci_s3c_get_min_clock,
34006diff -urNp linux-2.6.39/drivers/mmc/host/sdhci-spear.c linux-2.6.39/drivers/mmc/host/sdhci-spear.c
34007--- linux-2.6.39/drivers/mmc/host/sdhci-spear.c 2011-05-19 00:06:34.000000000 -0400
34008+++ linux-2.6.39/drivers/mmc/host/sdhci-spear.c 2011-05-22 19:36:31.000000000 -0400
34009@@ -32,7 +32,7 @@ struct spear_sdhci {
34010 };
34011
34012 /* sdhci ops */
34013-static struct sdhci_ops sdhci_pltfm_ops = {
34014+static const struct sdhci_ops sdhci_pltfm_ops = {
34015 /* Nothing to do for now. */
34016 };
34017
34018diff -urNp linux-2.6.39/drivers/mmc/host/sdhci-tegra.c linux-2.6.39/drivers/mmc/host/sdhci-tegra.c
34019--- linux-2.6.39/drivers/mmc/host/sdhci-tegra.c 2011-05-19 00:06:34.000000000 -0400
34020+++ linux-2.6.39/drivers/mmc/host/sdhci-tegra.c 2011-05-22 19:36:31.000000000 -0400
34021@@ -242,7 +242,7 @@ static void tegra_sdhci_pltfm_exit(struc
34022 clk_put(pltfm_host->clk);
34023 }
34024
34025-static struct sdhci_ops tegra_sdhci_ops = {
34026+static const struct sdhci_ops tegra_sdhci_ops = {
34027 .get_ro = tegra_sdhci_get_ro,
34028 .read_l = tegra_sdhci_readl,
34029 .read_w = tegra_sdhci_readw,
34030diff -urNp linux-2.6.39/drivers/mmc/host/sdricoh_cs.c linux-2.6.39/drivers/mmc/host/sdricoh_cs.c
34031--- linux-2.6.39/drivers/mmc/host/sdricoh_cs.c 2011-05-19 00:06:34.000000000 -0400
34032+++ linux-2.6.39/drivers/mmc/host/sdricoh_cs.c 2011-05-22 19:36:31.000000000 -0400
34033@@ -387,7 +387,7 @@ static int sdricoh_get_ro(struct mmc_hos
34034 return (status & STATUS_CARD_LOCKED);
34035 }
34036
34037-static struct mmc_host_ops sdricoh_ops = {
34038+static const struct mmc_host_ops sdricoh_ops = {
34039 .request = sdricoh_request,
34040 .set_ios = sdricoh_set_ios,
34041 .get_ro = sdricoh_get_ro,
34042diff -urNp linux-2.6.39/drivers/mmc/host/sh_mmcif.c linux-2.6.39/drivers/mmc/host/sh_mmcif.c
34043--- linux-2.6.39/drivers/mmc/host/sh_mmcif.c 2011-05-19 00:06:34.000000000 -0400
34044+++ linux-2.6.39/drivers/mmc/host/sh_mmcif.c 2011-05-22 19:36:31.000000000 -0400
34045@@ -872,7 +872,7 @@ static int sh_mmcif_get_cd(struct mmc_ho
34046 return p->get_cd(host->pd);
34047 }
34048
34049-static struct mmc_host_ops sh_mmcif_ops = {
34050+static const struct mmc_host_ops sh_mmcif_ops = {
34051 .request = sh_mmcif_request,
34052 .set_ios = sh_mmcif_set_ios,
34053 .get_cd = sh_mmcif_get_cd,
34054diff -urNp linux-2.6.39/drivers/mtd/chips/cfi_cmdset_0001.c linux-2.6.39/drivers/mtd/chips/cfi_cmdset_0001.c
34055--- linux-2.6.39/drivers/mtd/chips/cfi_cmdset_0001.c 2011-05-19 00:06:34.000000000 -0400
34056+++ linux-2.6.39/drivers/mtd/chips/cfi_cmdset_0001.c 2011-05-22 19:36:31.000000000 -0400
34057@@ -757,6 +757,8 @@ static int chip_ready (struct map_info *
34058 struct cfi_pri_intelext *cfip = cfi->cmdset_priv;
34059 unsigned long timeo = jiffies + HZ;
34060
34061+ pax_track_stack();
34062+
34063 /* Prevent setting state FL_SYNCING for chip in suspended state. */
34064 if (mode == FL_SYNCING && chip->oldstate != FL_READY)
34065 goto sleep;
34066@@ -1657,6 +1659,8 @@ static int __xipram do_write_buffer(stru
34067 unsigned long initial_adr;
34068 int initial_len = len;
34069
34070+ pax_track_stack();
34071+
34072 wbufsize = cfi_interleave(cfi) << cfi->cfiq->MaxBufWriteSize;
34073 adr += chip->start;
34074 initial_adr = adr;
34075@@ -1875,6 +1879,8 @@ static int __xipram do_erase_oneblock(st
34076 int retries = 3;
34077 int ret;
34078
34079+ pax_track_stack();
34080+
34081 adr += chip->start;
34082
34083 retry:
34084diff -urNp linux-2.6.39/drivers/mtd/chips/cfi_cmdset_0020.c linux-2.6.39/drivers/mtd/chips/cfi_cmdset_0020.c
34085--- linux-2.6.39/drivers/mtd/chips/cfi_cmdset_0020.c 2011-05-19 00:06:34.000000000 -0400
34086+++ linux-2.6.39/drivers/mtd/chips/cfi_cmdset_0020.c 2011-05-22 19:36:31.000000000 -0400
34087@@ -255,6 +255,8 @@ static inline int do_read_onechip(struct
34088 unsigned long cmd_addr;
34089 struct cfi_private *cfi = map->fldrv_priv;
34090
34091+ pax_track_stack();
34092+
34093 adr += chip->start;
34094
34095 /* Ensure cmd read/writes are aligned. */
34096@@ -428,6 +430,8 @@ static inline int do_write_buffer(struct
34097 DECLARE_WAITQUEUE(wait, current);
34098 int wbufsize, z;
34099
34100+ pax_track_stack();
34101+
34102 /* M58LW064A requires bus alignment for buffer wriets -- saw */
34103 if (adr & (map_bankwidth(map)-1))
34104 return -EINVAL;
34105@@ -742,6 +746,8 @@ static inline int do_erase_oneblock(stru
34106 DECLARE_WAITQUEUE(wait, current);
34107 int ret = 0;
34108
34109+ pax_track_stack();
34110+
34111 adr += chip->start;
34112
34113 /* Let's determine this according to the interleave only once */
34114@@ -1047,6 +1053,8 @@ static inline int do_lock_oneblock(struc
34115 unsigned long timeo = jiffies + HZ;
34116 DECLARE_WAITQUEUE(wait, current);
34117
34118+ pax_track_stack();
34119+
34120 adr += chip->start;
34121
34122 /* Let's determine this according to the interleave only once */
34123@@ -1196,6 +1204,8 @@ static inline int do_unlock_oneblock(str
34124 unsigned long timeo = jiffies + HZ;
34125 DECLARE_WAITQUEUE(wait, current);
34126
34127+ pax_track_stack();
34128+
34129 adr += chip->start;
34130
34131 /* Let's determine this according to the interleave only once */
34132diff -urNp linux-2.6.39/drivers/mtd/devices/doc2000.c linux-2.6.39/drivers/mtd/devices/doc2000.c
34133--- linux-2.6.39/drivers/mtd/devices/doc2000.c 2011-05-19 00:06:34.000000000 -0400
34134+++ linux-2.6.39/drivers/mtd/devices/doc2000.c 2011-05-22 19:36:31.000000000 -0400
34135@@ -776,7 +776,7 @@ static int doc_write(struct mtd_info *mt
34136
34137 /* The ECC will not be calculated correctly if less than 512 is written */
34138 /* DBB-
34139- if (len != 0x200 && eccbuf)
34140+ if (len != 0x200)
34141 printk(KERN_WARNING
34142 "ECC needs a full sector write (adr: %lx size %lx)\n",
34143 (long) to, (long) len);
34144diff -urNp linux-2.6.39/drivers/mtd/devices/doc2001.c linux-2.6.39/drivers/mtd/devices/doc2001.c
34145--- linux-2.6.39/drivers/mtd/devices/doc2001.c 2011-05-19 00:06:34.000000000 -0400
34146+++ linux-2.6.39/drivers/mtd/devices/doc2001.c 2011-05-22 19:36:31.000000000 -0400
34147@@ -393,7 +393,7 @@ static int doc_read (struct mtd_info *mt
34148 struct Nand *mychip = &this->chips[from >> (this->chipshift)];
34149
34150 /* Don't allow read past end of device */
34151- if (from >= this->totlen)
34152+ if (from >= this->totlen || !len)
34153 return -EINVAL;
34154
34155 /* Don't allow a single read to cross a 512-byte block boundary */
34156diff -urNp linux-2.6.39/drivers/mtd/ftl.c linux-2.6.39/drivers/mtd/ftl.c
34157--- linux-2.6.39/drivers/mtd/ftl.c 2011-05-19 00:06:34.000000000 -0400
34158+++ linux-2.6.39/drivers/mtd/ftl.c 2011-05-22 19:36:31.000000000 -0400
34159@@ -474,6 +474,8 @@ static int copy_erase_unit(partition_t *
34160 loff_t offset;
34161 uint16_t srcunitswap = cpu_to_le16(srcunit);
34162
34163+ pax_track_stack();
34164+
34165 eun = &part->EUNInfo[srcunit];
34166 xfer = &part->XferInfo[xferunit];
34167 DEBUG(2, "ftl_cs: copying block 0x%x to 0x%x\n",
34168diff -urNp linux-2.6.39/drivers/mtd/inftlcore.c linux-2.6.39/drivers/mtd/inftlcore.c
34169--- linux-2.6.39/drivers/mtd/inftlcore.c 2011-05-19 00:06:34.000000000 -0400
34170+++ linux-2.6.39/drivers/mtd/inftlcore.c 2011-05-22 19:36:31.000000000 -0400
34171@@ -259,6 +259,8 @@ static u16 INFTL_foldchain(struct INFTLr
34172 struct inftl_oob oob;
34173 size_t retlen;
34174
34175+ pax_track_stack();
34176+
34177 DEBUG(MTD_DEBUG_LEVEL3, "INFTL: INFTL_foldchain(inftl=%p,thisVUC=%d,"
34178 "pending=%d)\n", inftl, thisVUC, pendingblock);
34179
34180diff -urNp linux-2.6.39/drivers/mtd/inftlmount.c linux-2.6.39/drivers/mtd/inftlmount.c
34181--- linux-2.6.39/drivers/mtd/inftlmount.c 2011-05-19 00:06:34.000000000 -0400
34182+++ linux-2.6.39/drivers/mtd/inftlmount.c 2011-05-22 19:36:31.000000000 -0400
34183@@ -53,6 +53,8 @@ static int find_boot_record(struct INFTL
34184 struct INFTLPartition *ip;
34185 size_t retlen;
34186
34187+ pax_track_stack();
34188+
34189 DEBUG(MTD_DEBUG_LEVEL3, "INFTL: find_boot_record(inftl=%p)\n", inftl);
34190
34191 /*
34192diff -urNp linux-2.6.39/drivers/mtd/lpddr/qinfo_probe.c linux-2.6.39/drivers/mtd/lpddr/qinfo_probe.c
34193--- linux-2.6.39/drivers/mtd/lpddr/qinfo_probe.c 2011-05-19 00:06:34.000000000 -0400
34194+++ linux-2.6.39/drivers/mtd/lpddr/qinfo_probe.c 2011-05-22 19:36:31.000000000 -0400
34195@@ -106,6 +106,8 @@ static int lpddr_pfow_present(struct map
34196 {
34197 map_word pfow_val[4];
34198
34199+ pax_track_stack();
34200+
34201 /* Check identification string */
34202 pfow_val[0] = map_read(map, map->pfow_base + PFOW_QUERY_STRING_P);
34203 pfow_val[1] = map_read(map, map->pfow_base + PFOW_QUERY_STRING_F);
34204diff -urNp linux-2.6.39/drivers/mtd/mtdchar.c linux-2.6.39/drivers/mtd/mtdchar.c
34205--- linux-2.6.39/drivers/mtd/mtdchar.c 2011-05-19 00:06:34.000000000 -0400
34206+++ linux-2.6.39/drivers/mtd/mtdchar.c 2011-05-22 19:36:31.000000000 -0400
34207@@ -560,6 +560,8 @@ static int mtd_ioctl(struct file *file,
34208 u_long size;
34209 struct mtd_info_user info;
34210
34211+ pax_track_stack();
34212+
34213 DEBUG(MTD_DEBUG_LEVEL0, "MTD_ioctl\n");
34214
34215 size = (cmd & IOCSIZE_MASK) >> IOCSIZE_SHIFT;
34216diff -urNp linux-2.6.39/drivers/mtd/nand/denali.c linux-2.6.39/drivers/mtd/nand/denali.c
34217--- linux-2.6.39/drivers/mtd/nand/denali.c 2011-05-19 00:06:34.000000000 -0400
34218+++ linux-2.6.39/drivers/mtd/nand/denali.c 2011-05-22 19:36:31.000000000 -0400
34219@@ -25,6 +25,7 @@
34220 #include <linux/pci.h>
34221 #include <linux/mtd/mtd.h>
34222 #include <linux/module.h>
34223+#include <linux/slab.h>
34224
34225 #include "denali.h"
34226
34227diff -urNp linux-2.6.39/drivers/mtd/nftlcore.c linux-2.6.39/drivers/mtd/nftlcore.c
34228--- linux-2.6.39/drivers/mtd/nftlcore.c 2011-05-19 00:06:34.000000000 -0400
34229+++ linux-2.6.39/drivers/mtd/nftlcore.c 2011-05-22 19:36:31.000000000 -0400
34230@@ -264,6 +264,8 @@ static u16 NFTL_foldchain (struct NFTLre
34231 int inplace = 1;
34232 size_t retlen;
34233
34234+ pax_track_stack();
34235+
34236 memset(BlockMap, 0xff, sizeof(BlockMap));
34237 memset(BlockFreeFound, 0, sizeof(BlockFreeFound));
34238
34239diff -urNp linux-2.6.39/drivers/mtd/nftlmount.c linux-2.6.39/drivers/mtd/nftlmount.c
34240--- linux-2.6.39/drivers/mtd/nftlmount.c 2011-05-19 00:06:34.000000000 -0400
34241+++ linux-2.6.39/drivers/mtd/nftlmount.c 2011-05-22 19:36:31.000000000 -0400
34242@@ -24,6 +24,7 @@
34243 #include <asm/errno.h>
34244 #include <linux/delay.h>
34245 #include <linux/slab.h>
34246+#include <linux/sched.h>
34247 #include <linux/mtd/mtd.h>
34248 #include <linux/mtd/nand.h>
34249 #include <linux/mtd/nftl.h>
34250@@ -45,6 +46,8 @@ static int find_boot_record(struct NFTLr
34251 struct mtd_info *mtd = nftl->mbd.mtd;
34252 unsigned int i;
34253
34254+ pax_track_stack();
34255+
34256 /* Assume logical EraseSize == physical erasesize for starting the scan.
34257 We'll sort it out later if we find a MediaHeader which says otherwise */
34258 /* Actually, we won't. The new DiskOnChip driver has already scanned
34259diff -urNp linux-2.6.39/drivers/mtd/ubi/build.c linux-2.6.39/drivers/mtd/ubi/build.c
34260--- linux-2.6.39/drivers/mtd/ubi/build.c 2011-05-19 00:06:34.000000000 -0400
34261+++ linux-2.6.39/drivers/mtd/ubi/build.c 2011-05-22 19:36:31.000000000 -0400
34262@@ -1287,7 +1287,7 @@ module_exit(ubi_exit);
34263 static int __init bytes_str_to_int(const char *str)
34264 {
34265 char *endp;
34266- unsigned long result;
34267+ unsigned long result, scale = 1;
34268
34269 result = simple_strtoul(str, &endp, 0);
34270 if (str == endp || result >= INT_MAX) {
34271@@ -1298,11 +1298,11 @@ static int __init bytes_str_to_int(const
34272
34273 switch (*endp) {
34274 case 'G':
34275- result *= 1024;
34276+ scale *= 1024;
34277 case 'M':
34278- result *= 1024;
34279+ scale *= 1024;
34280 case 'K':
34281- result *= 1024;
34282+ scale *= 1024;
34283 if (endp[1] == 'i' && endp[2] == 'B')
34284 endp += 2;
34285 case '\0':
34286@@ -1313,7 +1313,13 @@ static int __init bytes_str_to_int(const
34287 return -EINVAL;
34288 }
34289
34290- return result;
34291+ if ((intoverflow_t)result*scale >= INT_MAX) {
34292+ printk(KERN_ERR "UBI error: incorrect bytes count: \"%s\"\n",
34293+ str);
34294+ return -EINVAL;
34295+ }
34296+
34297+ return result*scale;
34298 }
34299
34300 /**
34301diff -urNp linux-2.6.39/drivers/net/bcm63xx_enet.c linux-2.6.39/drivers/net/bcm63xx_enet.c
34302--- linux-2.6.39/drivers/net/bcm63xx_enet.c 2011-05-19 00:06:34.000000000 -0400
34303+++ linux-2.6.39/drivers/net/bcm63xx_enet.c 2011-05-22 19:36:31.000000000 -0400
34304@@ -1469,7 +1469,7 @@ static int bcm_enet_set_pauseparam(struc
34305 return 0;
34306 }
34307
34308-static struct ethtool_ops bcm_enet_ethtool_ops = {
34309+static const struct ethtool_ops bcm_enet_ethtool_ops = {
34310 .get_strings = bcm_enet_get_strings,
34311 .get_sset_count = bcm_enet_get_sset_count,
34312 .get_ethtool_stats = bcm_enet_get_ethtool_stats,
34313diff -urNp linux-2.6.39/drivers/net/bna/bnad_ethtool.c linux-2.6.39/drivers/net/bna/bnad_ethtool.c
34314--- linux-2.6.39/drivers/net/bna/bnad_ethtool.c 2011-05-19 00:06:34.000000000 -0400
34315+++ linux-2.6.39/drivers/net/bna/bnad_ethtool.c 2011-05-22 19:36:31.000000000 -0400
34316@@ -1242,7 +1242,7 @@ bnad_get_sset_count(struct net_device *n
34317 }
34318 }
34319
34320-static struct ethtool_ops bnad_ethtool_ops = {
34321+static const struct ethtool_ops bnad_ethtool_ops = {
34322 .get_settings = bnad_get_settings,
34323 .set_settings = bnad_set_settings,
34324 .get_drvinfo = bnad_get_drvinfo,
34325diff -urNp linux-2.6.39/drivers/net/bnx2.c linux-2.6.39/drivers/net/bnx2.c
34326--- linux-2.6.39/drivers/net/bnx2.c 2011-05-19 00:06:34.000000000 -0400
34327+++ linux-2.6.39/drivers/net/bnx2.c 2011-05-22 19:36:31.000000000 -0400
34328@@ -5828,6 +5828,8 @@ bnx2_test_nvram(struct bnx2 *bp)
34329 int rc = 0;
34330 u32 magic, csum;
34331
34332+ pax_track_stack();
34333+
34334 if ((rc = bnx2_nvram_read(bp, 0, data, 4)) != 0)
34335 goto test_nvram_done;
34336
34337diff -urNp linux-2.6.39/drivers/net/bnx2x/bnx2x_ethtool.c linux-2.6.39/drivers/net/bnx2x/bnx2x_ethtool.c
34338--- linux-2.6.39/drivers/net/bnx2x/bnx2x_ethtool.c 2011-05-19 00:06:34.000000000 -0400
34339+++ linux-2.6.39/drivers/net/bnx2x/bnx2x_ethtool.c 2011-05-22 19:36:31.000000000 -0400
34340@@ -1788,6 +1788,8 @@ static int bnx2x_test_nvram(struct bnx2x
34341 int i, rc;
34342 u32 magic, crc;
34343
34344+ pax_track_stack();
34345+
34346 if (BP_NOMCP(bp))
34347 return 0;
34348
34349diff -urNp linux-2.6.39/drivers/net/chelsio/pm3393.c linux-2.6.39/drivers/net/chelsio/pm3393.c
34350--- linux-2.6.39/drivers/net/chelsio/pm3393.c 2011-05-19 00:06:34.000000000 -0400
34351+++ linux-2.6.39/drivers/net/chelsio/pm3393.c 2011-05-22 19:36:31.000000000 -0400
34352@@ -571,7 +571,7 @@ static void pm3393_destroy(struct cmac *
34353 kfree(cmac);
34354 }
34355
34356-static struct cmac_ops pm3393_ops = {
34357+static const struct cmac_ops pm3393_ops = {
34358 .destroy = pm3393_destroy,
34359 .reset = pm3393_reset,
34360 .interrupt_enable = pm3393_interrupt_enable,
34361diff -urNp linux-2.6.39/drivers/net/chelsio/vsc7326.c linux-2.6.39/drivers/net/chelsio/vsc7326.c
34362--- linux-2.6.39/drivers/net/chelsio/vsc7326.c 2011-05-19 00:06:34.000000000 -0400
34363+++ linux-2.6.39/drivers/net/chelsio/vsc7326.c 2011-05-22 19:36:31.000000000 -0400
34364@@ -666,7 +666,7 @@ static void mac_destroy(struct cmac *mac
34365 kfree(mac);
34366 }
34367
34368-static struct cmac_ops vsc7326_ops = {
34369+static const struct cmac_ops vsc7326_ops = {
34370 .destroy = mac_destroy,
34371 .reset = mac_reset,
34372 .interrupt_handler = mac_intr_handler,
34373diff -urNp linux-2.6.39/drivers/net/cxgb4/cxgb4_main.c linux-2.6.39/drivers/net/cxgb4/cxgb4_main.c
34374--- linux-2.6.39/drivers/net/cxgb4/cxgb4_main.c 2011-05-19 00:06:34.000000000 -0400
34375+++ linux-2.6.39/drivers/net/cxgb4/cxgb4_main.c 2011-05-22 19:36:31.000000000 -0400
34376@@ -3428,6 +3428,8 @@ static int __devinit enable_msix(struct
34377 unsigned int nchan = adap->params.nports;
34378 struct msix_entry entries[MAX_INGQ + 1];
34379
34380+ pax_track_stack();
34381+
34382 for (i = 0; i < ARRAY_SIZE(entries); ++i)
34383 entries[i].entry = i;
34384
34385diff -urNp linux-2.6.39/drivers/net/cxgb4/t4_hw.c linux-2.6.39/drivers/net/cxgb4/t4_hw.c
34386--- linux-2.6.39/drivers/net/cxgb4/t4_hw.c 2011-05-19 00:06:34.000000000 -0400
34387+++ linux-2.6.39/drivers/net/cxgb4/t4_hw.c 2011-05-22 19:36:31.000000000 -0400
34388@@ -362,6 +362,8 @@ static int get_vpd_params(struct adapter
34389 u8 vpd[VPD_LEN], csum;
34390 unsigned int vpdr_len, kw_offset, id_len;
34391
34392+ pax_track_stack();
34393+
34394 ret = pci_read_vpd(adapter->pdev, VPD_BASE, sizeof(vpd), vpd);
34395 if (ret < 0)
34396 return ret;
34397diff -urNp linux-2.6.39/drivers/net/cxgb4vf/cxgb4vf_main.c linux-2.6.39/drivers/net/cxgb4vf/cxgb4vf_main.c
34398--- linux-2.6.39/drivers/net/cxgb4vf/cxgb4vf_main.c 2011-05-19 00:06:34.000000000 -0400
34399+++ linux-2.6.39/drivers/net/cxgb4vf/cxgb4vf_main.c 2011-05-22 19:36:31.000000000 -0400
34400@@ -1572,7 +1572,7 @@ static int cxgb4vf_set_tso(struct net_de
34401 return 0;
34402 }
34403
34404-static struct ethtool_ops cxgb4vf_ethtool_ops = {
34405+static const struct ethtool_ops cxgb4vf_ethtool_ops = {
34406 .get_settings = cxgb4vf_get_settings,
34407 .get_drvinfo = cxgb4vf_get_drvinfo,
34408 .get_msglevel = cxgb4vf_get_msglevel,
34409diff -urNp linux-2.6.39/drivers/net/e1000e/82571.c linux-2.6.39/drivers/net/e1000e/82571.c
34410--- linux-2.6.39/drivers/net/e1000e/82571.c 2011-05-19 00:06:34.000000000 -0400
34411+++ linux-2.6.39/drivers/net/e1000e/82571.c 2011-05-22 19:36:31.000000000 -0400
34412@@ -239,7 +239,7 @@ static s32 e1000_init_mac_params_82571(s
34413 {
34414 struct e1000_hw *hw = &adapter->hw;
34415 struct e1000_mac_info *mac = &hw->mac;
34416- struct e1000_mac_operations *func = &mac->ops;
34417+ struct e1000_mac_operations *func = &mac->ops; /* cannot be const */
34418 u32 swsm = 0;
34419 u32 swsm2 = 0;
34420 bool force_clear_smbi = false;
34421@@ -1930,7 +1930,7 @@ static void e1000_clear_hw_cntrs_82571(s
34422 er32(ICRXDMTC);
34423 }
34424
34425-static struct e1000_mac_operations e82571_mac_ops = {
34426+static const struct e1000_mac_operations e82571_mac_ops = {
34427 /* .check_mng_mode: mac type dependent */
34428 /* .check_for_link: media type dependent */
34429 .id_led_init = e1000e_id_led_init,
34430@@ -1952,7 +1952,7 @@ static struct e1000_mac_operations e8257
34431 .read_mac_addr = e1000_read_mac_addr_82571,
34432 };
34433
34434-static struct e1000_phy_operations e82_phy_ops_igp = {
34435+static const struct e1000_phy_operations e82_phy_ops_igp = {
34436 .acquire = e1000_get_hw_semaphore_82571,
34437 .check_polarity = e1000_check_polarity_igp,
34438 .check_reset_block = e1000e_check_reset_block_generic,
34439@@ -1970,7 +1970,7 @@ static struct e1000_phy_operations e82_p
34440 .cfg_on_link_up = NULL,
34441 };
34442
34443-static struct e1000_phy_operations e82_phy_ops_m88 = {
34444+static const struct e1000_phy_operations e82_phy_ops_m88 = {
34445 .acquire = e1000_get_hw_semaphore_82571,
34446 .check_polarity = e1000_check_polarity_m88,
34447 .check_reset_block = e1000e_check_reset_block_generic,
34448@@ -1988,7 +1988,7 @@ static struct e1000_phy_operations e82_p
34449 .cfg_on_link_up = NULL,
34450 };
34451
34452-static struct e1000_phy_operations e82_phy_ops_bm = {
34453+static const struct e1000_phy_operations e82_phy_ops_bm = {
34454 .acquire = e1000_get_hw_semaphore_82571,
34455 .check_polarity = e1000_check_polarity_m88,
34456 .check_reset_block = e1000e_check_reset_block_generic,
34457@@ -2006,7 +2006,7 @@ static struct e1000_phy_operations e82_p
34458 .cfg_on_link_up = NULL,
34459 };
34460
34461-static struct e1000_nvm_operations e82571_nvm_ops = {
34462+static const struct e1000_nvm_operations e82571_nvm_ops = {
34463 .acquire = e1000_acquire_nvm_82571,
34464 .read = e1000e_read_nvm_eerd,
34465 .release = e1000_release_nvm_82571,
34466diff -urNp linux-2.6.39/drivers/net/e1000e/e1000.h linux-2.6.39/drivers/net/e1000e/e1000.h
34467--- linux-2.6.39/drivers/net/e1000e/e1000.h 2011-05-19 00:06:34.000000000 -0400
34468+++ linux-2.6.39/drivers/net/e1000e/e1000.h 2011-05-22 19:36:31.000000000 -0400
34469@@ -409,9 +409,9 @@ struct e1000_info {
34470 u32 pba;
34471 u32 max_hw_frame_size;
34472 s32 (*get_variants)(struct e1000_adapter *);
34473- struct e1000_mac_operations *mac_ops;
34474- struct e1000_phy_operations *phy_ops;
34475- struct e1000_nvm_operations *nvm_ops;
34476+ const struct e1000_mac_operations *mac_ops;
34477+ const struct e1000_phy_operations *phy_ops;
34478+ const struct e1000_nvm_operations *nvm_ops;
34479 };
34480
34481 /* hardware capability, feature, and workaround flags */
34482diff -urNp linux-2.6.39/drivers/net/e1000e/es2lan.c linux-2.6.39/drivers/net/e1000e/es2lan.c
34483--- linux-2.6.39/drivers/net/e1000e/es2lan.c 2011-05-19 00:06:34.000000000 -0400
34484+++ linux-2.6.39/drivers/net/e1000e/es2lan.c 2011-05-22 19:36:31.000000000 -0400
34485@@ -205,7 +205,7 @@ static s32 e1000_init_mac_params_80003es
34486 {
34487 struct e1000_hw *hw = &adapter->hw;
34488 struct e1000_mac_info *mac = &hw->mac;
34489- struct e1000_mac_operations *func = &mac->ops;
34490+ struct e1000_mac_operations *func = &mac->ops; /* cannot be const */
34491
34492 /* Set media type */
34493 switch (adapter->pdev->device) {
34494@@ -1431,7 +1431,7 @@ static void e1000_clear_hw_cntrs_80003es
34495 er32(ICRXDMTC);
34496 }
34497
34498-static struct e1000_mac_operations es2_mac_ops = {
34499+static const struct e1000_mac_operations es2_mac_ops = {
34500 .read_mac_addr = e1000_read_mac_addr_80003es2lan,
34501 .id_led_init = e1000e_id_led_init,
34502 .check_mng_mode = e1000e_check_mng_mode_generic,
34503@@ -1453,7 +1453,7 @@ static struct e1000_mac_operations es2_m
34504 .setup_led = e1000e_setup_led_generic,
34505 };
34506
34507-static struct e1000_phy_operations es2_phy_ops = {
34508+static const struct e1000_phy_operations es2_phy_ops = {
34509 .acquire = e1000_acquire_phy_80003es2lan,
34510 .check_polarity = e1000_check_polarity_m88,
34511 .check_reset_block = e1000e_check_reset_block_generic,
34512@@ -1471,7 +1471,7 @@ static struct e1000_phy_operations es2_p
34513 .cfg_on_link_up = e1000_cfg_on_link_up_80003es2lan,
34514 };
34515
34516-static struct e1000_nvm_operations es2_nvm_ops = {
34517+static const struct e1000_nvm_operations es2_nvm_ops = {
34518 .acquire = e1000_acquire_nvm_80003es2lan,
34519 .read = e1000e_read_nvm_eerd,
34520 .release = e1000_release_nvm_80003es2lan,
34521diff -urNp linux-2.6.39/drivers/net/e1000e/hw.h linux-2.6.39/drivers/net/e1000e/hw.h
34522--- linux-2.6.39/drivers/net/e1000e/hw.h 2011-05-19 00:06:34.000000000 -0400
34523+++ linux-2.6.39/drivers/net/e1000e/hw.h 2011-05-22 19:36:31.000000000 -0400
34524@@ -811,6 +811,7 @@ struct e1000_nvm_operations {
34525 };
34526
34527 struct e1000_mac_info {
34528+ /* cannot be const see e1000_init_mac_params_ich8lan */
34529 struct e1000_mac_operations ops;
34530 u8 addr[ETH_ALEN];
34531 u8 perm_addr[ETH_ALEN];
34532@@ -852,6 +853,7 @@ struct e1000_mac_info {
34533 };
34534
34535 struct e1000_phy_info {
34536+ /* Cannot be const see e1000_init_phy_params_82571() */
34537 struct e1000_phy_operations ops;
34538
34539 enum e1000_phy_type type;
34540@@ -886,6 +888,7 @@ struct e1000_phy_info {
34541 };
34542
34543 struct e1000_nvm_info {
34544+ /* cannot be const */
34545 struct e1000_nvm_operations ops;
34546
34547 enum e1000_nvm_type type;
34548diff -urNp linux-2.6.39/drivers/net/e1000e/ich8lan.c linux-2.6.39/drivers/net/e1000e/ich8lan.c
34549--- linux-2.6.39/drivers/net/e1000e/ich8lan.c 2011-05-19 00:06:34.000000000 -0400
34550+++ linux-2.6.39/drivers/net/e1000e/ich8lan.c 2011-05-22 19:36:31.000000000 -0400
34551@@ -3866,7 +3866,7 @@ static void e1000_clear_hw_cntrs_ich8lan
34552 }
34553 }
34554
34555-static struct e1000_mac_operations ich8_mac_ops = {
34556+static const struct e1000_mac_operations ich8_mac_ops = {
34557 .id_led_init = e1000e_id_led_init,
34558 /* check_mng_mode dependent on mac type */
34559 .check_for_link = e1000_check_for_copper_link_ich8lan,
34560@@ -3885,7 +3885,7 @@ static struct e1000_mac_operations ich8_
34561 /* id_led_init dependent on mac type */
34562 };
34563
34564-static struct e1000_phy_operations ich8_phy_ops = {
34565+static const struct e1000_phy_operations ich8_phy_ops = {
34566 .acquire = e1000_acquire_swflag_ich8lan,
34567 .check_reset_block = e1000_check_reset_block_ich8lan,
34568 .commit = NULL,
34569@@ -3899,7 +3899,7 @@ static struct e1000_phy_operations ich8_
34570 .write_reg = e1000e_write_phy_reg_igp,
34571 };
34572
34573-static struct e1000_nvm_operations ich8_nvm_ops = {
34574+static const struct e1000_nvm_operations ich8_nvm_ops = {
34575 .acquire = e1000_acquire_nvm_ich8lan,
34576 .read = e1000_read_nvm_ich8lan,
34577 .release = e1000_release_nvm_ich8lan,
34578diff -urNp linux-2.6.39/drivers/net/greth.c linux-2.6.39/drivers/net/greth.c
34579--- linux-2.6.39/drivers/net/greth.c 2011-05-19 00:06:34.000000000 -0400
34580+++ linux-2.6.39/drivers/net/greth.c 2011-05-22 19:36:31.000000000 -0400
34581@@ -1192,7 +1192,7 @@ static const struct ethtool_ops greth_et
34582 .get_link = ethtool_op_get_link,
34583 };
34584
34585-static struct net_device_ops greth_netdev_ops = {
34586+static const struct net_device_ops greth_netdev_ops = {
34587 .ndo_open = greth_open,
34588 .ndo_stop = greth_close,
34589 .ndo_start_xmit = greth_start_xmit,
34590diff -urNp linux-2.6.39/drivers/net/hamradio/6pack.c linux-2.6.39/drivers/net/hamradio/6pack.c
34591--- linux-2.6.39/drivers/net/hamradio/6pack.c 2011-05-19 00:06:34.000000000 -0400
34592+++ linux-2.6.39/drivers/net/hamradio/6pack.c 2011-05-22 19:36:31.000000000 -0400
34593@@ -463,6 +463,8 @@ static void sixpack_receive_buf(struct t
34594 unsigned char buf[512];
34595 int count1;
34596
34597+ pax_track_stack();
34598+
34599 if (!count)
34600 return;
34601
34602diff -urNp linux-2.6.39/drivers/net/ibm_newemac/phy.c linux-2.6.39/drivers/net/ibm_newemac/phy.c
34603--- linux-2.6.39/drivers/net/ibm_newemac/phy.c 2011-05-19 00:06:34.000000000 -0400
34604+++ linux-2.6.39/drivers/net/ibm_newemac/phy.c 2011-05-22 19:36:31.000000000 -0400
34605@@ -273,7 +273,7 @@ static int genmii_read_link(struct mii_p
34606 }
34607
34608 /* Generic implementation for most 10/100/1000 PHYs */
34609-static struct mii_phy_ops generic_phy_ops = {
34610+static const struct mii_phy_ops generic_phy_ops = {
34611 .setup_aneg = genmii_setup_aneg,
34612 .setup_forced = genmii_setup_forced,
34613 .poll_link = genmii_poll_link,
34614@@ -337,7 +337,7 @@ static int cis8201_init(struct mii_phy *
34615 return 0;
34616 }
34617
34618-static struct mii_phy_ops cis8201_phy_ops = {
34619+static const struct mii_phy_ops cis8201_phy_ops = {
34620 .init = cis8201_init,
34621 .setup_aneg = genmii_setup_aneg,
34622 .setup_forced = genmii_setup_forced,
34623@@ -417,7 +417,7 @@ static int et1011c_init(struct mii_phy *
34624 return 0;
34625 }
34626
34627-static struct mii_phy_ops et1011c_phy_ops = {
34628+static const struct mii_phy_ops et1011c_phy_ops = {
34629 .init = et1011c_init,
34630 .setup_aneg = genmii_setup_aneg,
34631 .setup_forced = genmii_setup_forced,
34632@@ -436,7 +436,7 @@ static struct mii_phy_def et1011c_phy_de
34633
34634
34635
34636-static struct mii_phy_ops m88e1111_phy_ops = {
34637+static const struct mii_phy_ops m88e1111_phy_ops = {
34638 .init = m88e1111_init,
34639 .setup_aneg = genmii_setup_aneg,
34640 .setup_forced = genmii_setup_forced,
34641@@ -452,7 +452,7 @@ static struct mii_phy_def m88e1111_phy_d
34642 .ops = &m88e1111_phy_ops,
34643 };
34644
34645-static struct mii_phy_ops m88e1112_phy_ops = {
34646+static const struct mii_phy_ops m88e1112_phy_ops = {
34647 .init = m88e1112_init,
34648 .setup_aneg = genmii_setup_aneg,
34649 .setup_forced = genmii_setup_forced,
34650diff -urNp linux-2.6.39/drivers/net/ibmveth.c linux-2.6.39/drivers/net/ibmveth.c
34651--- linux-2.6.39/drivers/net/ibmveth.c 2011-05-19 00:06:34.000000000 -0400
34652+++ linux-2.6.39/drivers/net/ibmveth.c 2011-05-22 19:36:31.000000000 -0400
34653@@ -1625,7 +1625,7 @@ static struct vio_device_id ibmveth_devi
34654 };
34655 MODULE_DEVICE_TABLE(vio, ibmveth_device_table);
34656
34657-static struct dev_pm_ops ibmveth_pm_ops = {
34658+static const struct dev_pm_ops ibmveth_pm_ops = {
34659 .resume = ibmveth_resume
34660 };
34661
34662diff -urNp linux-2.6.39/drivers/net/igb/e1000_82575.c linux-2.6.39/drivers/net/igb/e1000_82575.c
34663--- linux-2.6.39/drivers/net/igb/e1000_82575.c 2011-05-19 00:06:34.000000000 -0400
34664+++ linux-2.6.39/drivers/net/igb/e1000_82575.c 2011-05-22 19:36:31.000000000 -0400
34665@@ -2029,7 +2029,7 @@ out:
34666 return ret_val;
34667 }
34668
34669-static struct e1000_mac_operations e1000_mac_ops_82575 = {
34670+static const struct e1000_mac_operations e1000_mac_ops_82575 = {
34671 .init_hw = igb_init_hw_82575,
34672 .check_for_link = igb_check_for_link_82575,
34673 .rar_set = igb_rar_set,
34674@@ -2037,13 +2037,13 @@ static struct e1000_mac_operations e1000
34675 .get_speed_and_duplex = igb_get_speed_and_duplex_copper,
34676 };
34677
34678-static struct e1000_phy_operations e1000_phy_ops_82575 = {
34679+static const struct e1000_phy_operations e1000_phy_ops_82575 = {
34680 .acquire = igb_acquire_phy_82575,
34681 .get_cfg_done = igb_get_cfg_done_82575,
34682 .release = igb_release_phy_82575,
34683 };
34684
34685-static struct e1000_nvm_operations e1000_nvm_ops_82575 = {
34686+static const struct e1000_nvm_operations e1000_nvm_ops_82575 = {
34687 .acquire = igb_acquire_nvm_82575,
34688 .read = igb_read_nvm_eerd,
34689 .release = igb_release_nvm_82575,
34690diff -urNp linux-2.6.39/drivers/net/igb/e1000_hw.h linux-2.6.39/drivers/net/igb/e1000_hw.h
34691--- linux-2.6.39/drivers/net/igb/e1000_hw.h 2011-05-19 00:06:34.000000000 -0400
34692+++ linux-2.6.39/drivers/net/igb/e1000_hw.h 2011-05-22 19:36:31.000000000 -0400
34693@@ -342,14 +342,15 @@ struct e1000_nvm_operations {
34694
34695 struct e1000_info {
34696 s32 (*get_invariants)(struct e1000_hw *);
34697- struct e1000_mac_operations *mac_ops;
34698- struct e1000_phy_operations *phy_ops;
34699- struct e1000_nvm_operations *nvm_ops;
34700+ const struct e1000_mac_operations *mac_ops;
34701+ const struct e1000_phy_operations *phy_ops;
34702+ const struct e1000_nvm_operations *nvm_ops;
34703 };
34704
34705 extern const struct e1000_info e1000_82575_info;
34706
34707 struct e1000_mac_info {
34708+ /* cannot be const see igb_get_invariants_82575() */
34709 struct e1000_mac_operations ops;
34710
34711 u8 addr[6];
34712@@ -388,6 +389,7 @@ struct e1000_mac_info {
34713 };
34714
34715 struct e1000_phy_info {
34716+ /* cannot be const see igb_get_invariants_82575() */
34717 struct e1000_phy_operations ops;
34718
34719 enum e1000_phy_type type;
34720@@ -423,6 +425,7 @@ struct e1000_phy_info {
34721 };
34722
34723 struct e1000_nvm_info {
34724+ /* cannot be const */
34725 struct e1000_nvm_operations ops;
34726 enum e1000_nvm_type type;
34727 enum e1000_nvm_override override;
34728diff -urNp linux-2.6.39/drivers/net/igbvf/vf.h linux-2.6.39/drivers/net/igbvf/vf.h
34729--- linux-2.6.39/drivers/net/igbvf/vf.h 2011-05-19 00:06:34.000000000 -0400
34730+++ linux-2.6.39/drivers/net/igbvf/vf.h 2011-05-22 19:36:31.000000000 -0400
34731@@ -191,6 +191,7 @@ struct e1000_mac_operations {
34732 };
34733
34734 struct e1000_mac_info {
34735+ /* cannot be const see e1000_init_mac_params_vf() */
34736 struct e1000_mac_operations ops;
34737 u8 addr[6];
34738 u8 perm_addr[6];
34739diff -urNp linux-2.6.39/drivers/net/irda/sh_irda.c linux-2.6.39/drivers/net/irda/sh_irda.c
34740--- linux-2.6.39/drivers/net/irda/sh_irda.c 2011-05-19 00:06:34.000000000 -0400
34741+++ linux-2.6.39/drivers/net/irda/sh_irda.c 2011-05-22 19:36:31.000000000 -0400
34742@@ -307,7 +307,7 @@ static int xir_fte(struct sh_irda_self *
34743 return 0;
34744 }
34745
34746-static struct sh_irda_xir_func xir_func = {
34747+static const struct sh_irda_xir_func xir_func = {
34748 .xir_fre = xir_fre,
34749 .xir_trov = xir_trov,
34750 .xir_9 = xir_9,
34751@@ -321,7 +321,7 @@ static struct sh_irda_xir_func xir_func
34752 *
34753 * MIR/FIR are not supported now
34754 *=====================================*/
34755-static struct sh_irda_xir_func mfir_func = {
34756+static const struct sh_irda_xir_func mfir_func = {
34757 .xir_fre = xir_fre,
34758 .xir_trov = xir_trov,
34759 .xir_9 = xir_9,
34760@@ -400,7 +400,7 @@ static int sir_fte(struct sh_irda_self *
34761 return 0;
34762 }
34763
34764-static struct sh_irda_xir_func sir_func = {
34765+static const struct sh_irda_xir_func sir_func = {
34766 .xir_fre = sir_fre,
34767 .xir_trov = sir_trov,
34768 .xir_9 = sir_tot,
34769@@ -411,7 +411,7 @@ static struct sh_irda_xir_func sir_func
34770 static void sh_irda_set_mode(struct sh_irda_self *self, enum sh_irda_mode mode)
34771 {
34772 struct device *dev = &self->ndev->dev;
34773- struct sh_irda_xir_func *func;
34774+ const struct sh_irda_xir_func *func;
34775 const char *name;
34776 u16 data;
34777
34778diff -urNp linux-2.6.39/drivers/net/ixgb/ixgb_main.c linux-2.6.39/drivers/net/ixgb/ixgb_main.c
34779--- linux-2.6.39/drivers/net/ixgb/ixgb_main.c 2011-05-19 00:06:34.000000000 -0400
34780+++ linux-2.6.39/drivers/net/ixgb/ixgb_main.c 2011-05-22 19:36:31.000000000 -0400
34781@@ -1069,6 +1069,8 @@ ixgb_set_multi(struct net_device *netdev
34782 u32 rctl;
34783 int i;
34784
34785+ pax_track_stack();
34786+
34787 /* Check for Promiscuous and All Multicast modes */
34788
34789 rctl = IXGB_READ_REG(hw, RCTL);
34790diff -urNp linux-2.6.39/drivers/net/ixgb/ixgb_param.c linux-2.6.39/drivers/net/ixgb/ixgb_param.c
34791--- linux-2.6.39/drivers/net/ixgb/ixgb_param.c 2011-05-19 00:06:34.000000000 -0400
34792+++ linux-2.6.39/drivers/net/ixgb/ixgb_param.c 2011-05-22 19:36:31.000000000 -0400
34793@@ -261,6 +261,9 @@ void __devinit
34794 ixgb_check_options(struct ixgb_adapter *adapter)
34795 {
34796 int bd = adapter->bd_number;
34797+
34798+ pax_track_stack();
34799+
34800 if (bd >= IXGB_MAX_NIC) {
34801 pr_notice("Warning: no configuration for board #%i\n", bd);
34802 pr_notice("Using defaults for all values\n");
34803diff -urNp linux-2.6.39/drivers/net/ixgbe/ixgbe_82599.c linux-2.6.39/drivers/net/ixgbe/ixgbe_82599.c
34804--- linux-2.6.39/drivers/net/ixgbe/ixgbe_82599.c 2011-05-19 00:06:34.000000000 -0400
34805+++ linux-2.6.39/drivers/net/ixgbe/ixgbe_82599.c 2011-05-22 19:36:31.000000000 -0400
34806@@ -2099,7 +2099,7 @@ static struct ixgbe_phy_operations phy_o
34807 .check_overtemp = &ixgbe_tn_check_overtemp,
34808 };
34809
34810-struct ixgbe_info ixgbe_82599_info = {
34811+const struct ixgbe_info ixgbe_82599_info = {
34812 .mac = ixgbe_mac_82599EB,
34813 .get_invariants = &ixgbe_get_invariants_82599,
34814 .mac_ops = &mac_ops_82599,
34815diff -urNp linux-2.6.39/drivers/net/ixgbe/ixgbe.h linux-2.6.39/drivers/net/ixgbe/ixgbe.h
34816--- linux-2.6.39/drivers/net/ixgbe/ixgbe.h 2011-05-19 00:06:34.000000000 -0400
34817+++ linux-2.6.39/drivers/net/ixgbe/ixgbe.h 2011-05-22 19:36:31.000000000 -0400
34818@@ -493,8 +493,8 @@ enum ixgbe_boards {
34819 };
34820
34821 extern struct ixgbe_info ixgbe_82598_info;
34822-extern struct ixgbe_info ixgbe_82599_info;
34823-extern struct ixgbe_info ixgbe_X540_info;
34824+extern const struct ixgbe_info ixgbe_82599_info;
34825+extern const struct ixgbe_info ixgbe_X540_info;
34826 #ifdef CONFIG_IXGBE_DCB
34827 extern const struct dcbnl_rtnl_ops dcbnl_ops;
34828 extern int ixgbe_copy_dcb_cfg(struct ixgbe_dcb_config *src_dcb_cfg,
34829diff -urNp linux-2.6.39/drivers/net/ixgbe/ixgbe_type.h linux-2.6.39/drivers/net/ixgbe/ixgbe_type.h
34830--- linux-2.6.39/drivers/net/ixgbe/ixgbe_type.h 2011-05-19 00:06:34.000000000 -0400
34831+++ linux-2.6.39/drivers/net/ixgbe/ixgbe_type.h 2011-05-22 19:36:31.000000000 -0400
34832@@ -2572,7 +2572,7 @@ struct ixgbe_phy_operations {
34833 };
34834
34835 struct ixgbe_eeprom_info {
34836- struct ixgbe_eeprom_operations ops;
34837+ struct ixgbe_eeprom_operations ops;
34838 enum ixgbe_eeprom_type type;
34839 u32 semaphore_delay;
34840 u16 word_size;
34841@@ -2581,7 +2581,7 @@ struct ixgbe_eeprom_info {
34842
34843 #define IXGBE_FLAGS_DOUBLE_RESET_REQUIRED 0x01
34844 struct ixgbe_mac_info {
34845- struct ixgbe_mac_operations ops;
34846+ struct ixgbe_mac_operations ops;
34847 enum ixgbe_mac_type type;
34848 u8 addr[IXGBE_ETH_LENGTH_OF_ADDRESS];
34849 u8 perm_addr[IXGBE_ETH_LENGTH_OF_ADDRESS];
34850@@ -2608,7 +2608,7 @@ struct ixgbe_mac_info {
34851 };
34852
34853 struct ixgbe_phy_info {
34854- struct ixgbe_phy_operations ops;
34855+ struct ixgbe_phy_operations ops;
34856 struct mdio_if_info mdio;
34857 enum ixgbe_phy_type type;
34858 u32 id;
34859diff -urNp linux-2.6.39/drivers/net/ixgbe/ixgbe_x540.c linux-2.6.39/drivers/net/ixgbe/ixgbe_x540.c
34860--- linux-2.6.39/drivers/net/ixgbe/ixgbe_x540.c 2011-05-19 00:06:34.000000000 -0400
34861+++ linux-2.6.39/drivers/net/ixgbe/ixgbe_x540.c 2011-05-22 19:36:31.000000000 -0400
34862@@ -727,7 +727,7 @@ static struct ixgbe_phy_operations phy_o
34863 .check_overtemp = &ixgbe_tn_check_overtemp,
34864 };
34865
34866-struct ixgbe_info ixgbe_X540_info = {
34867+const struct ixgbe_info ixgbe_X540_info = {
34868 .mac = ixgbe_mac_X540,
34869 .get_invariants = &ixgbe_get_invariants_X540,
34870 .mac_ops = &mac_ops_X540,
34871diff -urNp linux-2.6.39/drivers/net/ixgbevf/ethtool.c linux-2.6.39/drivers/net/ixgbevf/ethtool.c
34872--- linux-2.6.39/drivers/net/ixgbevf/ethtool.c 2011-05-19 00:06:34.000000000 -0400
34873+++ linux-2.6.39/drivers/net/ixgbevf/ethtool.c 2011-05-22 19:36:31.000000000 -0400
34874@@ -709,7 +709,7 @@ static int ixgbevf_nway_reset(struct net
34875 return 0;
34876 }
34877
34878-static struct ethtool_ops ixgbevf_ethtool_ops = {
34879+static const struct ethtool_ops ixgbevf_ethtool_ops = {
34880 .get_settings = ixgbevf_get_settings,
34881 .get_drvinfo = ixgbevf_get_drvinfo,
34882 .get_regs_len = ixgbevf_get_regs_len,
34883diff -urNp linux-2.6.39/drivers/net/ixgbevf/ixgbevf.h linux-2.6.39/drivers/net/ixgbevf/ixgbevf.h
34884--- linux-2.6.39/drivers/net/ixgbevf/ixgbevf.h 2011-05-19 00:06:34.000000000 -0400
34885+++ linux-2.6.39/drivers/net/ixgbevf/ixgbevf.h 2011-05-22 19:36:31.000000000 -0400
34886@@ -279,7 +279,7 @@ enum ixgbevf_boards {
34887
34888 extern struct ixgbevf_info ixgbevf_82599_vf_info;
34889 extern struct ixgbevf_info ixgbevf_X540_vf_info;
34890-extern struct ixgbe_mac_operations ixgbevf_mbx_ops;
34891+extern const struct ixgbe_mac_operations ixgbevf_mbx_ops;
34892
34893 /* needed by ethtool.c */
34894 extern char ixgbevf_driver_name[];
34895diff -urNp linux-2.6.39/drivers/net/ixgbevf/vf.c linux-2.6.39/drivers/net/ixgbevf/vf.c
34896--- linux-2.6.39/drivers/net/ixgbevf/vf.c 2011-05-19 00:06:34.000000000 -0400
34897+++ linux-2.6.39/drivers/net/ixgbevf/vf.c 2011-05-22 19:36:31.000000000 -0400
34898@@ -368,7 +368,7 @@ static s32 ixgbevf_check_mac_link_vf(str
34899 return 0;
34900 }
34901
34902-static struct ixgbe_mac_operations ixgbevf_mac_ops = {
34903+static const struct ixgbe_mac_operations ixgbevf_mac_ops = {
34904 .init_hw = ixgbevf_init_hw_vf,
34905 .reset_hw = ixgbevf_reset_hw_vf,
34906 .start_hw = ixgbevf_start_hw_vf,
34907@@ -381,12 +381,12 @@ static struct ixgbe_mac_operations ixgbe
34908 .set_vfta = ixgbevf_set_vfta_vf,
34909 };
34910
34911-struct ixgbevf_info ixgbevf_82599_vf_info = {
34912+const struct ixgbevf_info ixgbevf_82599_vf_info = {
34913 .mac = ixgbe_mac_82599_vf,
34914 .mac_ops = &ixgbevf_mac_ops,
34915 };
34916
34917-struct ixgbevf_info ixgbevf_X540_vf_info = {
34918+const struct ixgbevf_info ixgbevf_X540_vf_info = {
34919 .mac = ixgbe_mac_X540_vf,
34920 .mac_ops = &ixgbevf_mac_ops,
34921 };
34922diff -urNp linux-2.6.39/drivers/net/ixgbevf/vf.h linux-2.6.39/drivers/net/ixgbevf/vf.h
34923--- linux-2.6.39/drivers/net/ixgbevf/vf.h 2011-05-19 00:06:34.000000000 -0400
34924+++ linux-2.6.39/drivers/net/ixgbevf/vf.h 2011-05-22 19:36:31.000000000 -0400
34925@@ -166,7 +166,7 @@ struct ixgbevf_hw_stats {
34926
34927 struct ixgbevf_info {
34928 enum ixgbe_mac_type mac;
34929- struct ixgbe_mac_operations *mac_ops;
34930+ const struct ixgbe_mac_operations *mac_ops;
34931 };
34932
34933 #endif /* __IXGBE_VF_H__ */
34934diff -urNp linux-2.6.39/drivers/net/ksz884x.c linux-2.6.39/drivers/net/ksz884x.c
34935--- linux-2.6.39/drivers/net/ksz884x.c 2011-05-19 00:06:34.000000000 -0400
34936+++ linux-2.6.39/drivers/net/ksz884x.c 2011-05-22 19:36:31.000000000 -0400
34937@@ -6536,6 +6536,8 @@ static void netdev_get_ethtool_stats(str
34938 int rc;
34939 u64 counter[TOTAL_PORT_COUNTER_NUM];
34940
34941+ pax_track_stack();
34942+
34943 mutex_lock(&hw_priv->lock);
34944 n = SWITCH_PORT_NUM;
34945 for (i = 0, p = port->first_port; i < port->mib_port_cnt; i++, p++) {
34946@@ -6637,7 +6639,7 @@ static int netdev_set_rx_csum(struct net
34947 return 0;
34948 }
34949
34950-static struct ethtool_ops netdev_ethtool_ops = {
34951+static const struct ethtool_ops netdev_ethtool_ops = {
34952 .get_settings = netdev_get_settings,
34953 .set_settings = netdev_set_settings,
34954 .nway_reset = netdev_nway_reset,
34955diff -urNp linux-2.6.39/drivers/net/mlx4/main.c linux-2.6.39/drivers/net/mlx4/main.c
34956--- linux-2.6.39/drivers/net/mlx4/main.c 2011-05-19 00:06:34.000000000 -0400
34957+++ linux-2.6.39/drivers/net/mlx4/main.c 2011-05-22 19:36:31.000000000 -0400
34958@@ -40,6 +40,7 @@
34959 #include <linux/dma-mapping.h>
34960 #include <linux/slab.h>
34961 #include <linux/io-mapping.h>
34962+#include <linux/sched.h>
34963
34964 #include <linux/mlx4/device.h>
34965 #include <linux/mlx4/doorbell.h>
34966@@ -764,6 +765,8 @@ static int mlx4_init_hca(struct mlx4_dev
34967 u64 icm_size;
34968 int err;
34969
34970+ pax_track_stack();
34971+
34972 err = mlx4_QUERY_FW(dev);
34973 if (err) {
34974 if (err == -EACCES)
34975diff -urNp linux-2.6.39/drivers/net/netconsole.c linux-2.6.39/drivers/net/netconsole.c
34976--- linux-2.6.39/drivers/net/netconsole.c 2011-05-19 00:06:34.000000000 -0400
34977+++ linux-2.6.39/drivers/net/netconsole.c 2011-05-22 19:36:31.000000000 -0400
34978@@ -634,7 +634,7 @@ static void drop_netconsole_target(struc
34979 config_item_put(&nt->item);
34980 }
34981
34982-static struct configfs_group_operations netconsole_subsys_group_ops = {
34983+static const struct configfs_group_operations netconsole_subsys_group_ops = {
34984 .make_item = make_netconsole_target,
34985 .drop_item = drop_netconsole_target,
34986 };
34987diff -urNp linux-2.6.39/drivers/net/niu.c linux-2.6.39/drivers/net/niu.c
34988--- linux-2.6.39/drivers/net/niu.c 2011-05-19 00:06:34.000000000 -0400
34989+++ linux-2.6.39/drivers/net/niu.c 2011-05-22 19:36:31.000000000 -0400
34990@@ -9067,6 +9067,8 @@ static void __devinit niu_try_msix(struc
34991 int i, num_irqs, err;
34992 u8 first_ldg;
34993
34994+ pax_track_stack();
34995+
34996 first_ldg = (NIU_NUM_LDG / parent->num_ports) * np->port;
34997 for (i = 0; i < (NIU_NUM_LDG / parent->num_ports); i++)
34998 ldg_num_map[i] = first_ldg + i;
34999diff -urNp linux-2.6.39/drivers/net/pcnet32.c linux-2.6.39/drivers/net/pcnet32.c
35000--- linux-2.6.39/drivers/net/pcnet32.c 2011-05-19 00:06:34.000000000 -0400
35001+++ linux-2.6.39/drivers/net/pcnet32.c 2011-05-22 19:36:31.000000000 -0400
35002@@ -82,7 +82,7 @@ static int cards_found;
35003 /*
35004 * VLB I/O addresses
35005 */
35006-static unsigned int pcnet32_portlist[] __initdata =
35007+static unsigned int pcnet32_portlist[] __devinitdata =
35008 { 0x300, 0x320, 0x340, 0x360, 0 };
35009
35010 static int pcnet32_debug;
35011@@ -379,7 +379,7 @@ static int pcnet32_wio_check(unsigned lo
35012 return inw(addr + PCNET32_WIO_RAP) == 88;
35013 }
35014
35015-static struct pcnet32_access pcnet32_wio = {
35016+static const struct pcnet32_access pcnet32_wio = {
35017 .read_csr = pcnet32_wio_read_csr,
35018 .write_csr = pcnet32_wio_write_csr,
35019 .read_bcr = pcnet32_wio_read_bcr,
35020@@ -434,7 +434,7 @@ static int pcnet32_dwio_check(unsigned l
35021 return (inl(addr + PCNET32_DWIO_RAP) & 0xffff) == 88;
35022 }
35023
35024-static struct pcnet32_access pcnet32_dwio = {
35025+static const struct pcnet32_access pcnet32_dwio = {
35026 .read_csr = pcnet32_dwio_read_csr,
35027 .write_csr = pcnet32_dwio_write_csr,
35028 .read_bcr = pcnet32_dwio_read_bcr,
35029@@ -1546,7 +1546,7 @@ pcnet32_probe1(unsigned long ioaddr, int
35030 int chip_version;
35031 char *chipname;
35032 struct net_device *dev;
35033- struct pcnet32_access *a = NULL;
35034+ const struct pcnet32_access *a = NULL;
35035 u8 promaddr[6];
35036 int ret = -ENODEV;
35037
35038diff -urNp linux-2.6.39/drivers/net/ppp_generic.c linux-2.6.39/drivers/net/ppp_generic.c
35039--- linux-2.6.39/drivers/net/ppp_generic.c 2011-05-19 00:06:34.000000000 -0400
35040+++ linux-2.6.39/drivers/net/ppp_generic.c 2011-05-22 19:36:31.000000000 -0400
35041@@ -987,7 +987,6 @@ ppp_net_ioctl(struct net_device *dev, st
35042 void __user *addr = (void __user *) ifr->ifr_ifru.ifru_data;
35043 struct ppp_stats stats;
35044 struct ppp_comp_stats cstats;
35045- char *vers;
35046
35047 switch (cmd) {
35048 case SIOCGPPPSTATS:
35049@@ -1009,8 +1008,7 @@ ppp_net_ioctl(struct net_device *dev, st
35050 break;
35051
35052 case SIOCGPPPVER:
35053- vers = PPP_VERSION;
35054- if (copy_to_user(addr, vers, strlen(vers) + 1))
35055+ if (copy_to_user(addr, PPP_VERSION, sizeof(PPP_VERSION)))
35056 break;
35057 err = 0;
35058 break;
35059diff -urNp linux-2.6.39/drivers/net/qlcnic/qlcnic.h linux-2.6.39/drivers/net/qlcnic/qlcnic.h
35060--- linux-2.6.39/drivers/net/qlcnic/qlcnic.h 2011-05-19 00:06:34.000000000 -0400
35061+++ linux-2.6.39/drivers/net/qlcnic/qlcnic.h 2011-05-22 19:36:31.000000000 -0400
35062@@ -1037,7 +1037,7 @@ struct qlcnic_adapter {
35063 struct vlan_group *vlgrp;
35064 struct qlcnic_npar_info *npars;
35065 struct qlcnic_eswitch *eswitch;
35066- struct qlcnic_nic_template *nic_ops;
35067+ const struct qlcnic_nic_template *nic_ops;
35068
35069 struct qlcnic_adapter_stats stats;
35070
35071diff -urNp linux-2.6.39/drivers/net/qlcnic/qlcnic_main.c linux-2.6.39/drivers/net/qlcnic/qlcnic_main.c
35072--- linux-2.6.39/drivers/net/qlcnic/qlcnic_main.c 2011-05-19 00:06:34.000000000 -0400
35073+++ linux-2.6.39/drivers/net/qlcnic/qlcnic_main.c 2011-05-22 19:36:31.000000000 -0400
35074@@ -340,13 +340,13 @@ static const struct net_device_ops qlcni
35075 #endif
35076 };
35077
35078-static struct qlcnic_nic_template qlcnic_ops = {
35079+static const struct qlcnic_nic_template qlcnic_ops = {
35080 .config_bridged_mode = qlcnic_config_bridged_mode,
35081 .config_led = qlcnic_config_led,
35082 .start_firmware = qlcnic_start_firmware
35083 };
35084
35085-static struct qlcnic_nic_template qlcnic_vf_ops = {
35086+static const struct qlcnic_nic_template qlcnic_vf_ops = {
35087 .config_bridged_mode = qlcnicvf_config_bridged_mode,
35088 .config_led = qlcnicvf_config_led,
35089 .start_firmware = qlcnicvf_start_firmware
35090diff -urNp linux-2.6.39/drivers/net/qlge/qlge.h linux-2.6.39/drivers/net/qlge/qlge.h
35091--- linux-2.6.39/drivers/net/qlge/qlge.h 2011-05-19 00:06:34.000000000 -0400
35092+++ linux-2.6.39/drivers/net/qlge/qlge.h 2011-05-22 19:36:31.000000000 -0400
35093@@ -2134,7 +2134,7 @@ struct ql_adapter {
35094 struct delayed_work mpi_idc_work;
35095 struct delayed_work mpi_core_to_log;
35096 struct completion ide_completion;
35097- struct nic_operations *nic_ops;
35098+ const struct nic_operations *nic_ops;
35099 u16 device_id;
35100 struct timer_list timer;
35101 atomic_t lb_count;
35102diff -urNp linux-2.6.39/drivers/net/qlge/qlge_main.c linux-2.6.39/drivers/net/qlge/qlge_main.c
35103--- linux-2.6.39/drivers/net/qlge/qlge_main.c 2011-05-19 00:06:34.000000000 -0400
35104+++ linux-2.6.39/drivers/net/qlge/qlge_main.c 2011-05-22 19:36:31.000000000 -0400
35105@@ -4412,12 +4412,12 @@ error:
35106 rtnl_unlock();
35107 }
35108
35109-static struct nic_operations qla8012_nic_ops = {
35110+static const struct nic_operations qla8012_nic_ops = {
35111 .get_flash = ql_get_8012_flash_params,
35112 .port_initialize = ql_8012_port_initialize,
35113 };
35114
35115-static struct nic_operations qla8000_nic_ops = {
35116+static const struct nic_operations qla8000_nic_ops = {
35117 .get_flash = ql_get_8000_flash_params,
35118 .port_initialize = ql_8000_port_initialize,
35119 };
35120diff -urNp linux-2.6.39/drivers/net/sfc/falcon.c linux-2.6.39/drivers/net/sfc/falcon.c
35121--- linux-2.6.39/drivers/net/sfc/falcon.c 2011-05-19 00:06:34.000000000 -0400
35122+++ linux-2.6.39/drivers/net/sfc/falcon.c 2011-05-22 19:36:31.000000000 -0400
35123@@ -1703,7 +1703,7 @@ static int falcon_set_wol(struct efx_nic
35124 **************************************************************************
35125 */
35126
35127-struct efx_nic_type falcon_a1_nic_type = {
35128+const struct efx_nic_type falcon_a1_nic_type = {
35129 .probe = falcon_probe_nic,
35130 .remove = falcon_remove_nic,
35131 .init = falcon_init_nic,
35132@@ -1744,7 +1744,7 @@ struct efx_nic_type falcon_a1_nic_type =
35133 .reset_world_flags = ETH_RESET_IRQ,
35134 };
35135
35136-struct efx_nic_type falcon_b0_nic_type = {
35137+const struct efx_nic_type falcon_b0_nic_type = {
35138 .probe = falcon_probe_nic,
35139 .remove = falcon_remove_nic,
35140 .init = falcon_init_nic,
35141diff -urNp linux-2.6.39/drivers/net/sfc/mtd.c linux-2.6.39/drivers/net/sfc/mtd.c
35142--- linux-2.6.39/drivers/net/sfc/mtd.c 2011-05-19 00:06:34.000000000 -0400
35143+++ linux-2.6.39/drivers/net/sfc/mtd.c 2011-05-22 19:36:31.000000000 -0400
35144@@ -382,7 +382,7 @@ static int falcon_mtd_sync(struct mtd_in
35145 return rc;
35146 }
35147
35148-static struct efx_mtd_ops falcon_mtd_ops = {
35149+static const struct efx_mtd_ops falcon_mtd_ops = {
35150 .read = falcon_mtd_read,
35151 .erase = falcon_mtd_erase,
35152 .write = falcon_mtd_write,
35153@@ -560,7 +560,7 @@ static int siena_mtd_sync(struct mtd_inf
35154 return rc;
35155 }
35156
35157-static struct efx_mtd_ops siena_mtd_ops = {
35158+static const struct efx_mtd_ops siena_mtd_ops = {
35159 .read = siena_mtd_read,
35160 .erase = siena_mtd_erase,
35161 .write = siena_mtd_write,
35162diff -urNp linux-2.6.39/drivers/net/sfc/nic.h linux-2.6.39/drivers/net/sfc/nic.h
35163--- linux-2.6.39/drivers/net/sfc/nic.h 2011-05-19 00:06:34.000000000 -0400
35164+++ linux-2.6.39/drivers/net/sfc/nic.h 2011-05-22 19:36:31.000000000 -0400
35165@@ -152,9 +152,9 @@ struct siena_nic_data {
35166 int wol_filter_id;
35167 };
35168
35169-extern struct efx_nic_type falcon_a1_nic_type;
35170-extern struct efx_nic_type falcon_b0_nic_type;
35171-extern struct efx_nic_type siena_a0_nic_type;
35172+extern const struct efx_nic_type falcon_a1_nic_type;
35173+extern const struct efx_nic_type falcon_b0_nic_type;
35174+extern const struct efx_nic_type siena_a0_nic_type;
35175
35176 /**************************************************************************
35177 *
35178diff -urNp linux-2.6.39/drivers/net/sfc/siena.c linux-2.6.39/drivers/net/sfc/siena.c
35179--- linux-2.6.39/drivers/net/sfc/siena.c 2011-05-19 00:06:34.000000000 -0400
35180+++ linux-2.6.39/drivers/net/sfc/siena.c 2011-05-22 19:36:31.000000000 -0400
35181@@ -599,7 +599,7 @@ static void siena_init_wol(struct efx_ni
35182 **************************************************************************
35183 */
35184
35185-struct efx_nic_type siena_a0_nic_type = {
35186+const struct efx_nic_type siena_a0_nic_type = {
35187 .probe = siena_probe_nic,
35188 .remove = siena_remove_nic,
35189 .init = siena_init_nic,
35190diff -urNp linux-2.6.39/drivers/net/sh_eth.c linux-2.6.39/drivers/net/sh_eth.c
35191--- linux-2.6.39/drivers/net/sh_eth.c 2011-05-19 00:06:34.000000000 -0400
35192+++ linux-2.6.39/drivers/net/sh_eth.c 2011-05-22 19:36:31.000000000 -0400
35193@@ -1360,7 +1360,7 @@ static void sh_eth_get_strings(struct ne
35194 }
35195 }
35196
35197-static struct ethtool_ops sh_eth_ethtool_ops = {
35198+static const struct ethtool_ops sh_eth_ethtool_ops = {
35199 .get_settings = sh_eth_get_settings,
35200 .set_settings = sh_eth_set_settings,
35201 .nway_reset = sh_eth_nway_reset,
35202diff -urNp linux-2.6.39/drivers/net/stmmac/stmmac_ethtool.c linux-2.6.39/drivers/net/stmmac/stmmac_ethtool.c
35203--- linux-2.6.39/drivers/net/stmmac/stmmac_ethtool.c 2011-05-19 00:06:34.000000000 -0400
35204+++ linux-2.6.39/drivers/net/stmmac/stmmac_ethtool.c 2011-05-22 19:36:31.000000000 -0400
35205@@ -348,7 +348,7 @@ static int stmmac_set_wol(struct net_dev
35206 return 0;
35207 }
35208
35209-static struct ethtool_ops stmmac_ethtool_ops = {
35210+static const struct ethtool_ops stmmac_ethtool_ops = {
35211 .begin = stmmac_check_if_running,
35212 .get_drvinfo = stmmac_ethtool_getdrvinfo,
35213 .get_settings = stmmac_ethtool_getsettings,
35214diff -urNp linux-2.6.39/drivers/net/sungem_phy.c linux-2.6.39/drivers/net/sungem_phy.c
35215--- linux-2.6.39/drivers/net/sungem_phy.c 2011-05-19 00:06:34.000000000 -0400
35216+++ linux-2.6.39/drivers/net/sungem_phy.c 2011-05-22 19:36:31.000000000 -0400
35217@@ -886,7 +886,7 @@ static int marvell_read_link(struct mii_
35218 SUPPORTED_1000baseT_Half | SUPPORTED_1000baseT_Full)
35219
35220 /* Broadcom BCM 5201 */
35221-static struct mii_phy_ops bcm5201_phy_ops = {
35222+static const struct mii_phy_ops bcm5201_phy_ops = {
35223 .init = bcm5201_init,
35224 .suspend = bcm5201_suspend,
35225 .setup_aneg = genmii_setup_aneg,
35226@@ -905,7 +905,7 @@ static struct mii_phy_def bcm5201_phy_de
35227 };
35228
35229 /* Broadcom BCM 5221 */
35230-static struct mii_phy_ops bcm5221_phy_ops = {
35231+static const struct mii_phy_ops bcm5221_phy_ops = {
35232 .suspend = bcm5221_suspend,
35233 .init = bcm5221_init,
35234 .setup_aneg = genmii_setup_aneg,
35235@@ -924,7 +924,7 @@ static struct mii_phy_def bcm5221_phy_de
35236 };
35237
35238 /* Broadcom BCM 5241 */
35239-static struct mii_phy_ops bcm5241_phy_ops = {
35240+static const struct mii_phy_ops bcm5241_phy_ops = {
35241 .suspend = bcm5241_suspend,
35242 .init = bcm5241_init,
35243 .setup_aneg = genmii_setup_aneg,
35244@@ -942,7 +942,7 @@ static struct mii_phy_def bcm5241_phy_de
35245 };
35246
35247 /* Broadcom BCM 5400 */
35248-static struct mii_phy_ops bcm5400_phy_ops = {
35249+static const struct mii_phy_ops bcm5400_phy_ops = {
35250 .init = bcm5400_init,
35251 .suspend = bcm5400_suspend,
35252 .setup_aneg = bcm54xx_setup_aneg,
35253@@ -961,7 +961,7 @@ static struct mii_phy_def bcm5400_phy_de
35254 };
35255
35256 /* Broadcom BCM 5401 */
35257-static struct mii_phy_ops bcm5401_phy_ops = {
35258+static const struct mii_phy_ops bcm5401_phy_ops = {
35259 .init = bcm5401_init,
35260 .suspend = bcm5401_suspend,
35261 .setup_aneg = bcm54xx_setup_aneg,
35262@@ -980,7 +980,7 @@ static struct mii_phy_def bcm5401_phy_de
35263 };
35264
35265 /* Broadcom BCM 5411 */
35266-static struct mii_phy_ops bcm5411_phy_ops = {
35267+static const struct mii_phy_ops bcm5411_phy_ops = {
35268 .init = bcm5411_init,
35269 .suspend = generic_suspend,
35270 .setup_aneg = bcm54xx_setup_aneg,
35271@@ -999,7 +999,7 @@ static struct mii_phy_def bcm5411_phy_de
35272 };
35273
35274 /* Broadcom BCM 5421 */
35275-static struct mii_phy_ops bcm5421_phy_ops = {
35276+static const struct mii_phy_ops bcm5421_phy_ops = {
35277 .init = bcm5421_init,
35278 .suspend = generic_suspend,
35279 .setup_aneg = bcm54xx_setup_aneg,
35280@@ -1019,7 +1019,7 @@ static struct mii_phy_def bcm5421_phy_de
35281 };
35282
35283 /* Broadcom BCM 5421 built-in K2 */
35284-static struct mii_phy_ops bcm5421k2_phy_ops = {
35285+static const struct mii_phy_ops bcm5421k2_phy_ops = {
35286 .init = bcm5421_init,
35287 .suspend = generic_suspend,
35288 .setup_aneg = bcm54xx_setup_aneg,
35289@@ -1037,7 +1037,7 @@ static struct mii_phy_def bcm5421k2_phy_
35290 .ops = &bcm5421k2_phy_ops
35291 };
35292
35293-static struct mii_phy_ops bcm5461_phy_ops = {
35294+static const struct mii_phy_ops bcm5461_phy_ops = {
35295 .init = bcm5421_init,
35296 .suspend = generic_suspend,
35297 .setup_aneg = bcm54xx_setup_aneg,
35298@@ -1057,7 +1057,7 @@ static struct mii_phy_def bcm5461_phy_de
35299 };
35300
35301 /* Broadcom BCM 5462 built-in Vesta */
35302-static struct mii_phy_ops bcm5462V_phy_ops = {
35303+static const struct mii_phy_ops bcm5462V_phy_ops = {
35304 .init = bcm5421_init,
35305 .suspend = generic_suspend,
35306 .setup_aneg = bcm54xx_setup_aneg,
35307@@ -1076,7 +1076,7 @@ static struct mii_phy_def bcm5462V_phy_d
35308 };
35309
35310 /* Marvell 88E1101 amd 88E1111 */
35311-static struct mii_phy_ops marvell88e1101_phy_ops = {
35312+static const struct mii_phy_ops marvell88e1101_phy_ops = {
35313 .suspend = generic_suspend,
35314 .setup_aneg = marvell_setup_aneg,
35315 .setup_forced = marvell_setup_forced,
35316@@ -1084,7 +1084,7 @@ static struct mii_phy_ops marvell88e1101
35317 .read_link = marvell_read_link
35318 };
35319
35320-static struct mii_phy_ops marvell88e1111_phy_ops = {
35321+static const struct mii_phy_ops marvell88e1111_phy_ops = {
35322 .init = marvell88e1111_init,
35323 .suspend = generic_suspend,
35324 .setup_aneg = marvell_setup_aneg,
35325@@ -1122,7 +1122,7 @@ static struct mii_phy_def marvell88e1111
35326 };
35327
35328 /* Generic implementation for most 10/100 PHYs */
35329-static struct mii_phy_ops generic_phy_ops = {
35330+static const struct mii_phy_ops generic_phy_ops = {
35331 .setup_aneg = genmii_setup_aneg,
35332 .setup_forced = genmii_setup_forced,
35333 .poll_link = genmii_poll_link,
35334diff -urNp linux-2.6.39/drivers/net/tg3.h linux-2.6.39/drivers/net/tg3.h
35335--- linux-2.6.39/drivers/net/tg3.h 2011-05-19 00:06:34.000000000 -0400
35336+++ linux-2.6.39/drivers/net/tg3.h 2011-05-22 19:36:31.000000000 -0400
35337@@ -131,6 +131,7 @@
35338 #define CHIPREV_ID_5750_A0 0x4000
35339 #define CHIPREV_ID_5750_A1 0x4001
35340 #define CHIPREV_ID_5750_A3 0x4003
35341+#define CHIPREV_ID_5750_C1 0x4201
35342 #define CHIPREV_ID_5750_C2 0x4202
35343 #define CHIPREV_ID_5752_A0_HW 0x5000
35344 #define CHIPREV_ID_5752_A0 0x6000
35345diff -urNp linux-2.6.39/drivers/net/tile/tilepro.c linux-2.6.39/drivers/net/tile/tilepro.c
35346--- linux-2.6.39/drivers/net/tile/tilepro.c 2011-05-19 00:06:34.000000000 -0400
35347+++ linux-2.6.39/drivers/net/tile/tilepro.c 2011-05-22 19:36:31.000000000 -0400
35348@@ -2263,7 +2263,7 @@ static int tile_net_get_mac(struct net_d
35349 }
35350
35351
35352-static struct net_device_ops tile_net_ops = {
35353+static const struct net_device_ops tile_net_ops = {
35354 .ndo_open = tile_net_open,
35355 .ndo_stop = tile_net_stop,
35356 .ndo_start_xmit = tile_net_tx,
35357diff -urNp linux-2.6.39/drivers/net/tulip/de2104x.c linux-2.6.39/drivers/net/tulip/de2104x.c
35358--- linux-2.6.39/drivers/net/tulip/de2104x.c 2011-05-19 00:06:34.000000000 -0400
35359+++ linux-2.6.39/drivers/net/tulip/de2104x.c 2011-05-22 19:36:31.000000000 -0400
35360@@ -1817,6 +1817,8 @@ static void __devinit de21041_get_srom_i
35361 struct de_srom_info_leaf *il;
35362 void *bufp;
35363
35364+ pax_track_stack();
35365+
35366 /* download entire eeprom */
35367 for (i = 0; i < DE_EEPROM_WORDS; i++)
35368 ((__le16 *)ee_data)[i] =
35369diff -urNp linux-2.6.39/drivers/net/tulip/de4x5.c linux-2.6.39/drivers/net/tulip/de4x5.c
35370--- linux-2.6.39/drivers/net/tulip/de4x5.c 2011-05-19 00:06:34.000000000 -0400
35371+++ linux-2.6.39/drivers/net/tulip/de4x5.c 2011-05-22 19:36:31.000000000 -0400
35372@@ -5401,7 +5401,7 @@ de4x5_ioctl(struct net_device *dev, stru
35373 for (i=0; i<ETH_ALEN; i++) {
35374 tmp.addr[i] = dev->dev_addr[i];
35375 }
35376- if (copy_to_user(ioc->data, tmp.addr, ioc->len)) return -EFAULT;
35377+ if (ioc->len > sizeof tmp.addr || copy_to_user(ioc->data, tmp.addr, ioc->len)) return -EFAULT;
35378 break;
35379
35380 case DE4X5_SET_HWADDR: /* Set the hardware address */
35381@@ -5441,7 +5441,7 @@ de4x5_ioctl(struct net_device *dev, stru
35382 spin_lock_irqsave(&lp->lock, flags);
35383 memcpy(&statbuf, &lp->pktStats, ioc->len);
35384 spin_unlock_irqrestore(&lp->lock, flags);
35385- if (copy_to_user(ioc->data, &statbuf, ioc->len))
35386+ if (ioc->len > sizeof statbuf || copy_to_user(ioc->data, &statbuf, ioc->len))
35387 return -EFAULT;
35388 break;
35389 }
35390diff -urNp linux-2.6.39/drivers/net/usb/asix.c linux-2.6.39/drivers/net/usb/asix.c
35391--- linux-2.6.39/drivers/net/usb/asix.c 2011-05-19 00:06:34.000000000 -0400
35392+++ linux-2.6.39/drivers/net/usb/asix.c 2011-05-22 19:36:31.000000000 -0400
35393@@ -1098,7 +1098,7 @@ out:
35394 return ret;
35395 }
35396
35397-static struct ethtool_ops ax88178_ethtool_ops = {
35398+static const struct ethtool_ops ax88178_ethtool_ops = {
35399 .get_drvinfo = asix_get_drvinfo,
35400 .get_link = asix_get_link,
35401 .get_msglevel = usbnet_get_msglevel,
35402diff -urNp linux-2.6.39/drivers/net/usb/cdc_ncm.c linux-2.6.39/drivers/net/usb/cdc_ncm.c
35403--- linux-2.6.39/drivers/net/usb/cdc_ncm.c 2011-05-19 00:06:34.000000000 -0400
35404+++ linux-2.6.39/drivers/net/usb/cdc_ncm.c 2011-05-22 19:36:31.000000000 -0400
35405@@ -141,7 +141,7 @@ struct cdc_ncm_ctx {
35406 static void cdc_ncm_tx_timeout(unsigned long arg);
35407 static const struct driver_info cdc_ncm_info;
35408 static struct usb_driver cdc_ncm_driver;
35409-static struct ethtool_ops cdc_ncm_ethtool_ops;
35410+static const struct ethtool_ops cdc_ncm_ethtool_ops;
35411
35412 static const struct usb_device_id cdc_devs[] = {
35413 { USB_INTERFACE_INFO(USB_CLASS_COMM,
35414@@ -1257,7 +1257,7 @@ static struct usb_driver cdc_ncm_driver
35415 .supports_autosuspend = 1,
35416 };
35417
35418-static struct ethtool_ops cdc_ncm_ethtool_ops = {
35419+static const struct ethtool_ops cdc_ncm_ethtool_ops = {
35420 .get_drvinfo = cdc_ncm_get_drvinfo,
35421 .get_link = usbnet_get_link,
35422 .get_msglevel = usbnet_get_msglevel,
35423diff -urNp linux-2.6.39/drivers/net/usb/hso.c linux-2.6.39/drivers/net/usb/hso.c
35424--- linux-2.6.39/drivers/net/usb/hso.c 2011-05-19 00:06:34.000000000 -0400
35425+++ linux-2.6.39/drivers/net/usb/hso.c 2011-05-22 19:36:31.000000000 -0400
35426@@ -71,7 +71,7 @@
35427 #include <asm/byteorder.h>
35428 #include <linux/serial_core.h>
35429 #include <linux/serial.h>
35430-
35431+#include <asm/local.h>
35432
35433 #define MOD_AUTHOR "Option Wireless"
35434 #define MOD_DESCRIPTION "USB High Speed Option driver"
35435@@ -257,7 +257,7 @@ struct hso_serial {
35436
35437 /* from usb_serial_port */
35438 struct tty_struct *tty;
35439- int open_count;
35440+ local_t open_count;
35441 spinlock_t serial_lock;
35442
35443 int (*write_data) (struct hso_serial *serial);
35444@@ -1190,7 +1190,7 @@ static void put_rxbuf_data_and_resubmit_
35445 struct urb *urb;
35446
35447 urb = serial->rx_urb[0];
35448- if (serial->open_count > 0) {
35449+ if (local_read(&serial->open_count) > 0) {
35450 count = put_rxbuf_data(urb, serial);
35451 if (count == -1)
35452 return;
35453@@ -1226,7 +1226,7 @@ static void hso_std_serial_read_bulk_cal
35454 DUMP1(urb->transfer_buffer, urb->actual_length);
35455
35456 /* Anyone listening? */
35457- if (serial->open_count == 0)
35458+ if (local_read(&serial->open_count) == 0)
35459 return;
35460
35461 if (status == 0) {
35462@@ -1311,8 +1311,7 @@ static int hso_serial_open(struct tty_st
35463 spin_unlock_irq(&serial->serial_lock);
35464
35465 /* check for port already opened, if not set the termios */
35466- serial->open_count++;
35467- if (serial->open_count == 1) {
35468+ if (local_inc_return(&serial->open_count) == 1) {
35469 serial->rx_state = RX_IDLE;
35470 /* Force default termio settings */
35471 _hso_serial_set_termios(tty, NULL);
35472@@ -1324,7 +1323,7 @@ static int hso_serial_open(struct tty_st
35473 result = hso_start_serial_device(serial->parent, GFP_KERNEL);
35474 if (result) {
35475 hso_stop_serial_device(serial->parent);
35476- serial->open_count--;
35477+ local_dec(&serial->open_count);
35478 kref_put(&serial->parent->ref, hso_serial_ref_free);
35479 }
35480 } else {
35481@@ -1361,10 +1360,10 @@ static void hso_serial_close(struct tty_
35482
35483 /* reset the rts and dtr */
35484 /* do the actual close */
35485- serial->open_count--;
35486+ local_dec(&serial->open_count);
35487
35488- if (serial->open_count <= 0) {
35489- serial->open_count = 0;
35490+ if (local_read(&serial->open_count) <= 0) {
35491+ local_set(&serial->open_count, 0);
35492 spin_lock_irq(&serial->serial_lock);
35493 if (serial->tty == tty) {
35494 serial->tty->driver_data = NULL;
35495@@ -1446,7 +1445,7 @@ static void hso_serial_set_termios(struc
35496
35497 /* the actual setup */
35498 spin_lock_irqsave(&serial->serial_lock, flags);
35499- if (serial->open_count)
35500+ if (local_read(&serial->open_count))
35501 _hso_serial_set_termios(tty, old);
35502 else
35503 tty->termios = old;
35504@@ -1905,7 +1904,7 @@ static void intr_callback(struct urb *ur
35505 D1("Pending read interrupt on port %d\n", i);
35506 spin_lock(&serial->serial_lock);
35507 if (serial->rx_state == RX_IDLE &&
35508- serial->open_count > 0) {
35509+ local_read(&serial->open_count) > 0) {
35510 /* Setup and send a ctrl req read on
35511 * port i */
35512 if (!serial->rx_urb_filled[0]) {
35513@@ -3097,7 +3096,7 @@ static int hso_resume(struct usb_interfa
35514 /* Start all serial ports */
35515 for (i = 0; i < HSO_SERIAL_TTY_MINORS; i++) {
35516 if (serial_table[i] && (serial_table[i]->interface == iface)) {
35517- if (dev2ser(serial_table[i])->open_count) {
35518+ if (local_read(&dev2ser(serial_table[i])->open_count)) {
35519 result =
35520 hso_start_serial_device(serial_table[i], GFP_NOIO);
35521 hso_kick_transmit(dev2ser(serial_table[i]));
35522diff -urNp linux-2.6.39/drivers/net/usb/ipheth.c linux-2.6.39/drivers/net/usb/ipheth.c
35523--- linux-2.6.39/drivers/net/usb/ipheth.c 2011-05-19 00:06:34.000000000 -0400
35524+++ linux-2.6.39/drivers/net/usb/ipheth.c 2011-05-22 19:36:31.000000000 -0400
35525@@ -421,7 +421,7 @@ static u32 ipheth_ethtool_op_get_link(st
35526 return netif_carrier_ok(dev->net);
35527 }
35528
35529-static struct ethtool_ops ops = {
35530+static const struct ethtool_ops ops = {
35531 .get_link = ipheth_ethtool_op_get_link
35532 };
35533
35534diff -urNp linux-2.6.39/drivers/net/usb/sierra_net.c linux-2.6.39/drivers/net/usb/sierra_net.c
35535--- linux-2.6.39/drivers/net/usb/sierra_net.c 2011-05-19 00:06:34.000000000 -0400
35536+++ linux-2.6.39/drivers/net/usb/sierra_net.c 2011-05-22 19:36:31.000000000 -0400
35537@@ -618,7 +618,7 @@ static u32 sierra_net_get_link(struct ne
35538 return sierra_net_get_private(dev)->link_up && netif_running(net);
35539 }
35540
35541-static struct ethtool_ops sierra_net_ethtool_ops = {
35542+static const struct ethtool_ops sierra_net_ethtool_ops = {
35543 .get_drvinfo = sierra_net_get_drvinfo,
35544 .get_link = sierra_net_get_link,
35545 .get_msglevel = usbnet_get_msglevel,
35546diff -urNp linux-2.6.39/drivers/net/vmxnet3/vmxnet3_ethtool.c linux-2.6.39/drivers/net/vmxnet3/vmxnet3_ethtool.c
35547--- linux-2.6.39/drivers/net/vmxnet3/vmxnet3_ethtool.c 2011-05-19 00:06:34.000000000 -0400
35548+++ linux-2.6.39/drivers/net/vmxnet3/vmxnet3_ethtool.c 2011-05-22 19:36:31.000000000 -0400
35549@@ -631,8 +631,7 @@ vmxnet3_set_rss_indir(struct net_device
35550 * Return with error code if any of the queue indices
35551 * is out of range
35552 */
35553- if (p->ring_index[i] < 0 ||
35554- p->ring_index[i] >= adapter->num_rx_queues)
35555+ if (p->ring_index[i] >= adapter->num_rx_queues)
35556 return -EINVAL;
35557 }
35558
35559diff -urNp linux-2.6.39/drivers/net/vxge/vxge-config.h linux-2.6.39/drivers/net/vxge/vxge-config.h
35560--- linux-2.6.39/drivers/net/vxge/vxge-config.h 2011-05-19 00:06:34.000000000 -0400
35561+++ linux-2.6.39/drivers/net/vxge/vxge-config.h 2011-05-22 19:36:31.000000000 -0400
35562@@ -834,7 +834,7 @@ struct vxge_hw_device_hw_info {
35563 struct vxge_hw_device_attr {
35564 void __iomem *bar0;
35565 struct pci_dev *pdev;
35566- struct vxge_hw_uld_cbs uld_callbacks;
35567+ struct vxge_hw_uld_cbs uld_callbacks;
35568 };
35569
35570 #define VXGE_HW_DEVICE_LINK_STATE_SET(hldev, ls) (hldev->link_state = ls)
35571diff -urNp linux-2.6.39/drivers/net/vxge/vxge-main.c linux-2.6.39/drivers/net/vxge/vxge-main.c
35572--- linux-2.6.39/drivers/net/vxge/vxge-main.c 2011-05-19 00:06:34.000000000 -0400
35573+++ linux-2.6.39/drivers/net/vxge/vxge-main.c 2011-05-22 19:36:31.000000000 -0400
35574@@ -97,6 +97,8 @@ static inline void VXGE_COMPLETE_VPATH_T
35575 struct sk_buff *completed[NR_SKB_COMPLETED];
35576 int more;
35577
35578+ pax_track_stack();
35579+
35580 do {
35581 more = 0;
35582 skb_ptr = completed;
35583@@ -1927,6 +1929,8 @@ static enum vxge_hw_status vxge_rth_conf
35584 u8 mtable[256] = {0}; /* CPU to vpath mapping */
35585 int index;
35586
35587+ pax_track_stack();
35588+
35589 /*
35590 * Filling
35591 * - itable with bucket numbers
35592diff -urNp linux-2.6.39/drivers/net/wan/cycx_x25.c linux-2.6.39/drivers/net/wan/cycx_x25.c
35593--- linux-2.6.39/drivers/net/wan/cycx_x25.c 2011-05-19 00:06:34.000000000 -0400
35594+++ linux-2.6.39/drivers/net/wan/cycx_x25.c 2011-05-22 19:36:31.000000000 -0400
35595@@ -1018,6 +1018,8 @@ static void hex_dump(char *msg, unsigned
35596 unsigned char hex[1024],
35597 * phex = hex;
35598
35599+ pax_track_stack();
35600+
35601 if (len >= (sizeof(hex) / 2))
35602 len = (sizeof(hex) / 2) - 1;
35603
35604diff -urNp linux-2.6.39/drivers/net/wan/lapbether.c linux-2.6.39/drivers/net/wan/lapbether.c
35605--- linux-2.6.39/drivers/net/wan/lapbether.c 2011-05-19 00:06:34.000000000 -0400
35606+++ linux-2.6.39/drivers/net/wan/lapbether.c 2011-05-22 19:36:31.000000000 -0400
35607@@ -259,7 +259,7 @@ static int lapbeth_set_mac_address(struc
35608 }
35609
35610
35611-static struct lapb_register_struct lapbeth_callbacks = {
35612+static const struct lapb_register_struct lapbeth_callbacks = {
35613 .connect_confirmation = lapbeth_connected,
35614 .connect_indication = lapbeth_connected,
35615 .disconnect_confirmation = lapbeth_disconnected,
35616diff -urNp linux-2.6.39/drivers/net/wan/x25_asy.c linux-2.6.39/drivers/net/wan/x25_asy.c
35617--- linux-2.6.39/drivers/net/wan/x25_asy.c 2011-05-19 00:06:34.000000000 -0400
35618+++ linux-2.6.39/drivers/net/wan/x25_asy.c 2011-05-22 19:36:31.000000000 -0400
35619@@ -434,7 +434,7 @@ static void x25_asy_disconnected(struct
35620 netif_rx(skb);
35621 }
35622
35623-static struct lapb_register_struct x25_asy_callbacks = {
35624+static const struct lapb_register_struct x25_asy_callbacks = {
35625 .connect_confirmation = x25_asy_connected,
35626 .connect_indication = x25_asy_connected,
35627 .disconnect_confirmation = x25_asy_disconnected,
35628diff -urNp linux-2.6.39/drivers/net/wimax/i2400m/usb-fw.c linux-2.6.39/drivers/net/wimax/i2400m/usb-fw.c
35629--- linux-2.6.39/drivers/net/wimax/i2400m/usb-fw.c 2011-05-19 00:06:34.000000000 -0400
35630+++ linux-2.6.39/drivers/net/wimax/i2400m/usb-fw.c 2011-05-22 19:36:31.000000000 -0400
35631@@ -287,6 +287,8 @@ ssize_t i2400mu_bus_bm_wait_for_ack(stru
35632 int do_autopm = 1;
35633 DECLARE_COMPLETION_ONSTACK(notif_completion);
35634
35635+ pax_track_stack();
35636+
35637 d_fnstart(8, dev, "(i2400m %p ack %p size %zu)\n",
35638 i2400m, ack, ack_size);
35639 BUG_ON(_ack == i2400m->bm_ack_buf);
35640diff -urNp linux-2.6.39/drivers/net/wireless/airo.c linux-2.6.39/drivers/net/wireless/airo.c
35641--- linux-2.6.39/drivers/net/wireless/airo.c 2011-05-19 00:06:34.000000000 -0400
35642+++ linux-2.6.39/drivers/net/wireless/airo.c 2011-05-22 19:36:31.000000000 -0400
35643@@ -3001,6 +3001,8 @@ static void airo_process_scan_results (s
35644 BSSListElement * loop_net;
35645 BSSListElement * tmp_net;
35646
35647+ pax_track_stack();
35648+
35649 /* Blow away current list of scan results */
35650 list_for_each_entry_safe (loop_net, tmp_net, &ai->network_list, list) {
35651 list_move_tail (&loop_net->list, &ai->network_free_list);
35652@@ -3792,6 +3794,8 @@ static u16 setup_card(struct airo_info *
35653 WepKeyRid wkr;
35654 int rc;
35655
35656+ pax_track_stack();
35657+
35658 memset( &mySsid, 0, sizeof( mySsid ) );
35659 kfree (ai->flash);
35660 ai->flash = NULL;
35661@@ -4760,6 +4764,8 @@ static int proc_stats_rid_open( struct i
35662 __le32 *vals = stats.vals;
35663 int len;
35664
35665+ pax_track_stack();
35666+
35667 if ((file->private_data = kzalloc(sizeof(struct proc_data ), GFP_KERNEL)) == NULL)
35668 return -ENOMEM;
35669 data = file->private_data;
35670@@ -5483,6 +5489,8 @@ static int proc_BSSList_open( struct ino
35671 /* If doLoseSync is not 1, we won't do a Lose Sync */
35672 int doLoseSync = -1;
35673
35674+ pax_track_stack();
35675+
35676 if ((file->private_data = kzalloc(sizeof(struct proc_data ), GFP_KERNEL)) == NULL)
35677 return -ENOMEM;
35678 data = file->private_data;
35679@@ -7190,6 +7198,8 @@ static int airo_get_aplist(struct net_de
35680 int i;
35681 int loseSync = capable(CAP_NET_ADMIN) ? 1: -1;
35682
35683+ pax_track_stack();
35684+
35685 qual = kmalloc(IW_MAX_AP * sizeof(*qual), GFP_KERNEL);
35686 if (!qual)
35687 return -ENOMEM;
35688@@ -7750,6 +7760,8 @@ static void airo_read_wireless_stats(str
35689 CapabilityRid cap_rid;
35690 __le32 *vals = stats_rid.vals;
35691
35692+ pax_track_stack();
35693+
35694 /* Get stats out of the card */
35695 clear_bit(JOB_WSTATS, &local->jobs);
35696 if (local->power.event) {
35697diff -urNp linux-2.6.39/drivers/net/wireless/ath/ath5k/debug.c linux-2.6.39/drivers/net/wireless/ath/ath5k/debug.c
35698--- linux-2.6.39/drivers/net/wireless/ath/ath5k/debug.c 2011-05-19 00:06:34.000000000 -0400
35699+++ linux-2.6.39/drivers/net/wireless/ath/ath5k/debug.c 2011-05-22 19:36:31.000000000 -0400
35700@@ -204,6 +204,8 @@ static ssize_t read_file_beacon(struct f
35701 unsigned int v;
35702 u64 tsf;
35703
35704+ pax_track_stack();
35705+
35706 v = ath5k_hw_reg_read(sc->ah, AR5K_BEACON);
35707 len += snprintf(buf+len, sizeof(buf)-len,
35708 "%-24s0x%08x\tintval: %d\tTIM: 0x%x\n",
35709@@ -323,6 +325,8 @@ static ssize_t read_file_debug(struct fi
35710 unsigned int len = 0;
35711 unsigned int i;
35712
35713+ pax_track_stack();
35714+
35715 len += snprintf(buf+len, sizeof(buf)-len,
35716 "DEBUG LEVEL: 0x%08x\n\n", sc->debug.level);
35717
35718@@ -384,6 +388,8 @@ static ssize_t read_file_antenna(struct
35719 unsigned int i;
35720 unsigned int v;
35721
35722+ pax_track_stack();
35723+
35724 len += snprintf(buf+len, sizeof(buf)-len, "antenna mode\t%d\n",
35725 sc->ah->ah_ant_mode);
35726 len += snprintf(buf+len, sizeof(buf)-len, "default antenna\t%d\n",
35727@@ -494,6 +500,8 @@ static ssize_t read_file_misc(struct fil
35728 unsigned int len = 0;
35729 u32 filt = ath5k_hw_get_rx_filter(sc->ah);
35730
35731+ pax_track_stack();
35732+
35733 len += snprintf(buf+len, sizeof(buf)-len, "bssid-mask: %pM\n",
35734 sc->bssidmask);
35735 len += snprintf(buf+len, sizeof(buf)-len, "filter-flags: 0x%x ",
35736@@ -550,6 +558,8 @@ static ssize_t read_file_frameerrors(str
35737 unsigned int len = 0;
35738 int i;
35739
35740+ pax_track_stack();
35741+
35742 len += snprintf(buf+len, sizeof(buf)-len,
35743 "RX\n---------------------\n");
35744 len += snprintf(buf+len, sizeof(buf)-len, "CRC\t%u\t(%u%%)\n",
35745@@ -667,6 +677,8 @@ static ssize_t read_file_ani(struct file
35746 char buf[700];
35747 unsigned int len = 0;
35748
35749+ pax_track_stack();
35750+
35751 len += snprintf(buf+len, sizeof(buf)-len,
35752 "HW has PHY error counters:\t%s\n",
35753 sc->ah->ah_capabilities.cap_has_phyerr_counters ?
35754@@ -827,6 +839,8 @@ static ssize_t read_file_queue(struct fi
35755 struct ath5k_buf *bf, *bf0;
35756 int i, n;
35757
35758+ pax_track_stack();
35759+
35760 len += snprintf(buf+len, sizeof(buf)-len,
35761 "available txbuffers: %d\n", sc->txbuf_len);
35762
35763diff -urNp linux-2.6.39/drivers/net/wireless/ath/ath9k/ar9003_calib.c linux-2.6.39/drivers/net/wireless/ath/ath9k/ar9003_calib.c
35764--- linux-2.6.39/drivers/net/wireless/ath/ath9k/ar9003_calib.c 2011-05-19 00:06:34.000000000 -0400
35765+++ linux-2.6.39/drivers/net/wireless/ath/ath9k/ar9003_calib.c 2011-05-22 19:36:31.000000000 -0400
35766@@ -734,6 +734,8 @@ static void ar9003_hw_tx_iq_cal(struct a
35767 s32 i, j, ip, im, nmeasurement;
35768 u8 nchains = get_streams(common->tx_chainmask);
35769
35770+ pax_track_stack();
35771+
35772 for (ip = 0; ip < MPASS; ip++) {
35773 REG_RMW_FIELD(ah, AR_PHY_TX_IQCAL_CONTROL_1,
35774 AR_PHY_TX_IQCAQL_CONTROL_1_IQCORR_I_Q_COFF_DELPT,
35775@@ -856,6 +858,8 @@ static void ar9003_hw_tx_iq_cal_post_pro
35776 int i, ip, im, j;
35777 int nmeasurement;
35778
35779+ pax_track_stack();
35780+
35781 for (i = 0; i < AR9300_MAX_CHAINS; i++) {
35782 if (ah->txchainmask & (1 << i))
35783 num_chains++;
35784diff -urNp linux-2.6.39/drivers/net/wireless/ath/ath9k/ar9003_paprd.c linux-2.6.39/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
35785--- linux-2.6.39/drivers/net/wireless/ath/ath9k/ar9003_paprd.c 2011-05-19 00:06:34.000000000 -0400
35786+++ linux-2.6.39/drivers/net/wireless/ath/ath9k/ar9003_paprd.c 2011-05-22 19:36:31.000000000 -0400
35787@@ -356,6 +356,8 @@ static bool create_pa_curve(u32 *data_L,
35788 int theta_low_bin = 0;
35789 int i;
35790
35791+ pax_track_stack();
35792+
35793 /* disregard any bin that contains <= 16 samples */
35794 thresh_accum_cnt = 16;
35795 scale_factor = 5;
35796diff -urNp linux-2.6.39/drivers/net/wireless/ath/ath9k/debug.c linux-2.6.39/drivers/net/wireless/ath/ath9k/debug.c
35797--- linux-2.6.39/drivers/net/wireless/ath/ath9k/debug.c 2011-05-19 00:06:34.000000000 -0400
35798+++ linux-2.6.39/drivers/net/wireless/ath/ath9k/debug.c 2011-05-22 19:36:31.000000000 -0400
35799@@ -335,6 +335,8 @@ static ssize_t read_file_interrupt(struc
35800 char buf[512];
35801 unsigned int len = 0;
35802
35803+ pax_track_stack();
35804+
35805 if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) {
35806 len += snprintf(buf + len, sizeof(buf) - len,
35807 "%8s: %10u\n", "RXLP", sc->debug.stats.istats.rxlp);
35808@@ -422,6 +424,8 @@ static ssize_t read_file_wiphy(struct fi
35809 u8 addr[ETH_ALEN];
35810 u32 tmp;
35811
35812+ pax_track_stack();
35813+
35814 len += snprintf(buf + len, sizeof(buf) - len,
35815 "%s (chan=%d center-freq: %d MHz channel-type: %d (%s))\n",
35816 wiphy_name(sc->hw->wiphy),
35817diff -urNp linux-2.6.39/drivers/net/wireless/ath/ath9k/htc_drv_main.c linux-2.6.39/drivers/net/wireless/ath/ath9k/htc_drv_main.c
35818--- linux-2.6.39/drivers/net/wireless/ath/ath9k/htc_drv_main.c 2011-05-19 00:06:34.000000000 -0400
35819+++ linux-2.6.39/drivers/net/wireless/ath/ath9k/htc_drv_main.c 2011-05-22 19:36:31.000000000 -0400
35820@@ -737,6 +737,8 @@ static ssize_t read_file_tgt_stats(struc
35821 unsigned int len = 0;
35822 int ret = 0;
35823
35824+ pax_track_stack();
35825+
35826 memset(&cmd_rsp, 0, sizeof(cmd_rsp));
35827
35828 WMI_CMD(WMI_TGT_STATS_CMDID);
35829@@ -782,6 +784,8 @@ static ssize_t read_file_xmit(struct fil
35830 char buf[512];
35831 unsigned int len = 0;
35832
35833+ pax_track_stack();
35834+
35835 len += snprintf(buf + len, sizeof(buf) - len,
35836 "%20s : %10u\n", "Buffers queued",
35837 priv->debug.tx_stats.buf_queued);
35838@@ -831,6 +835,8 @@ static ssize_t read_file_recv(struct fil
35839 char buf[512];
35840 unsigned int len = 0;
35841
35842+ pax_track_stack();
35843+
35844 len += snprintf(buf + len, sizeof(buf) - len,
35845 "%20s : %10u\n", "SKBs allocated",
35846 priv->debug.rx_stats.skb_allocated);
35847@@ -1816,7 +1822,7 @@ static void ath9k_htc_set_coverage_class
35848 mutex_unlock(&priv->mutex);
35849 }
35850
35851-struct ieee80211_ops ath9k_htc_ops = {
35852+const struct ieee80211_ops ath9k_htc_ops = {
35853 .tx = ath9k_htc_tx,
35854 .start = ath9k_htc_start,
35855 .stop = ath9k_htc_stop,
35856diff -urNp linux-2.6.39/drivers/net/wireless/ath/ath9k/htc.h linux-2.6.39/drivers/net/wireless/ath/ath9k/htc.h
35857--- linux-2.6.39/drivers/net/wireless/ath/ath9k/htc.h 2011-05-19 00:06:34.000000000 -0400
35858+++ linux-2.6.39/drivers/net/wireless/ath/ath9k/htc.h 2011-05-22 19:36:31.000000000 -0400
35859@@ -42,7 +42,7 @@
35860 #define TSF_TO_TU(_h, _l) \
35861 ((((u32)(_h)) << 22) | (((u32)(_l)) >> 10))
35862
35863-extern struct ieee80211_ops ath9k_htc_ops;
35864+extern const struct ieee80211_ops ath9k_htc_ops;
35865 extern int htc_modparam_nohwcrypt;
35866
35867 enum htc_phymode {
35868diff -urNp linux-2.6.39/drivers/net/wireless/ath/ath9k/hw.h linux-2.6.39/drivers/net/wireless/ath/ath9k/hw.h
35869--- linux-2.6.39/drivers/net/wireless/ath/ath9k/hw.h 2011-05-19 00:06:34.000000000 -0400
35870+++ linux-2.6.39/drivers/net/wireless/ath/ath9k/hw.h 2011-05-22 19:36:31.000000000 -0400
35871@@ -753,9 +753,7 @@ struct ath_hw {
35872 } enable_32kHz_clock;
35873
35874 /* Private to hardware code */
35875- struct ath_hw_private_ops private_ops;
35876- /* Accessed by the lower level driver */
35877- struct ath_hw_ops ops;
35878+ struct ath_hw_private_ops private_ops;struct ath_hw_ops ops;
35879
35880 /* Used to program the radio on non single-chip devices */
35881 u32 *analogBank0Data;
35882diff -urNp linux-2.6.39/drivers/net/wireless/b43/debugfs.c linux-2.6.39/drivers/net/wireless/b43/debugfs.c
35883--- linux-2.6.39/drivers/net/wireless/b43/debugfs.c 2011-05-19 00:06:34.000000000 -0400
35884+++ linux-2.6.39/drivers/net/wireless/b43/debugfs.c 2011-05-22 19:36:31.000000000 -0400
35885@@ -43,7 +43,7 @@ static struct dentry *rootdir;
35886 struct b43_debugfs_fops {
35887 ssize_t (*read)(struct b43_wldev *dev, char *buf, size_t bufsize);
35888 int (*write)(struct b43_wldev *dev, const char *buf, size_t count);
35889- struct file_operations fops;
35890+ const struct file_operations fops;
35891 /* Offset of struct b43_dfs_file in struct b43_dfsentry */
35892 size_t file_struct_offset;
35893 };
35894diff -urNp linux-2.6.39/drivers/net/wireless/b43legacy/debugfs.c linux-2.6.39/drivers/net/wireless/b43legacy/debugfs.c
35895--- linux-2.6.39/drivers/net/wireless/b43legacy/debugfs.c 2011-05-19 00:06:34.000000000 -0400
35896+++ linux-2.6.39/drivers/net/wireless/b43legacy/debugfs.c 2011-05-22 19:36:31.000000000 -0400
35897@@ -44,7 +44,7 @@ static struct dentry *rootdir;
35898 struct b43legacy_debugfs_fops {
35899 ssize_t (*read)(struct b43legacy_wldev *dev, char *buf, size_t bufsize);
35900 int (*write)(struct b43legacy_wldev *dev, const char *buf, size_t count);
35901- struct file_operations fops;
35902+ const struct file_operations fops;
35903 /* Offset of struct b43legacy_dfs_file in struct b43legacy_dfsentry */
35904 size_t file_struct_offset;
35905 /* Take wl->irq_lock before calling read/write? */
35906diff -urNp linux-2.6.39/drivers/net/wireless/ipw2x00/ipw2100.c linux-2.6.39/drivers/net/wireless/ipw2x00/ipw2100.c
35907--- linux-2.6.39/drivers/net/wireless/ipw2x00/ipw2100.c 2011-05-19 00:06:34.000000000 -0400
35908+++ linux-2.6.39/drivers/net/wireless/ipw2x00/ipw2100.c 2011-05-22 19:36:31.000000000 -0400
35909@@ -2100,6 +2100,8 @@ static int ipw2100_set_essid(struct ipw2
35910 int err;
35911 DECLARE_SSID_BUF(ssid);
35912
35913+ pax_track_stack();
35914+
35915 IPW_DEBUG_HC("SSID: '%s'\n", print_ssid(ssid, essid, ssid_len));
35916
35917 if (ssid_len)
35918@@ -5449,6 +5451,8 @@ static int ipw2100_set_key(struct ipw210
35919 struct ipw2100_wep_key *wep_key = (void *)cmd.host_command_parameters;
35920 int err;
35921
35922+ pax_track_stack();
35923+
35924 IPW_DEBUG_HC("WEP_KEY_INFO: index = %d, len = %d/%d\n",
35925 idx, keylen, len);
35926
35927diff -urNp linux-2.6.39/drivers/net/wireless/ipw2x00/libipw_rx.c linux-2.6.39/drivers/net/wireless/ipw2x00/libipw_rx.c
35928--- linux-2.6.39/drivers/net/wireless/ipw2x00/libipw_rx.c 2011-05-19 00:06:34.000000000 -0400
35929+++ linux-2.6.39/drivers/net/wireless/ipw2x00/libipw_rx.c 2011-05-22 19:36:31.000000000 -0400
35930@@ -1565,6 +1565,8 @@ static void libipw_process_probe_respons
35931 unsigned long flags;
35932 DECLARE_SSID_BUF(ssid);
35933
35934+ pax_track_stack();
35935+
35936 LIBIPW_DEBUG_SCAN("'%s' (%pM"
35937 "): %c%c%c%c %c%c%c%c-%c%c%c%c %c%c%c%c\n",
35938 print_ssid(ssid, info_element->data, info_element->len),
35939diff -urNp linux-2.6.39/drivers/net/wireless/iwlegacy/iwl-3945.c linux-2.6.39/drivers/net/wireless/iwlegacy/iwl-3945.c
35940--- linux-2.6.39/drivers/net/wireless/iwlegacy/iwl-3945.c 2011-05-19 00:06:34.000000000 -0400
35941+++ linux-2.6.39/drivers/net/wireless/iwlegacy/iwl-3945.c 2011-05-22 19:36:31.000000000 -0400
35942@@ -2630,7 +2630,7 @@ static int iwl3945_load_bsm(struct iwl_p
35943 return 0;
35944 }
35945
35946-static struct iwl_hcmd_ops iwl3945_hcmd = {
35947+static const struct iwl_hcmd_ops iwl3945_hcmd = {
35948 .rxon_assoc = iwl3945_send_rxon_assoc,
35949 .commit_rxon = iwl3945_commit_rxon,
35950 };
35951@@ -2675,7 +2675,7 @@ static const struct iwl_legacy_ops iwl39
35952 .manage_ibss_station = iwl3945_manage_ibss_station,
35953 };
35954
35955-static struct iwl_hcmd_utils_ops iwl3945_hcmd_utils = {
35956+static const struct iwl_hcmd_utils_ops iwl3945_hcmd_utils = {
35957 .get_hcmd_size = iwl3945_get_hcmd_size,
35958 .build_addsta_hcmd = iwl3945_build_addsta_hcmd,
35959 .request_scan = iwl3945_request_scan,
35960diff -urNp linux-2.6.39/drivers/net/wireless/iwlegacy/iwl-4965.c linux-2.6.39/drivers/net/wireless/iwlegacy/iwl-4965.c
35961--- linux-2.6.39/drivers/net/wireless/iwlegacy/iwl-4965.c 2011-05-19 00:06:34.000000000 -0400
35962+++ linux-2.6.39/drivers/net/wireless/iwlegacy/iwl-4965.c 2011-05-22 19:36:32.000000000 -0400
35963@@ -1904,7 +1904,7 @@ static void iwl4965_rx_handler_setup(str
35964 priv->rx_handlers[BEACON_NOTIFICATION] = iwl4965_rx_beacon_notif;
35965 }
35966
35967-static struct iwl_hcmd_ops iwl4965_hcmd = {
35968+static const struct iwl_hcmd_ops iwl4965_hcmd = {
35969 .rxon_assoc = iwl4965_send_rxon_assoc,
35970 .commit_rxon = iwl4965_commit_rxon,
35971 .set_rxon_chain = iwl4965_set_rxon_chain,
35972@@ -2056,7 +2056,7 @@ static void iwl4965_config_ap(struct iwl
35973 iwl4965_send_beacon_cmd(priv);
35974 }
35975
35976-static struct iwl_hcmd_utils_ops iwl4965_hcmd_utils = {
35977+static const struct iwl_hcmd_utils_ops iwl4965_hcmd_utils = {
35978 .get_hcmd_size = iwl4965_get_hcmd_size,
35979 .build_addsta_hcmd = iwl4965_build_addsta_hcmd,
35980 .request_scan = iwl4965_request_scan,
35981@@ -2114,7 +2114,7 @@ static const struct iwl_legacy_ops iwl49
35982 .update_bcast_stations = iwl4965_update_bcast_stations,
35983 };
35984
35985-struct ieee80211_ops iwl4965_hw_ops = {
35986+const struct ieee80211_ops iwl4965_hw_ops = {
35987 .tx = iwl4965_mac_tx,
35988 .start = iwl4965_mac_start,
35989 .stop = iwl4965_mac_stop,
35990diff -urNp linux-2.6.39/drivers/net/wireless/iwlegacy/iwl-4965.h linux-2.6.39/drivers/net/wireless/iwlegacy/iwl-4965.h
35991--- linux-2.6.39/drivers/net/wireless/iwlegacy/iwl-4965.h 2011-05-19 00:06:34.000000000 -0400
35992+++ linux-2.6.39/drivers/net/wireless/iwlegacy/iwl-4965.h 2011-05-22 19:36:32.000000000 -0400
35993@@ -70,7 +70,7 @@ extern struct iwl_cfg iwl4965_cfg;
35994
35995 extern struct iwl_mod_params iwl4965_mod_params;
35996
35997-extern struct ieee80211_ops iwl4965_hw_ops;
35998+extern const struct ieee80211_ops iwl4965_hw_ops;
35999
36000 /* tx queue */
36001 void iwl4965_free_tfds_in_queue(struct iwl_priv *priv,
36002diff -urNp linux-2.6.39/drivers/net/wireless/iwlegacy/iwl-core.h linux-2.6.39/drivers/net/wireless/iwlegacy/iwl-core.h
36003--- linux-2.6.39/drivers/net/wireless/iwlegacy/iwl-core.h 2011-05-19 00:06:34.000000000 -0400
36004+++ linux-2.6.39/drivers/net/wireless/iwlegacy/iwl-core.h 2011-05-22 19:36:32.000000000 -0400
36005@@ -150,7 +150,7 @@ struct iwl_lib_ops {
36006 int (*set_channel_switch)(struct iwl_priv *priv,
36007 struct ieee80211_channel_switch *ch_switch);
36008 /* power management */
36009- struct iwl_apm_ops apm_ops;
36010+ const struct iwl_apm_ops apm_ops;
36011
36012 /* power */
36013 int (*send_tx_power) (struct iwl_priv *priv);
36014@@ -160,12 +160,12 @@ struct iwl_lib_ops {
36015 struct iwl_eeprom_ops eeprom_ops;
36016
36017 /* temperature */
36018- struct iwl_temp_ops temp_ops;
36019+ const struct iwl_temp_ops temp_ops;
36020 /* check for plcp health */
36021 bool (*check_plcp_health)(struct iwl_priv *priv,
36022 struct iwl_rx_packet *pkt);
36023
36024- struct iwl_debugfs_ops debugfs_ops;
36025+ const struct iwl_debugfs_ops debugfs_ops;
36026
36027 };
36028
36029diff -urNp linux-2.6.39/drivers/net/wireless/iwlwifi/iwl-6000.c linux-2.6.39/drivers/net/wireless/iwlwifi/iwl-6000.c
36030--- linux-2.6.39/drivers/net/wireless/iwlwifi/iwl-6000.c 2011-05-19 00:06:34.000000000 -0400
36031+++ linux-2.6.39/drivers/net/wireless/iwlwifi/iwl-6000.c 2011-05-22 19:36:32.000000000 -0400
36032@@ -422,11 +422,11 @@ static struct iwl_lib_ops iwl6030_lib =
36033 }
36034 };
36035
36036-static struct iwl_nic_ops iwl6050_nic_ops = {
36037+static const struct iwl_nic_ops iwl6050_nic_ops = {
36038 .additional_nic_config = &iwl6050_additional_nic_config,
36039 };
36040
36041-static struct iwl_nic_ops iwl6150_nic_ops = {
36042+static const struct iwl_nic_ops iwl6150_nic_ops = {
36043 .additional_nic_config = &iwl6150_additional_nic_config,
36044 };
36045
36046diff -urNp linux-2.6.39/drivers/net/wireless/iwlwifi/iwl-agn.h linux-2.6.39/drivers/net/wireless/iwlwifi/iwl-agn.h
36047--- linux-2.6.39/drivers/net/wireless/iwlwifi/iwl-agn.h 2011-05-19 00:06:34.000000000 -0400
36048+++ linux-2.6.39/drivers/net/wireless/iwlwifi/iwl-agn.h 2011-05-22 19:36:32.000000000 -0400
36049@@ -109,9 +109,9 @@ extern struct iwl_cfg iwl230_bg_cfg;
36050 extern struct iwl_cfg iwl230_bgn_cfg;
36051
36052 extern struct iwl_mod_params iwlagn_mod_params;
36053-extern struct iwl_hcmd_ops iwlagn_hcmd;
36054-extern struct iwl_hcmd_ops iwlagn_bt_hcmd;
36055-extern struct iwl_hcmd_utils_ops iwlagn_hcmd_utils;
36056+extern const struct iwl_hcmd_ops iwlagn_hcmd;
36057+extern const struct iwl_hcmd_ops iwlagn_bt_hcmd;
36058+extern const struct iwl_hcmd_utils_ops iwlagn_hcmd_utils;
36059
36060 extern struct ieee80211_ops iwlagn_hw_ops;
36061 extern struct ieee80211_ops iwl4965_hw_ops;
36062diff -urNp linux-2.6.39/drivers/net/wireless/iwlwifi/iwl-agn-hcmd.c linux-2.6.39/drivers/net/wireless/iwlwifi/iwl-agn-hcmd.c
36063--- linux-2.6.39/drivers/net/wireless/iwlwifi/iwl-agn-hcmd.c 2011-05-19 00:06:34.000000000 -0400
36064+++ linux-2.6.39/drivers/net/wireless/iwlwifi/iwl-agn-hcmd.c 2011-05-22 19:36:32.000000000 -0400
36065@@ -363,7 +363,7 @@ static int iwlagn_set_pan_params(struct
36066 return ret;
36067 }
36068
36069-struct iwl_hcmd_ops iwlagn_hcmd = {
36070+const struct iwl_hcmd_ops iwlagn_hcmd = {
36071 .rxon_assoc = iwlagn_send_rxon_assoc,
36072 .commit_rxon = iwlagn_commit_rxon,
36073 .set_rxon_chain = iwlagn_set_rxon_chain,
36074@@ -372,7 +372,7 @@ struct iwl_hcmd_ops iwlagn_hcmd = {
36075 .set_pan_params = iwlagn_set_pan_params,
36076 };
36077
36078-struct iwl_hcmd_ops iwlagn_bt_hcmd = {
36079+const struct iwl_hcmd_ops iwlagn_bt_hcmd = {
36080 .rxon_assoc = iwlagn_send_rxon_assoc,
36081 .commit_rxon = iwlagn_commit_rxon,
36082 .set_rxon_chain = iwlagn_set_rxon_chain,
36083@@ -381,7 +381,7 @@ struct iwl_hcmd_ops iwlagn_bt_hcmd = {
36084 .set_pan_params = iwlagn_set_pan_params,
36085 };
36086
36087-struct iwl_hcmd_utils_ops iwlagn_hcmd_utils = {
36088+const struct iwl_hcmd_utils_ops iwlagn_hcmd_utils = {
36089 .get_hcmd_size = iwlagn_get_hcmd_size,
36090 .build_addsta_hcmd = iwlagn_build_addsta_hcmd,
36091 .gain_computation = iwlagn_gain_computation,
36092diff -urNp linux-2.6.39/drivers/net/wireless/iwlwifi/iwl-agn-rs.c linux-2.6.39/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
36093--- linux-2.6.39/drivers/net/wireless/iwlwifi/iwl-agn-rs.c 2011-05-19 00:06:34.000000000 -0400
36094+++ linux-2.6.39/drivers/net/wireless/iwlwifi/iwl-agn-rs.c 2011-05-22 19:36:32.000000000 -0400
36095@@ -883,6 +883,8 @@ static void rs_tx_status(void *priv_r, s
36096 struct iwl_station_priv *sta_priv = (void *)sta->drv_priv;
36097 struct iwl_rxon_context *ctx = sta_priv->common.ctx;
36098
36099+ pax_track_stack();
36100+
36101 IWL_DEBUG_RATE_LIMIT(priv, "get frame ack response, update rate scale window\n");
36102
36103 /* Treat uninitialized rate scaling data same as non-existing. */
36104@@ -2894,6 +2896,8 @@ static void rs_fill_link_cmd(struct iwl_
36105 container_of(lq_sta, struct iwl_station_priv, lq_sta);
36106 struct iwl_link_quality_cmd *lq_cmd = &lq_sta->lq;
36107
36108+ pax_track_stack();
36109+
36110 /* Override starting rate (index 0) if needed for debug purposes */
36111 rs_dbgfs_set_mcs(lq_sta, &new_rate, index);
36112
36113diff -urNp linux-2.6.39/drivers/net/wireless/iwlwifi/iwl-core.h linux-2.6.39/drivers/net/wireless/iwlwifi/iwl-core.h
36114--- linux-2.6.39/drivers/net/wireless/iwlwifi/iwl-core.h 2011-05-19 00:06:34.000000000 -0400
36115+++ linux-2.6.39/drivers/net/wireless/iwlwifi/iwl-core.h 2011-05-22 19:36:32.000000000 -0400
36116@@ -198,28 +198,25 @@ struct iwl_lib_ops {
36117 int (*set_channel_switch)(struct iwl_priv *priv,
36118 struct ieee80211_channel_switch *ch_switch);
36119 /* power management */
36120- struct iwl_apm_ops apm_ops;
36121+ const struct iwl_apm_ops apm_ops;
36122
36123 /* power */
36124 int (*send_tx_power) (struct iwl_priv *priv);
36125 void (*update_chain_flags)(struct iwl_priv *priv);
36126
36127 /* isr */
36128- struct iwl_isr_ops isr_ops;
36129+ const struct iwl_isr_ops isr_ops;
36130
36131 /* eeprom operations (as defined in iwl-eeprom.h) */
36132 struct iwl_eeprom_ops eeprom_ops;
36133
36134 /* temperature */
36135- struct iwl_temp_ops temp_ops;
36136+ const struct iwl_temp_ops temp_ops;
36137
36138 int (*txfifo_flush)(struct iwl_priv *priv, u16 flush_control);
36139 void (*dev_txfifo_flush)(struct iwl_priv *priv, u16 flush_control);
36140
36141- struct iwl_debugfs_ops debugfs_ops;
36142-
36143- /* thermal throttling */
36144- struct iwl_tt_ops tt_ops;
36145+ const struct iwl_debugfs_ops debugfs_ops;const struct iwl_tt_ops tt_ops;
36146 };
36147
36148 struct iwl_led_ops {
36149diff -urNp linux-2.6.39/drivers/net/wireless/iwlwifi/iwl-debugfs.c linux-2.6.39/drivers/net/wireless/iwlwifi/iwl-debugfs.c
36150--- linux-2.6.39/drivers/net/wireless/iwlwifi/iwl-debugfs.c 2011-05-19 00:06:34.000000000 -0400
36151+++ linux-2.6.39/drivers/net/wireless/iwlwifi/iwl-debugfs.c 2011-05-22 19:36:32.000000000 -0400
36152@@ -549,6 +549,8 @@ static ssize_t iwl_dbgfs_status_read(str
36153 int pos = 0;
36154 const size_t bufsz = sizeof(buf);
36155
36156+ pax_track_stack();
36157+
36158 pos += scnprintf(buf + pos, bufsz - pos, "STATUS_HCMD_ACTIVE:\t %d\n",
36159 test_bit(STATUS_HCMD_ACTIVE, &priv->status));
36160 pos += scnprintf(buf + pos, bufsz - pos, "STATUS_INT_ENABLED:\t %d\n",
36161@@ -681,6 +683,8 @@ static ssize_t iwl_dbgfs_qos_read(struct
36162 char buf[256 * NUM_IWL_RXON_CTX];
36163 const size_t bufsz = sizeof(buf);
36164
36165+ pax_track_stack();
36166+
36167 for_each_context(priv, ctx) {
36168 pos += scnprintf(buf + pos, bufsz - pos, "context %d:\n",
36169 ctx->ctxid);
36170diff -urNp linux-2.6.39/drivers/net/wireless/iwlwifi/iwl-debug.h linux-2.6.39/drivers/net/wireless/iwlwifi/iwl-debug.h
36171--- linux-2.6.39/drivers/net/wireless/iwlwifi/iwl-debug.h 2011-05-19 00:06:34.000000000 -0400
36172+++ linux-2.6.39/drivers/net/wireless/iwlwifi/iwl-debug.h 2011-05-22 19:36:32.000000000 -0400
36173@@ -68,8 +68,8 @@ do {
36174 } while (0)
36175
36176 #else
36177-#define IWL_DEBUG(__priv, level, fmt, args...)
36178-#define IWL_DEBUG_LIMIT(__priv, level, fmt, args...)
36179+#define IWL_DEBUG(__priv, level, fmt, args...) do {} while (0)
36180+#define IWL_DEBUG_LIMIT(__priv, level, fmt, args...) do {} while (0)
36181 static inline void iwl_print_hex_dump(struct iwl_priv *priv, int level,
36182 const void *p, u32 len)
36183 {}
36184diff -urNp linux-2.6.39/drivers/net/wireless/iwmc3200wifi/cfg80211.c linux-2.6.39/drivers/net/wireless/iwmc3200wifi/cfg80211.c
36185--- linux-2.6.39/drivers/net/wireless/iwmc3200wifi/cfg80211.c 2011-05-19 00:06:34.000000000 -0400
36186+++ linux-2.6.39/drivers/net/wireless/iwmc3200wifi/cfg80211.c 2011-05-22 19:36:32.000000000 -0400
36187@@ -763,7 +763,7 @@ static int iwm_cfg80211_flush_pmksa(stru
36188 }
36189
36190
36191-static struct cfg80211_ops iwm_cfg80211_ops = {
36192+static const struct cfg80211_ops iwm_cfg80211_ops = {
36193 .change_virtual_intf = iwm_cfg80211_change_iface,
36194 .add_key = iwm_cfg80211_add_key,
36195 .get_key = iwm_cfg80211_get_key,
36196diff -urNp linux-2.6.39/drivers/net/wireless/iwmc3200wifi/debugfs.c linux-2.6.39/drivers/net/wireless/iwmc3200wifi/debugfs.c
36197--- linux-2.6.39/drivers/net/wireless/iwmc3200wifi/debugfs.c 2011-05-19 00:06:34.000000000 -0400
36198+++ linux-2.6.39/drivers/net/wireless/iwmc3200wifi/debugfs.c 2011-05-22 19:36:32.000000000 -0400
36199@@ -327,6 +327,8 @@ static ssize_t iwm_debugfs_fw_err_read(s
36200 int buf_len = 512;
36201 size_t len = 0;
36202
36203+ pax_track_stack();
36204+
36205 if (*ppos != 0)
36206 return 0;
36207 if (count < sizeof(buf))
36208diff -urNp linux-2.6.39/drivers/net/wireless/libertas/cfg.c linux-2.6.39/drivers/net/wireless/libertas/cfg.c
36209--- linux-2.6.39/drivers/net/wireless/libertas/cfg.c 2011-05-19 00:06:34.000000000 -0400
36210+++ linux-2.6.39/drivers/net/wireless/libertas/cfg.c 2011-05-22 19:36:32.000000000 -0400
36211@@ -2003,7 +2003,7 @@ static int lbs_leave_ibss(struct wiphy *
36212 * Initialization
36213 */
36214
36215-static struct cfg80211_ops lbs_cfg80211_ops = {
36216+static const struct cfg80211_ops lbs_cfg80211_ops = {
36217 .set_channel = lbs_cfg_set_channel,
36218 .scan = lbs_cfg_scan,
36219 .connect = lbs_cfg_connect,
36220diff -urNp linux-2.6.39/drivers/net/wireless/libertas/debugfs.c linux-2.6.39/drivers/net/wireless/libertas/debugfs.c
36221--- linux-2.6.39/drivers/net/wireless/libertas/debugfs.c 2011-05-19 00:06:34.000000000 -0400
36222+++ linux-2.6.39/drivers/net/wireless/libertas/debugfs.c 2011-05-22 19:36:32.000000000 -0400
36223@@ -702,7 +702,7 @@ out_unlock:
36224 struct lbs_debugfs_files {
36225 const char *name;
36226 int perm;
36227- struct file_operations fops;
36228+ const struct file_operations fops;
36229 };
36230
36231 static const struct lbs_debugfs_files debugfs_files[] = {
36232diff -urNp linux-2.6.39/drivers/net/wireless/rndis_wlan.c linux-2.6.39/drivers/net/wireless/rndis_wlan.c
36233--- linux-2.6.39/drivers/net/wireless/rndis_wlan.c 2011-05-19 00:06:34.000000000 -0400
36234+++ linux-2.6.39/drivers/net/wireless/rndis_wlan.c 2011-05-22 19:36:32.000000000 -0400
36235@@ -1277,7 +1277,7 @@ static int set_rts_threshold(struct usbn
36236
36237 netdev_dbg(usbdev->net, "%s(): %i\n", __func__, rts_threshold);
36238
36239- if (rts_threshold < 0 || rts_threshold > 2347)
36240+ if (rts_threshold > 2347)
36241 rts_threshold = 2347;
36242
36243 tmp = cpu_to_le32(rts_threshold);
36244diff -urNp linux-2.6.39/drivers/net/wireless/rtlwifi/pci.c linux-2.6.39/drivers/net/wireless/rtlwifi/pci.c
36245--- linux-2.6.39/drivers/net/wireless/rtlwifi/pci.c 2011-05-19 00:06:34.000000000 -0400
36246+++ linux-2.6.39/drivers/net/wireless/rtlwifi/pci.c 2011-05-22 19:36:32.000000000 -0400
36247@@ -1869,7 +1869,7 @@ int rtl_pci_resume(struct pci_dev *pdev)
36248 }
36249 EXPORT_SYMBOL(rtl_pci_resume);
36250
36251-struct rtl_intf_ops rtl_pci_ops = {
36252+const struct rtl_intf_ops rtl_pci_ops = {
36253 .adapter_start = rtl_pci_start,
36254 .adapter_stop = rtl_pci_stop,
36255 .adapter_tx = rtl_pci_tx,
36256diff -urNp linux-2.6.39/drivers/net/wireless/rtlwifi/pci.h linux-2.6.39/drivers/net/wireless/rtlwifi/pci.h
36257--- linux-2.6.39/drivers/net/wireless/rtlwifi/pci.h 2011-05-19 00:06:34.000000000 -0400
36258+++ linux-2.6.39/drivers/net/wireless/rtlwifi/pci.h 2011-05-22 19:36:32.000000000 -0400
36259@@ -234,7 +234,7 @@ struct rtl_pci_priv {
36260
36261 int rtl_pci_reset_trx_ring(struct ieee80211_hw *hw);
36262
36263-extern struct rtl_intf_ops rtl_pci_ops;
36264+extern const struct rtl_intf_ops rtl_pci_ops;
36265
36266 int __devinit rtl_pci_probe(struct pci_dev *pdev,
36267 const struct pci_device_id *id);
36268diff -urNp linux-2.6.39/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c linux-2.6.39/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c
36269--- linux-2.6.39/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c 2011-05-19 00:06:34.000000000 -0400
36270+++ linux-2.6.39/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c 2011-05-22 19:36:32.000000000 -0400
36271@@ -827,6 +827,8 @@ static bool _rtl92c_phy_sw_chnl_step_by_
36272 u8 rfpath;
36273 u8 num_total_rfpath = rtlphy->num_total_rfpath;
36274
36275+ pax_track_stack();
36276+
36277 precommoncmdcnt = 0;
36278 _rtl92c_phy_set_sw_chnl_cmdarray(precommoncmd, precommoncmdcnt++,
36279 MAX_PRECMD_CNT,
36280diff -urNp linux-2.6.39/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c linux-2.6.39/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
36281--- linux-2.6.39/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c 2011-05-19 00:06:34.000000000 -0400
36282+++ linux-2.6.39/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c 2011-05-22 19:36:32.000000000 -0400
36283@@ -96,7 +96,7 @@ void rtl92c_deinit_sw_vars(struct ieee80
36284 }
36285 }
36286
36287-static struct rtl_hal_ops rtl8192ce_hal_ops = {
36288+static const struct rtl_hal_ops rtl8192ce_hal_ops = {
36289 .init_sw_vars = rtl92c_init_sw_vars,
36290 .deinit_sw_vars = rtl92c_deinit_sw_vars,
36291 .read_eeprom_info = rtl92ce_read_eeprom_info,
36292@@ -151,7 +151,7 @@ static struct rtl_mod_params rtl92ce_mod
36293 .sw_crypto = 0,
36294 };
36295
36296-static struct rtl_hal_cfg rtl92ce_hal_cfg = {
36297+static const struct rtl_hal_cfg rtl92ce_hal_cfg = {
36298 .name = "rtl92c_pci",
36299 .fw_name = "rtlwifi/rtl8192cfw.bin",
36300 .ops = &rtl8192ce_hal_ops,
36301diff -urNp linux-2.6.39/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c linux-2.6.39/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
36302--- linux-2.6.39/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c 2011-05-19 00:06:34.000000000 -0400
36303+++ linux-2.6.39/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c 2011-05-22 19:36:32.000000000 -0400
36304@@ -77,7 +77,7 @@ static void rtl92cu_deinit_sw_vars(struc
36305 }
36306 }
36307
36308-static struct rtl_hal_ops rtl8192cu_hal_ops = {
36309+static const struct rtl_hal_ops rtl8192cu_hal_ops = {
36310 .init_sw_vars = rtl92cu_init_sw_vars,
36311 .deinit_sw_vars = rtl92cu_deinit_sw_vars,
36312 .read_chip_version = rtl92c_read_chip_version,
36313@@ -147,7 +147,7 @@ static struct rtl_hal_usbint_cfg rtl92cu
36314 .usb_mq_to_hwq = rtl8192cu_mq_to_hwq,
36315 };
36316
36317-static struct rtl_hal_cfg rtl92cu_hal_cfg = {
36318+static const struct rtl_hal_cfg rtl92cu_hal_cfg = {
36319 .name = "rtl92c_usb",
36320 .fw_name = "rtlwifi/rtl8192cufw.bin",
36321 .ops = &rtl8192cu_hal_ops,
36322diff -urNp linux-2.6.39/drivers/net/wireless/rtlwifi/usb.c linux-2.6.39/drivers/net/wireless/rtlwifi/usb.c
36323--- linux-2.6.39/drivers/net/wireless/rtlwifi/usb.c 2011-05-19 00:06:34.000000000 -0400
36324+++ linux-2.6.39/drivers/net/wireless/rtlwifi/usb.c 2011-05-22 19:36:32.000000000 -0400
36325@@ -913,7 +913,7 @@ static bool rtl_usb_tx_chk_waitq_insert(
36326 return false;
36327 }
36328
36329-static struct rtl_intf_ops rtl_usb_ops = {
36330+static const struct rtl_intf_ops rtl_usb_ops = {
36331 .adapter_start = rtl_usb_start,
36332 .adapter_stop = rtl_usb_stop,
36333 .adapter_tx = rtl_usb_tx,
36334diff -urNp linux-2.6.39/drivers/net/wireless/rtlwifi/wifi.h linux-2.6.39/drivers/net/wireless/rtlwifi/wifi.h
36335--- linux-2.6.39/drivers/net/wireless/rtlwifi/wifi.h 2011-05-19 00:06:34.000000000 -0400
36336+++ linux-2.6.39/drivers/net/wireless/rtlwifi/wifi.h 2011-05-22 19:36:32.000000000 -0400
36337@@ -1447,7 +1447,7 @@ struct rtl_hal_cfg {
36338 u8 bar_id;
36339 char *name;
36340 char *fw_name;
36341- struct rtl_hal_ops *ops;
36342+ const struct rtl_hal_ops *ops;
36343 struct rtl_mod_params *mod_params;
36344 struct rtl_hal_usbint_cfg *usb_interface_cfg;
36345
36346@@ -1533,7 +1533,7 @@ struct rtl_priv {
36347 *intf_ops : for diff interrface usb/pcie
36348 */
36349 struct rtl_hal_cfg *cfg;
36350- struct rtl_intf_ops *intf_ops;
36351+ const struct rtl_intf_ops *intf_ops;
36352
36353 /*this var will be set by set_bit,
36354 and was used to indicate status of
36355diff -urNp linux-2.6.39/drivers/net/wireless/wl12xx/spi.c linux-2.6.39/drivers/net/wireless/wl12xx/spi.c
36356--- linux-2.6.39/drivers/net/wireless/wl12xx/spi.c 2011-05-19 00:06:34.000000000 -0400
36357+++ linux-2.6.39/drivers/net/wireless/wl12xx/spi.c 2011-05-22 19:36:32.000000000 -0400
36358@@ -280,6 +280,8 @@ static void wl1271_spi_raw_write(struct
36359 u32 chunk_len;
36360 int i;
36361
36362+ pax_track_stack();
36363+
36364 WARN_ON(len > WL1271_AGGR_BUFFER_SIZE);
36365
36366 spi_message_init(&m);
36367diff -urNp linux-2.6.39/drivers/net/xen-netback/interface.c linux-2.6.39/drivers/net/xen-netback/interface.c
36368--- linux-2.6.39/drivers/net/xen-netback/interface.c 2011-05-19 00:06:34.000000000 -0400
36369+++ linux-2.6.39/drivers/net/xen-netback/interface.c 2011-05-22 19:36:32.000000000 -0400
36370@@ -273,7 +273,7 @@ static void xenvif_get_strings(struct ne
36371 }
36372 }
36373
36374-static struct ethtool_ops xenvif_ethtool_ops = {
36375+static const struct ethtool_ops xenvif_ethtool_ops = {
36376 .get_tx_csum = ethtool_op_get_tx_csum,
36377 .set_tx_csum = xenvif_set_tx_csum,
36378 .get_sg = ethtool_op_get_sg,
36379diff -urNp linux-2.6.39/drivers/net/xilinx_emaclite.c linux-2.6.39/drivers/net/xilinx_emaclite.c
36380--- linux-2.6.39/drivers/net/xilinx_emaclite.c 2011-05-19 00:06:34.000000000 -0400
36381+++ linux-2.6.39/drivers/net/xilinx_emaclite.c 2011-05-22 19:36:32.000000000 -0400
36382@@ -1085,7 +1085,7 @@ static bool get_bool(struct platform_dev
36383 }
36384 }
36385
36386-static struct net_device_ops xemaclite_netdev_ops;
36387+static const struct net_device_ops xemaclite_netdev_ops;
36388
36389 /**
36390 * xemaclite_of_probe - Probe method for the Emaclite device.
36391@@ -1264,7 +1264,7 @@ xemaclite_poll_controller(struct net_dev
36392 }
36393 #endif
36394
36395-static struct net_device_ops xemaclite_netdev_ops = {
36396+static const struct net_device_ops xemaclite_netdev_ops = {
36397 .ndo_open = xemaclite_open,
36398 .ndo_stop = xemaclite_close,
36399 .ndo_start_xmit = xemaclite_send,
36400diff -urNp linux-2.6.39/drivers/nfc/pn544.c linux-2.6.39/drivers/nfc/pn544.c
36401--- linux-2.6.39/drivers/nfc/pn544.c 2011-05-19 00:06:34.000000000 -0400
36402+++ linux-2.6.39/drivers/nfc/pn544.c 2011-05-22 19:36:32.000000000 -0400
36403@@ -89,7 +89,7 @@ static ssize_t pn544_test(struct device
36404
36405 static int pn544_enable(struct pn544_info *info, int mode)
36406 {
36407- struct pn544_nfc_platform_data *pdata;
36408+ const struct pn544_nfc_platform_data *pdata;
36409 struct i2c_client *client = info->i2c_dev;
36410
36411 int r;
36412@@ -118,7 +118,7 @@ static int pn544_enable(struct pn544_inf
36413
36414 static void pn544_disable(struct pn544_info *info)
36415 {
36416- struct pn544_nfc_platform_data *pdata;
36417+ const struct pn544_nfc_platform_data *pdata;
36418 struct i2c_client *client = info->i2c_dev;
36419
36420 pdata = client->dev.platform_data;
36421@@ -509,7 +509,7 @@ static long pn544_ioctl(struct file *fil
36422 struct pn544_info *info = container_of(file->private_data,
36423 struct pn544_info, miscdev);
36424 struct i2c_client *client = info->i2c_dev;
36425- struct pn544_nfc_platform_data *pdata;
36426+ const struct pn544_nfc_platform_data *pdata;
36427 unsigned int val;
36428 int r = 0;
36429
36430@@ -715,7 +715,7 @@ static int __devinit pn544_probe(struct
36431 const struct i2c_device_id *id)
36432 {
36433 struct pn544_info *info;
36434- struct pn544_nfc_platform_data *pdata;
36435+ const struct pn544_nfc_platform_data *pdata;
36436 int r = 0;
36437
36438 dev_dbg(&client->dev, "%s\n", __func__);
36439diff -urNp linux-2.6.39/drivers/of/pdt.c linux-2.6.39/drivers/of/pdt.c
36440--- linux-2.6.39/drivers/of/pdt.c 2011-05-19 00:06:34.000000000 -0400
36441+++ linux-2.6.39/drivers/of/pdt.c 2011-05-22 19:36:32.000000000 -0400
36442@@ -24,7 +24,7 @@
36443 #include <linux/of_pdt.h>
36444 #include <asm/prom.h>
36445
36446-static struct of_pdt_ops *of_pdt_prom_ops __initdata;
36447+static const struct of_pdt_ops *of_pdt_prom_ops;
36448
36449 void __initdata (*of_pdt_build_more)(struct device_node *dp,
36450 struct device_node ***nextp);
36451diff -urNp linux-2.6.39/drivers/oprofile/buffer_sync.c linux-2.6.39/drivers/oprofile/buffer_sync.c
36452--- linux-2.6.39/drivers/oprofile/buffer_sync.c 2011-05-19 00:06:34.000000000 -0400
36453+++ linux-2.6.39/drivers/oprofile/buffer_sync.c 2011-05-22 19:36:32.000000000 -0400
36454@@ -342,7 +342,7 @@ static void add_data(struct op_entry *en
36455 if (cookie == NO_COOKIE)
36456 offset = pc;
36457 if (cookie == INVALID_COOKIE) {
36458- atomic_inc(&oprofile_stats.sample_lost_no_mapping);
36459+ atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mapping);
36460 offset = pc;
36461 }
36462 if (cookie != last_cookie) {
36463@@ -386,14 +386,14 @@ add_sample(struct mm_struct *mm, struct
36464 /* add userspace sample */
36465
36466 if (!mm) {
36467- atomic_inc(&oprofile_stats.sample_lost_no_mm);
36468+ atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mm);
36469 return 0;
36470 }
36471
36472 cookie = lookup_dcookie(mm, s->eip, &offset);
36473
36474 if (cookie == INVALID_COOKIE) {
36475- atomic_inc(&oprofile_stats.sample_lost_no_mapping);
36476+ atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mapping);
36477 return 0;
36478 }
36479
36480@@ -562,7 +562,7 @@ void sync_buffer(int cpu)
36481 /* ignore backtraces if failed to add a sample */
36482 if (state == sb_bt_start) {
36483 state = sb_bt_ignore;
36484- atomic_inc(&oprofile_stats.bt_lost_no_mapping);
36485+ atomic_inc_unchecked(&oprofile_stats.bt_lost_no_mapping);
36486 }
36487 }
36488 release_mm(mm);
36489diff -urNp linux-2.6.39/drivers/oprofile/event_buffer.c linux-2.6.39/drivers/oprofile/event_buffer.c
36490--- linux-2.6.39/drivers/oprofile/event_buffer.c 2011-05-19 00:06:34.000000000 -0400
36491+++ linux-2.6.39/drivers/oprofile/event_buffer.c 2011-05-22 19:36:32.000000000 -0400
36492@@ -53,7 +53,7 @@ void add_event_entry(unsigned long value
36493 }
36494
36495 if (buffer_pos == buffer_size) {
36496- atomic_inc(&oprofile_stats.event_lost_overflow);
36497+ atomic_inc_unchecked(&oprofile_stats.event_lost_overflow);
36498 return;
36499 }
36500
36501diff -urNp linux-2.6.39/drivers/oprofile/oprof.c linux-2.6.39/drivers/oprofile/oprof.c
36502--- linux-2.6.39/drivers/oprofile/oprof.c 2011-05-19 00:06:34.000000000 -0400
36503+++ linux-2.6.39/drivers/oprofile/oprof.c 2011-05-22 19:36:32.000000000 -0400
36504@@ -110,7 +110,7 @@ static void switch_worker(struct work_st
36505 if (oprofile_ops.switch_events())
36506 return;
36507
36508- atomic_inc(&oprofile_stats.multiplex_counter);
36509+ atomic_inc_unchecked(&oprofile_stats.multiplex_counter);
36510 start_switch_worker();
36511 }
36512
36513diff -urNp linux-2.6.39/drivers/oprofile/oprofilefs.c linux-2.6.39/drivers/oprofile/oprofilefs.c
36514--- linux-2.6.39/drivers/oprofile/oprofilefs.c 2011-05-19 00:06:34.000000000 -0400
36515+++ linux-2.6.39/drivers/oprofile/oprofilefs.c 2011-05-22 19:36:32.000000000 -0400
36516@@ -186,7 +186,7 @@ static const struct file_operations atom
36517
36518
36519 int oprofilefs_create_ro_atomic(struct super_block *sb, struct dentry *root,
36520- char const *name, atomic_t *val)
36521+ char const *name, atomic_unchecked_t *val)
36522 {
36523 return __oprofilefs_create_file(sb, root, name,
36524 &atomic_ro_fops, 0444, val);
36525diff -urNp linux-2.6.39/drivers/oprofile/oprofile_stats.c linux-2.6.39/drivers/oprofile/oprofile_stats.c
36526--- linux-2.6.39/drivers/oprofile/oprofile_stats.c 2011-05-19 00:06:34.000000000 -0400
36527+++ linux-2.6.39/drivers/oprofile/oprofile_stats.c 2011-05-22 19:36:32.000000000 -0400
36528@@ -30,11 +30,11 @@ void oprofile_reset_stats(void)
36529 cpu_buf->sample_invalid_eip = 0;
36530 }
36531
36532- atomic_set(&oprofile_stats.sample_lost_no_mm, 0);
36533- atomic_set(&oprofile_stats.sample_lost_no_mapping, 0);
36534- atomic_set(&oprofile_stats.event_lost_overflow, 0);
36535- atomic_set(&oprofile_stats.bt_lost_no_mapping, 0);
36536- atomic_set(&oprofile_stats.multiplex_counter, 0);
36537+ atomic_set_unchecked(&oprofile_stats.sample_lost_no_mm, 0);
36538+ atomic_set_unchecked(&oprofile_stats.sample_lost_no_mapping, 0);
36539+ atomic_set_unchecked(&oprofile_stats.event_lost_overflow, 0);
36540+ atomic_set_unchecked(&oprofile_stats.bt_lost_no_mapping, 0);
36541+ atomic_set_unchecked(&oprofile_stats.multiplex_counter, 0);
36542 }
36543
36544
36545diff -urNp linux-2.6.39/drivers/oprofile/oprofile_stats.h linux-2.6.39/drivers/oprofile/oprofile_stats.h
36546--- linux-2.6.39/drivers/oprofile/oprofile_stats.h 2011-05-19 00:06:34.000000000 -0400
36547+++ linux-2.6.39/drivers/oprofile/oprofile_stats.h 2011-05-22 19:36:32.000000000 -0400
36548@@ -13,11 +13,11 @@
36549 #include <asm/atomic.h>
36550
36551 struct oprofile_stat_struct {
36552- atomic_t sample_lost_no_mm;
36553- atomic_t sample_lost_no_mapping;
36554- atomic_t bt_lost_no_mapping;
36555- atomic_t event_lost_overflow;
36556- atomic_t multiplex_counter;
36557+ atomic_unchecked_t sample_lost_no_mm;
36558+ atomic_unchecked_t sample_lost_no_mapping;
36559+ atomic_unchecked_t bt_lost_no_mapping;
36560+ atomic_unchecked_t event_lost_overflow;
36561+ atomic_unchecked_t multiplex_counter;
36562 };
36563
36564 extern struct oprofile_stat_struct oprofile_stats;
36565diff -urNp linux-2.6.39/drivers/parisc/dino.c linux-2.6.39/drivers/parisc/dino.c
36566--- linux-2.6.39/drivers/parisc/dino.c 2011-05-19 00:06:34.000000000 -0400
36567+++ linux-2.6.39/drivers/parisc/dino.c 2011-05-22 19:36:32.000000000 -0400
36568@@ -238,7 +238,7 @@ static int dino_cfg_write(struct pci_bus
36569 return 0;
36570 }
36571
36572-static struct pci_ops dino_cfg_ops = {
36573+static const struct pci_ops dino_cfg_ops = {
36574 .read = dino_cfg_read,
36575 .write = dino_cfg_write,
36576 };
36577diff -urNp linux-2.6.39/drivers/parisc/lba_pci.c linux-2.6.39/drivers/parisc/lba_pci.c
36578--- linux-2.6.39/drivers/parisc/lba_pci.c 2011-05-19 00:06:34.000000000 -0400
36579+++ linux-2.6.39/drivers/parisc/lba_pci.c 2011-05-22 19:36:32.000000000 -0400
36580@@ -468,7 +468,7 @@ static int elroy_cfg_write(struct pci_bu
36581 }
36582
36583
36584-static struct pci_ops elroy_cfg_ops = {
36585+static const struct pci_ops elroy_cfg_ops = {
36586 .read = elroy_cfg_read,
36587 .write = elroy_cfg_write,
36588 };
36589@@ -541,7 +541,7 @@ static int mercury_cfg_write(struct pci_
36590 return 0;
36591 }
36592
36593-static struct pci_ops mercury_cfg_ops = {
36594+static const struct pci_ops mercury_cfg_ops = {
36595 .read = mercury_cfg_read,
36596 .write = mercury_cfg_write,
36597 };
36598@@ -1405,7 +1405,7 @@ lba_driver_probe(struct parisc_device *d
36599 {
36600 struct lba_device *lba_dev;
36601 struct pci_bus *lba_bus;
36602- struct pci_ops *cfg_ops;
36603+ const struct pci_ops *cfg_ops;
36604 u32 func_class;
36605 void *tmp_obj;
36606 char *version;
36607diff -urNp linux-2.6.39/drivers/parport/procfs.c linux-2.6.39/drivers/parport/procfs.c
36608--- linux-2.6.39/drivers/parport/procfs.c 2011-05-19 00:06:34.000000000 -0400
36609+++ linux-2.6.39/drivers/parport/procfs.c 2011-05-22 19:36:32.000000000 -0400
36610@@ -64,7 +64,7 @@ static int do_active_device(ctl_table *t
36611
36612 *ppos += len;
36613
36614- return copy_to_user(result, buffer, len) ? -EFAULT : 0;
36615+ return (len > sizeof buffer || copy_to_user(result, buffer, len)) ? -EFAULT : 0;
36616 }
36617
36618 #ifdef CONFIG_PARPORT_1284
36619@@ -106,7 +106,7 @@ static int do_autoprobe(ctl_table *table
36620
36621 *ppos += len;
36622
36623- return copy_to_user (result, buffer, len) ? -EFAULT : 0;
36624+ return (len > sizeof buffer || copy_to_user (result, buffer, len)) ? -EFAULT : 0;
36625 }
36626 #endif /* IEEE1284.3 support. */
36627
36628diff -urNp linux-2.6.39/drivers/pci/access.c linux-2.6.39/drivers/pci/access.c
36629--- linux-2.6.39/drivers/pci/access.c 2011-05-19 00:06:34.000000000 -0400
36630+++ linux-2.6.39/drivers/pci/access.c 2011-05-22 19:36:32.000000000 -0400
36631@@ -74,9 +74,9 @@ EXPORT_SYMBOL(pci_bus_write_config_dword
36632 *
36633 * Return previous raw operations
36634 */
36635-struct pci_ops *pci_bus_set_ops(struct pci_bus *bus, struct pci_ops *ops)
36636+const struct pci_ops *pci_bus_set_ops(struct pci_bus *bus, const struct pci_ops *ops)
36637 {
36638- struct pci_ops *old_ops;
36639+ const struct pci_ops *old_ops;
36640 unsigned long flags;
36641
36642 raw_spin_lock_irqsave(&pci_lock, flags);
36643diff -urNp linux-2.6.39/drivers/pci/hotplug/acpiphp_glue.c linux-2.6.39/drivers/pci/hotplug/acpiphp_glue.c
36644--- linux-2.6.39/drivers/pci/hotplug/acpiphp_glue.c 2011-05-19 00:06:34.000000000 -0400
36645+++ linux-2.6.39/drivers/pci/hotplug/acpiphp_glue.c 2011-05-22 19:36:32.000000000 -0400
36646@@ -110,7 +110,7 @@ static int post_dock_fixups(struct notif
36647 }
36648
36649
36650-static struct acpi_dock_ops acpiphp_dock_ops = {
36651+static const struct acpi_dock_ops acpiphp_dock_ops = {
36652 .handler = handle_hotplug_event_func,
36653 };
36654
36655diff -urNp linux-2.6.39/drivers/pci/hotplug/cpqphp_nvram.c linux-2.6.39/drivers/pci/hotplug/cpqphp_nvram.c
36656--- linux-2.6.39/drivers/pci/hotplug/cpqphp_nvram.c 2011-05-19 00:06:34.000000000 -0400
36657+++ linux-2.6.39/drivers/pci/hotplug/cpqphp_nvram.c 2011-05-22 19:36:32.000000000 -0400
36658@@ -428,9 +428,13 @@ static u32 store_HRT (void __iomem *rom_
36659
36660 void compaq_nvram_init (void __iomem *rom_start)
36661 {
36662+
36663+#ifndef CONFIG_PAX_KERNEXEC
36664 if (rom_start) {
36665 compaq_int15_entry_point = (rom_start + ROM_INT15_PHY_ADDR - ROM_PHY_ADDR);
36666 }
36667+#endif
36668+
36669 dbg("int15 entry = %p\n", compaq_int15_entry_point);
36670
36671 /* initialize our int15 lock */
36672diff -urNp linux-2.6.39/drivers/pci/hotplug/shpchp.h linux-2.6.39/drivers/pci/hotplug/shpchp.h
36673--- linux-2.6.39/drivers/pci/hotplug/shpchp.h 2011-05-19 00:06:34.000000000 -0400
36674+++ linux-2.6.39/drivers/pci/hotplug/shpchp.h 2011-05-22 19:36:32.000000000 -0400
36675@@ -86,7 +86,7 @@ struct slot {
36676 u8 presence_save;
36677 u8 pwr_save;
36678 struct controller *ctrl;
36679- struct hpc_ops *hpc_ops;
36680+ const struct hpc_ops *hpc_ops;
36681 struct hotplug_slot *hotplug_slot;
36682 struct list_head slot_list;
36683 struct delayed_work work; /* work for button event */
36684@@ -107,7 +107,7 @@ struct controller {
36685 int slot_num_inc; /* 1 or -1 */
36686 struct pci_dev *pci_dev;
36687 struct list_head slot_list;
36688- struct hpc_ops *hpc_ops;
36689+ const struct hpc_ops *hpc_ops;
36690 wait_queue_head_t queue; /* sleep & wake process */
36691 u8 slot_device_offset;
36692 u32 pcix_misc2_reg; /* for amd pogo errata */
36693diff -urNp linux-2.6.39/drivers/pci/hotplug/shpchp_hpc.c linux-2.6.39/drivers/pci/hotplug/shpchp_hpc.c
36694--- linux-2.6.39/drivers/pci/hotplug/shpchp_hpc.c 2011-05-19 00:06:34.000000000 -0400
36695+++ linux-2.6.39/drivers/pci/hotplug/shpchp_hpc.c 2011-05-22 19:36:32.000000000 -0400
36696@@ -910,7 +910,7 @@ static int shpc_get_max_bus_speed(struct
36697 return retval;
36698 }
36699
36700-static struct hpc_ops shpchp_hpc_ops = {
36701+static const struct hpc_ops shpchp_hpc_ops = {
36702 .power_on_slot = hpc_power_on_slot,
36703 .slot_enable = hpc_slot_enable,
36704 .slot_disable = hpc_slot_disable,
36705diff -urNp linux-2.6.39/drivers/pci/intel-iommu.c linux-2.6.39/drivers/pci/intel-iommu.c
36706--- linux-2.6.39/drivers/pci/intel-iommu.c 2011-05-19 00:06:34.000000000 -0400
36707+++ linux-2.6.39/drivers/pci/intel-iommu.c 2011-05-22 19:36:32.000000000 -0400
36708@@ -391,7 +391,7 @@ static int intel_iommu_strict;
36709 static DEFINE_SPINLOCK(device_domain_lock);
36710 static LIST_HEAD(device_domain_list);
36711
36712-static struct iommu_ops intel_iommu_ops;
36713+static const struct iommu_ops intel_iommu_ops;
36714
36715 static int __init intel_iommu_setup(char *str)
36716 {
36717@@ -2945,7 +2945,7 @@ static int intel_mapping_error(struct de
36718 return !dma_addr;
36719 }
36720
36721-struct dma_map_ops intel_dma_ops = {
36722+const struct dma_map_ops intel_dma_ops = {
36723 .alloc_coherent = intel_alloc_coherent,
36724 .free_coherent = intel_free_coherent,
36725 .map_sg = intel_map_sg,
36726@@ -3739,7 +3739,7 @@ static int intel_iommu_domain_has_cap(st
36727 return 0;
36728 }
36729
36730-static struct iommu_ops intel_iommu_ops = {
36731+static const struct iommu_ops intel_iommu_ops = {
36732 .domain_init = intel_iommu_domain_init,
36733 .domain_destroy = intel_iommu_domain_destroy,
36734 .attach_dev = intel_iommu_attach_device,
36735diff -urNp linux-2.6.39/drivers/pci/pci-acpi.c linux-2.6.39/drivers/pci/pci-acpi.c
36736--- linux-2.6.39/drivers/pci/pci-acpi.c 2011-05-19 00:06:34.000000000 -0400
36737+++ linux-2.6.39/drivers/pci/pci-acpi.c 2011-05-22 19:36:32.000000000 -0400
36738@@ -332,7 +332,7 @@ static int acpi_pci_run_wake(struct pci_
36739 return 0;
36740 }
36741
36742-static struct pci_platform_pm_ops acpi_pci_platform_pm = {
36743+static const struct pci_platform_pm_ops acpi_pci_platform_pm = {
36744 .is_manageable = acpi_pci_power_manageable,
36745 .set_state = acpi_pci_set_power_state,
36746 .choose_state = acpi_pci_choose_state,
36747diff -urNp linux-2.6.39/drivers/pci/pci.c linux-2.6.39/drivers/pci/pci.c
36748--- linux-2.6.39/drivers/pci/pci.c 2011-05-19 00:06:34.000000000 -0400
36749+++ linux-2.6.39/drivers/pci/pci.c 2011-05-22 19:36:32.000000000 -0400
36750@@ -480,9 +480,9 @@ pci_restore_bars(struct pci_dev *dev)
36751 pci_update_resource(dev, i);
36752 }
36753
36754-static struct pci_platform_pm_ops *pci_platform_pm;
36755+static const struct pci_platform_pm_ops *pci_platform_pm;
36756
36757-int pci_set_platform_pm(struct pci_platform_pm_ops *ops)
36758+int pci_set_platform_pm(const struct pci_platform_pm_ops *ops)
36759 {
36760 if (!ops->is_manageable || !ops->set_state || !ops->choose_state
36761 || !ops->sleep_wake || !ops->can_wakeup)
36762diff -urNp linux-2.6.39/drivers/pci/pcie/aer/aerdrv_core.c linux-2.6.39/drivers/pci/pcie/aer/aerdrv_core.c
36763--- linux-2.6.39/drivers/pci/pcie/aer/aerdrv_core.c 2011-05-19 00:06:34.000000000 -0400
36764+++ linux-2.6.39/drivers/pci/pcie/aer/aerdrv_core.c 2011-05-22 19:36:32.000000000 -0400
36765@@ -239,7 +239,7 @@ static bool find_source_device(struct pc
36766 static int report_error_detected(struct pci_dev *dev, void *data)
36767 {
36768 pci_ers_result_t vote;
36769- struct pci_error_handlers *err_handler;
36770+ const struct pci_error_handlers *err_handler;
36771 struct aer_broadcast_data *result_data;
36772 result_data = (struct aer_broadcast_data *) data;
36773
36774@@ -273,7 +273,7 @@ static int report_error_detected(struct
36775 static int report_mmio_enabled(struct pci_dev *dev, void *data)
36776 {
36777 pci_ers_result_t vote;
36778- struct pci_error_handlers *err_handler;
36779+ const struct pci_error_handlers *err_handler;
36780 struct aer_broadcast_data *result_data;
36781 result_data = (struct aer_broadcast_data *) data;
36782
36783@@ -291,7 +291,7 @@ static int report_mmio_enabled(struct pc
36784 static int report_slot_reset(struct pci_dev *dev, void *data)
36785 {
36786 pci_ers_result_t vote;
36787- struct pci_error_handlers *err_handler;
36788+ const struct pci_error_handlers *err_handler;
36789 struct aer_broadcast_data *result_data;
36790 result_data = (struct aer_broadcast_data *) data;
36791
36792@@ -308,7 +308,7 @@ static int report_slot_reset(struct pci_
36793
36794 static int report_resume(struct pci_dev *dev, void *data)
36795 {
36796- struct pci_error_handlers *err_handler;
36797+ const struct pci_error_handlers *err_handler;
36798
36799 dev->error_state = pci_channel_io_normal;
36800
36801diff -urNp linux-2.6.39/drivers/pci/pcie/aer/aer_inject.c linux-2.6.39/drivers/pci/pcie/aer/aer_inject.c
36802--- linux-2.6.39/drivers/pci/pcie/aer/aer_inject.c 2011-05-19 00:06:34.000000000 -0400
36803+++ linux-2.6.39/drivers/pci/pcie/aer/aer_inject.c 2011-05-22 19:36:32.000000000 -0400
36804@@ -64,7 +64,7 @@ struct aer_error {
36805 struct pci_bus_ops {
36806 struct list_head list;
36807 struct pci_bus *bus;
36808- struct pci_ops *ops;
36809+ const struct pci_ops *ops;
36810 };
36811
36812 static LIST_HEAD(einjected);
36813@@ -110,7 +110,7 @@ static struct aer_error *__find_aer_erro
36814 }
36815
36816 /* inject_lock must be held before calling */
36817-static struct pci_ops *__find_pci_bus_ops(struct pci_bus *bus)
36818+static const struct pci_ops *__find_pci_bus_ops(struct pci_bus *bus)
36819 {
36820 struct pci_bus_ops *bus_ops;
36821
36822@@ -187,7 +187,7 @@ static int pci_read_aer(struct pci_bus *
36823 u32 *sim;
36824 struct aer_error *err;
36825 unsigned long flags;
36826- struct pci_ops *ops;
36827+ const struct pci_ops *ops;
36828 int domain;
36829
36830 spin_lock_irqsave(&inject_lock, flags);
36831@@ -219,7 +219,7 @@ int pci_write_aer(struct pci_bus *bus, u
36832 struct aer_error *err;
36833 unsigned long flags;
36834 int rw1cs;
36835- struct pci_ops *ops;
36836+ const struct pci_ops *ops;
36837 int domain;
36838
36839 spin_lock_irqsave(&inject_lock, flags);
36840@@ -254,7 +254,7 @@ static struct pci_ops pci_ops_aer = {
36841
36842 static void pci_bus_ops_init(struct pci_bus_ops *bus_ops,
36843 struct pci_bus *bus,
36844- struct pci_ops *ops)
36845+ const struct pci_ops *ops)
36846 {
36847 INIT_LIST_HEAD(&bus_ops->list);
36848 bus_ops->bus = bus;
36849@@ -263,7 +263,7 @@ static void pci_bus_ops_init(struct pci_
36850
36851 static int pci_bus_set_aer_ops(struct pci_bus *bus)
36852 {
36853- struct pci_ops *ops;
36854+ const struct pci_ops *ops;
36855 struct pci_bus_ops *bus_ops;
36856 unsigned long flags;
36857
36858diff -urNp linux-2.6.39/drivers/pci/pcie/aspm.c linux-2.6.39/drivers/pci/pcie/aspm.c
36859--- linux-2.6.39/drivers/pci/pcie/aspm.c 2011-05-19 00:06:34.000000000 -0400
36860+++ linux-2.6.39/drivers/pci/pcie/aspm.c 2011-05-22 19:36:32.000000000 -0400
36861@@ -27,9 +27,9 @@
36862 #define MODULE_PARAM_PREFIX "pcie_aspm."
36863
36864 /* Note: those are not register definitions */
36865-#define ASPM_STATE_L0S_UP (1) /* Upstream direction L0s state */
36866-#define ASPM_STATE_L0S_DW (2) /* Downstream direction L0s state */
36867-#define ASPM_STATE_L1 (4) /* L1 state */
36868+#define ASPM_STATE_L0S_UP (1U) /* Upstream direction L0s state */
36869+#define ASPM_STATE_L0S_DW (2U) /* Downstream direction L0s state */
36870+#define ASPM_STATE_L1 (4U) /* L1 state */
36871 #define ASPM_STATE_L0S (ASPM_STATE_L0S_UP | ASPM_STATE_L0S_DW)
36872 #define ASPM_STATE_ALL (ASPM_STATE_L0S | ASPM_STATE_L1)
36873
36874diff -urNp linux-2.6.39/drivers/pci/pci.h linux-2.6.39/drivers/pci/pci.h
36875--- linux-2.6.39/drivers/pci/pci.h 2011-05-19 00:06:34.000000000 -0400
36876+++ linux-2.6.39/drivers/pci/pci.h 2011-05-22 19:36:32.000000000 -0400
36877@@ -65,7 +65,7 @@ struct pci_platform_pm_ops {
36878 int (*run_wake)(struct pci_dev *dev, bool enable);
36879 };
36880
36881-extern int pci_set_platform_pm(struct pci_platform_pm_ops *ops);
36882+extern int pci_set_platform_pm(const struct pci_platform_pm_ops *ops);
36883 extern void pci_update_current_state(struct pci_dev *dev, pci_power_t state);
36884 extern void pci_disable_enabled_device(struct pci_dev *dev);
36885 extern int pci_finish_runtime_suspend(struct pci_dev *dev);
36886diff -urNp linux-2.6.39/drivers/pci/probe.c linux-2.6.39/drivers/pci/probe.c
36887--- linux-2.6.39/drivers/pci/probe.c 2011-05-19 00:06:34.000000000 -0400
36888+++ linux-2.6.39/drivers/pci/probe.c 2011-05-22 19:36:32.000000000 -0400
36889@@ -62,14 +62,14 @@ static ssize_t pci_bus_show_cpuaffinity(
36890 return ret;
36891 }
36892
36893-static ssize_t inline pci_bus_show_cpumaskaffinity(struct device *dev,
36894+static inline ssize_t pci_bus_show_cpumaskaffinity(struct device *dev,
36895 struct device_attribute *attr,
36896 char *buf)
36897 {
36898 return pci_bus_show_cpuaffinity(dev, 0, attr, buf);
36899 }
36900
36901-static ssize_t inline pci_bus_show_cpulistaffinity(struct device *dev,
36902+static inline ssize_t pci_bus_show_cpulistaffinity(struct device *dev,
36903 struct device_attribute *attr,
36904 char *buf)
36905 {
36906@@ -165,7 +165,7 @@ int __pci_read_base(struct pci_dev *dev,
36907 u32 l, sz, mask;
36908 u16 orig_cmd;
36909
36910- mask = type ? PCI_ROM_ADDRESS_MASK : ~0;
36911+ mask = type ? (u32)PCI_ROM_ADDRESS_MASK : ~0;
36912
36913 if (!dev->mmio_always_on) {
36914 pci_read_config_word(dev, PCI_COMMAND, &orig_cmd);
36915@@ -1407,7 +1407,7 @@ unsigned int __devinit pci_scan_child_bu
36916 }
36917
36918 struct pci_bus * pci_create_bus(struct device *parent,
36919- int bus, struct pci_ops *ops, void *sysdata)
36920+ int bus, const struct pci_ops *ops, void *sysdata)
36921 {
36922 int error;
36923 struct pci_bus *b, *b2;
36924@@ -1483,7 +1483,7 @@ err_out:
36925 }
36926
36927 struct pci_bus * __devinit pci_scan_bus_parented(struct device *parent,
36928- int bus, struct pci_ops *ops, void *sysdata)
36929+ int bus, const struct pci_ops *ops, void *sysdata)
36930 {
36931 struct pci_bus *b;
36932
36933diff -urNp linux-2.6.39/drivers/pci/proc.c linux-2.6.39/drivers/pci/proc.c
36934--- linux-2.6.39/drivers/pci/proc.c 2011-05-19 00:06:34.000000000 -0400
36935+++ linux-2.6.39/drivers/pci/proc.c 2011-05-22 19:41:37.000000000 -0400
36936@@ -476,7 +476,16 @@ static const struct file_operations proc
36937 static int __init pci_proc_init(void)
36938 {
36939 struct pci_dev *dev = NULL;
36940+
36941+#ifdef CONFIG_GRKERNSEC_PROC_ADD
36942+#ifdef CONFIG_GRKERNSEC_PROC_USER
36943+ proc_bus_pci_dir = proc_mkdir_mode("bus/pci", S_IRUSR | S_IXUSR, NULL);
36944+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
36945+ proc_bus_pci_dir = proc_mkdir_mode("bus/pci", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
36946+#endif
36947+#else
36948 proc_bus_pci_dir = proc_mkdir("bus/pci", NULL);
36949+#endif
36950 proc_create("devices", 0, proc_bus_pci_dir,
36951 &proc_bus_pci_dev_operations);
36952 proc_initialized = 1;
36953diff -urNp linux-2.6.39/drivers/pci/xen-pcifront.c linux-2.6.39/drivers/pci/xen-pcifront.c
36954--- linux-2.6.39/drivers/pci/xen-pcifront.c 2011-05-19 00:06:34.000000000 -0400
36955+++ linux-2.6.39/drivers/pci/xen-pcifront.c 2011-05-22 19:36:32.000000000 -0400
36956@@ -187,6 +187,8 @@ static int pcifront_bus_read(struct pci_
36957 struct pcifront_sd *sd = bus->sysdata;
36958 struct pcifront_device *pdev = pcifront_get_pdev(sd);
36959
36960+ pax_track_stack();
36961+
36962 if (verbose_request)
36963 dev_info(&pdev->xdev->dev,
36964 "read dev=%04x:%02x:%02x.%01x - offset %x size %d\n",
36965@@ -226,6 +228,8 @@ static int pcifront_bus_write(struct pci
36966 struct pcifront_sd *sd = bus->sysdata;
36967 struct pcifront_device *pdev = pcifront_get_pdev(sd);
36968
36969+ pax_track_stack();
36970+
36971 if (verbose_request)
36972 dev_info(&pdev->xdev->dev,
36973 "write dev=%04x:%02x:%02x.%01x - "
36974@@ -236,7 +240,7 @@ static int pcifront_bus_write(struct pci
36975 return errno_to_pcibios_err(do_pci_op(pdev, &op));
36976 }
36977
36978-struct pci_ops pcifront_bus_ops = {
36979+const struct pci_ops pcifront_bus_ops = {
36980 .read = pcifront_bus_read,
36981 .write = pcifront_bus_write,
36982 };
36983@@ -258,6 +262,8 @@ static int pci_frontend_enable_msix(stru
36984 struct pcifront_device *pdev = pcifront_get_pdev(sd);
36985 struct msi_desc *entry;
36986
36987+ pax_track_stack();
36988+
36989 if (nvec > SH_INFO_MAX_VEC) {
36990 dev_err(&dev->dev, "too much vector for pci frontend: %x."
36991 " Increase SH_INFO_MAX_VEC.\n", nvec);
36992@@ -309,6 +315,8 @@ static void pci_frontend_disable_msix(st
36993 struct pcifront_sd *sd = dev->bus->sysdata;
36994 struct pcifront_device *pdev = pcifront_get_pdev(sd);
36995
36996+ pax_track_stack();
36997+
36998 err = do_pci_op(pdev, &op);
36999
37000 /* What should do for error ? */
37001@@ -328,6 +336,8 @@ static int pci_frontend_enable_msi(struc
37002 struct pcifront_sd *sd = dev->bus->sysdata;
37003 struct pcifront_device *pdev = pcifront_get_pdev(sd);
37004
37005+ pax_track_stack();
37006+
37007 err = do_pci_op(pdev, &op);
37008 if (likely(!err)) {
37009 vector[0] = op.value;
37010@@ -368,7 +378,7 @@ static void pci_frontend_disable_msi(str
37011 printk(KERN_DEBUG "get fake response frombackend\n");
37012 }
37013
37014-static struct xen_pci_frontend_ops pci_frontend_ops = {
37015+static const struct xen_pci_frontend_ops pci_frontend_ops = {
37016 .enable_msi = pci_frontend_enable_msi,
37017 .disable_msi = pci_frontend_disable_msi,
37018 .enable_msix = pci_frontend_enable_msix,
37019diff -urNp linux-2.6.39/drivers/pcmcia/at91_cf.c linux-2.6.39/drivers/pcmcia/at91_cf.c
37020--- linux-2.6.39/drivers/pcmcia/at91_cf.c 2011-05-19 00:06:34.000000000 -0400
37021+++ linux-2.6.39/drivers/pcmcia/at91_cf.c 2011-05-22 19:36:32.000000000 -0400
37022@@ -203,7 +203,7 @@ at91_cf_set_mem_map(struct pcmcia_socket
37023 return 0;
37024 }
37025
37026-static struct pccard_operations at91_cf_ops = {
37027+static const struct pccard_operations at91_cf_ops = {
37028 .init = at91_cf_ss_init,
37029 .suspend = at91_cf_ss_suspend,
37030 .get_status = at91_cf_get_status,
37031diff -urNp linux-2.6.39/drivers/pcmcia/bfin_cf_pcmcia.c linux-2.6.39/drivers/pcmcia/bfin_cf_pcmcia.c
37032--- linux-2.6.39/drivers/pcmcia/bfin_cf_pcmcia.c 2011-05-19 00:06:34.000000000 -0400
37033+++ linux-2.6.39/drivers/pcmcia/bfin_cf_pcmcia.c 2011-05-22 19:36:32.000000000 -0400
37034@@ -184,7 +184,7 @@ bfin_cf_set_mem_map(struct pcmcia_socket
37035 return 0;
37036 }
37037
37038-static struct pccard_operations bfin_cf_ops = {
37039+static const struct pccard_operations bfin_cf_ops = {
37040 .init = bfin_cf_ss_init,
37041 .suspend = bfin_cf_ss_suspend,
37042 .get_status = bfin_cf_get_status,
37043diff -urNp linux-2.6.39/drivers/pcmcia/db1xxx_ss.c linux-2.6.39/drivers/pcmcia/db1xxx_ss.c
37044--- linux-2.6.39/drivers/pcmcia/db1xxx_ss.c 2011-05-19 00:06:34.000000000 -0400
37045+++ linux-2.6.39/drivers/pcmcia/db1xxx_ss.c 2011-05-22 19:36:32.000000000 -0400
37046@@ -384,7 +384,7 @@ static int au1x00_pcmcia_set_mem_map(str
37047 return 0;
37048 }
37049
37050-static struct pccard_operations db1x_pcmcia_operations = {
37051+static const struct pccard_operations db1x_pcmcia_operations = {
37052 .init = db1x_pcmcia_sock_init,
37053 .suspend = db1x_pcmcia_sock_suspend,
37054 .get_status = db1x_pcmcia_get_status,
37055diff -urNp linux-2.6.39/drivers/pcmcia/electra_cf.c linux-2.6.39/drivers/pcmcia/electra_cf.c
37056--- linux-2.6.39/drivers/pcmcia/electra_cf.c 2011-05-19 00:06:34.000000000 -0400
37057+++ linux-2.6.39/drivers/pcmcia/electra_cf.c 2011-05-22 19:36:32.000000000 -0400
37058@@ -173,7 +173,7 @@ static int electra_cf_set_mem_map(struct
37059 return 0;
37060 }
37061
37062-static struct pccard_operations electra_cf_ops = {
37063+static const struct pccard_operations electra_cf_ops = {
37064 .init = electra_cf_ss_init,
37065 .get_status = electra_cf_get_status,
37066 .set_socket = electra_cf_set_socket,
37067diff -urNp linux-2.6.39/drivers/pcmcia/m32r_cfc.c linux-2.6.39/drivers/pcmcia/m32r_cfc.c
37068--- linux-2.6.39/drivers/pcmcia/m32r_cfc.c 2011-05-19 00:06:34.000000000 -0400
37069+++ linux-2.6.39/drivers/pcmcia/m32r_cfc.c 2011-05-22 19:36:32.000000000 -0400
37070@@ -674,7 +674,7 @@ static int pcc_init(struct pcmcia_socket
37071 return 0;
37072 }
37073
37074-static struct pccard_operations pcc_operations = {
37075+static const struct pccard_operations pcc_operations = {
37076 .init = pcc_init,
37077 .get_status = pcc_get_status,
37078 .set_socket = pcc_set_socket,
37079diff -urNp linux-2.6.39/drivers/pcmcia/m32r_pcc.c linux-2.6.39/drivers/pcmcia/m32r_pcc.c
37080--- linux-2.6.39/drivers/pcmcia/m32r_pcc.c 2011-05-19 00:06:34.000000000 -0400
37081+++ linux-2.6.39/drivers/pcmcia/m32r_pcc.c 2011-05-22 19:36:32.000000000 -0400
37082@@ -652,7 +652,7 @@ static int pcc_init(struct pcmcia_socket
37083 return 0;
37084 }
37085
37086-static struct pccard_operations pcc_operations = {
37087+static const struct pccard_operations pcc_operations = {
37088 .init = pcc_init,
37089 .get_status = pcc_get_status,
37090 .set_socket = pcc_set_socket,
37091diff -urNp linux-2.6.39/drivers/pcmcia/m8xx_pcmcia.c linux-2.6.39/drivers/pcmcia/m8xx_pcmcia.c
37092--- linux-2.6.39/drivers/pcmcia/m8xx_pcmcia.c 2011-05-19 00:06:34.000000000 -0400
37093+++ linux-2.6.39/drivers/pcmcia/m8xx_pcmcia.c 2011-05-22 19:36:32.000000000 -0400
37094@@ -1139,7 +1139,7 @@ static int m8xx_sock_suspend(struct pcmc
37095 return m8xx_set_socket(sock, &dead_socket);
37096 }
37097
37098-static struct pccard_operations m8xx_services = {
37099+static const struct pccard_operations m8xx_services = {
37100 .init = m8xx_sock_init,
37101 .suspend = m8xx_sock_suspend,
37102 .get_status = m8xx_get_status,
37103diff -urNp linux-2.6.39/drivers/pcmcia/omap_cf.c linux-2.6.39/drivers/pcmcia/omap_cf.c
37104--- linux-2.6.39/drivers/pcmcia/omap_cf.c 2011-05-19 00:06:34.000000000 -0400
37105+++ linux-2.6.39/drivers/pcmcia/omap_cf.c 2011-05-22 19:36:32.000000000 -0400
37106@@ -185,7 +185,7 @@ omap_cf_set_mem_map(struct pcmcia_socket
37107 return 0;
37108 }
37109
37110-static struct pccard_operations omap_cf_ops = {
37111+static const struct pccard_operations omap_cf_ops = {
37112 .init = omap_cf_ss_init,
37113 .suspend = omap_cf_ss_suspend,
37114 .get_status = omap_cf_get_status,
37115diff -urNp linux-2.6.39/drivers/pcmcia/rsrc_iodyn.c linux-2.6.39/drivers/pcmcia/rsrc_iodyn.c
37116--- linux-2.6.39/drivers/pcmcia/rsrc_iodyn.c 2011-05-19 00:06:34.000000000 -0400
37117+++ linux-2.6.39/drivers/pcmcia/rsrc_iodyn.c 2011-05-22 19:36:32.000000000 -0400
37118@@ -161,7 +161,7 @@ static int iodyn_find_io(struct pcmcia_s
37119 }
37120
37121
37122-struct pccard_resource_ops pccard_iodyn_ops = {
37123+const struct pccard_resource_ops pccard_iodyn_ops = {
37124 .validate_mem = NULL,
37125 .find_io = iodyn_find_io,
37126 .find_mem = NULL,
37127diff -urNp linux-2.6.39/drivers/pcmcia/rsrc_mgr.c linux-2.6.39/drivers/pcmcia/rsrc_mgr.c
37128--- linux-2.6.39/drivers/pcmcia/rsrc_mgr.c 2011-05-19 00:06:34.000000000 -0400
37129+++ linux-2.6.39/drivers/pcmcia/rsrc_mgr.c 2011-05-22 19:36:32.000000000 -0400
37130@@ -57,7 +57,7 @@ static int static_find_io(struct pcmcia_
37131 }
37132
37133
37134-struct pccard_resource_ops pccard_static_ops = {
37135+const struct pccard_resource_ops pccard_static_ops = {
37136 .validate_mem = NULL,
37137 .find_io = static_find_io,
37138 .find_mem = NULL,
37139diff -urNp linux-2.6.39/drivers/pcmcia/vrc4171_card.c linux-2.6.39/drivers/pcmcia/vrc4171_card.c
37140--- linux-2.6.39/drivers/pcmcia/vrc4171_card.c 2011-05-19 00:06:34.000000000 -0400
37141+++ linux-2.6.39/drivers/pcmcia/vrc4171_card.c 2011-05-22 19:36:32.000000000 -0400
37142@@ -479,7 +479,7 @@ static int pccard_set_mem_map(struct pcm
37143 return 0;
37144 }
37145
37146-static struct pccard_operations vrc4171_pccard_operations = {
37147+static const struct pccard_operations vrc4171_pccard_operations = {
37148 .init = pccard_init,
37149 .get_status = pccard_get_status,
37150 .set_socket = pccard_set_socket,
37151diff -urNp linux-2.6.39/drivers/pcmcia/vrc4173_cardu.c linux-2.6.39/drivers/pcmcia/vrc4173_cardu.c
37152--- linux-2.6.39/drivers/pcmcia/vrc4173_cardu.c 2011-05-19 00:06:34.000000000 -0400
37153+++ linux-2.6.39/drivers/pcmcia/vrc4173_cardu.c 2011-05-22 19:36:32.000000000 -0400
37154@@ -384,7 +384,7 @@ static void cardu_proc_setup(unsigned in
37155 {
37156 }
37157
37158-static struct pccard_operations cardu_operations = {
37159+static const struct pccard_operations cardu_operations = {
37160 .init = cardu_init,
37161 .register_callback = cardu_register_callback,
37162 .inquire_socket = cardu_inquire_socket,
37163diff -urNp linux-2.6.39/drivers/pcmcia/xxs1500_ss.c linux-2.6.39/drivers/pcmcia/xxs1500_ss.c
37164--- linux-2.6.39/drivers/pcmcia/xxs1500_ss.c 2011-05-19 00:06:34.000000000 -0400
37165+++ linux-2.6.39/drivers/pcmcia/xxs1500_ss.c 2011-05-22 19:36:32.000000000 -0400
37166@@ -196,7 +196,7 @@ static int au1x00_pcmcia_set_mem_map(str
37167 return 0;
37168 }
37169
37170-static struct pccard_operations xxs1500_pcmcia_operations = {
37171+static const struct pccard_operations xxs1500_pcmcia_operations = {
37172 .init = xxs1500_pcmcia_sock_init,
37173 .suspend = xxs1500_pcmcia_sock_suspend,
37174 .get_status = xxs1500_pcmcia_get_status,
37175diff -urNp linux-2.6.39/drivers/platform/x86/acerhdf.c linux-2.6.39/drivers/platform/x86/acerhdf.c
37176--- linux-2.6.39/drivers/platform/x86/acerhdf.c 2011-05-19 00:06:34.000000000 -0400
37177+++ linux-2.6.39/drivers/platform/x86/acerhdf.c 2011-05-22 19:36:32.000000000 -0400
37178@@ -406,7 +406,7 @@ static int acerhdf_get_crit_temp(struct
37179 }
37180
37181 /* bind callback functions to thermalzone */
37182-static struct thermal_zone_device_ops acerhdf_dev_ops = {
37183+static const struct thermal_zone_device_ops acerhdf_dev_ops = {
37184 .bind = acerhdf_bind,
37185 .unbind = acerhdf_unbind,
37186 .get_temp = acerhdf_get_ec_temp,
37187@@ -481,7 +481,7 @@ err_out:
37188 }
37189
37190 /* bind fan callbacks to fan device */
37191-static struct thermal_cooling_device_ops acerhdf_cooling_ops = {
37192+static const struct thermal_cooling_device_ops acerhdf_cooling_ops = {
37193 .get_max_state = acerhdf_get_max_state,
37194 .get_cur_state = acerhdf_get_cur_state,
37195 .set_cur_state = acerhdf_set_cur_state,
37196diff -urNp linux-2.6.39/drivers/platform/x86/ideapad-laptop.c linux-2.6.39/drivers/platform/x86/ideapad-laptop.c
37197--- linux-2.6.39/drivers/platform/x86/ideapad-laptop.c 2011-05-19 00:06:34.000000000 -0400
37198+++ linux-2.6.39/drivers/platform/x86/ideapad-laptop.c 2011-05-22 19:36:32.000000000 -0400
37199@@ -207,7 +207,7 @@ static int ideapad_rfk_set(void *data, b
37200 return write_ec_cmd(ideapad_handle, opcode, !blocked);
37201 }
37202
37203-static struct rfkill_ops ideapad_rfk_ops = {
37204+static const struct rfkill_ops ideapad_rfk_ops = {
37205 .set_block = ideapad_rfk_set,
37206 };
37207
37208diff -urNp linux-2.6.39/drivers/platform/x86/intel_menlow.c linux-2.6.39/drivers/platform/x86/intel_menlow.c
37209--- linux-2.6.39/drivers/platform/x86/intel_menlow.c 2011-05-19 00:06:34.000000000 -0400
37210+++ linux-2.6.39/drivers/platform/x86/intel_menlow.c 2011-05-22 19:36:32.000000000 -0400
37211@@ -143,7 +143,7 @@ static int memory_set_cur_bandwidth(stru
37212 return 0;
37213 }
37214
37215-static struct thermal_cooling_device_ops memory_cooling_ops = {
37216+static const struct thermal_cooling_device_ops memory_cooling_ops = {
37217 .get_max_state = memory_get_max_bandwidth,
37218 .get_cur_state = memory_get_cur_bandwidth,
37219 .set_cur_state = memory_set_cur_bandwidth,
37220diff -urNp linux-2.6.39/drivers/platform/x86/intel_mid_thermal.c linux-2.6.39/drivers/platform/x86/intel_mid_thermal.c
37221--- linux-2.6.39/drivers/platform/x86/intel_mid_thermal.c 2011-05-19 00:06:34.000000000 -0400
37222+++ linux-2.6.39/drivers/platform/x86/intel_mid_thermal.c 2011-05-22 19:36:32.000000000 -0400
37223@@ -458,7 +458,7 @@ static int read_curr_temp(struct thermal
37224 }
37225
37226 /* Can't be const */
37227-static struct thermal_zone_device_ops tzd_ops = {
37228+static const struct thermal_zone_device_ops tzd_ops = {
37229 .get_temp = read_curr_temp,
37230 };
37231
37232diff -urNp linux-2.6.39/drivers/platform/x86/samsung-laptop.c linux-2.6.39/drivers/platform/x86/samsung-laptop.c
37233--- linux-2.6.39/drivers/platform/x86/samsung-laptop.c 2011-05-19 00:06:34.000000000 -0400
37234+++ linux-2.6.39/drivers/platform/x86/samsung-laptop.c 2011-05-22 19:36:32.000000000 -0400
37235@@ -419,7 +419,7 @@ static int rfkill_set(void *data, bool b
37236 return 0;
37237 }
37238
37239-static struct rfkill_ops rfkill_ops = {
37240+static const struct rfkill_ops rfkill_ops = {
37241 .set_block = rfkill_set,
37242 };
37243
37244diff -urNp linux-2.6.39/drivers/pnp/pnpbios/bioscalls.c linux-2.6.39/drivers/pnp/pnpbios/bioscalls.c
37245--- linux-2.6.39/drivers/pnp/pnpbios/bioscalls.c 2011-05-19 00:06:34.000000000 -0400
37246+++ linux-2.6.39/drivers/pnp/pnpbios/bioscalls.c 2011-05-22 19:36:32.000000000 -0400
37247@@ -59,7 +59,7 @@ do { \
37248 set_desc_limit(&gdt[(selname) >> 3], (size) - 1); \
37249 } while(0)
37250
37251-static struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4092,
37252+static const struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4093,
37253 (unsigned long)__va(0x400UL), PAGE_SIZE - 0x400 - 1);
37254
37255 /*
37256@@ -96,7 +96,10 @@ static inline u16 call_pnp_bios(u16 func
37257
37258 cpu = get_cpu();
37259 save_desc_40 = get_cpu_gdt_table(cpu)[0x40 / 8];
37260+
37261+ pax_open_kernel();
37262 get_cpu_gdt_table(cpu)[0x40 / 8] = bad_bios_desc;
37263+ pax_close_kernel();
37264
37265 /* On some boxes IRQ's during PnP BIOS calls are deadly. */
37266 spin_lock_irqsave(&pnp_bios_lock, flags);
37267@@ -134,7 +137,10 @@ static inline u16 call_pnp_bios(u16 func
37268 :"memory");
37269 spin_unlock_irqrestore(&pnp_bios_lock, flags);
37270
37271+ pax_open_kernel();
37272 get_cpu_gdt_table(cpu)[0x40 / 8] = save_desc_40;
37273+ pax_close_kernel();
37274+
37275 put_cpu();
37276
37277 /* If we get here and this is set then the PnP BIOS faulted on us. */
37278@@ -468,7 +474,7 @@ int pnp_bios_read_escd(char *data, u32 n
37279 return status;
37280 }
37281
37282-void pnpbios_calls_init(union pnp_bios_install_struct *header)
37283+void __init pnpbios_calls_init(union pnp_bios_install_struct *header)
37284 {
37285 int i;
37286
37287@@ -476,6 +482,8 @@ void pnpbios_calls_init(union pnp_bios_i
37288 pnp_bios_callpoint.offset = header->fields.pm16offset;
37289 pnp_bios_callpoint.segment = PNP_CS16;
37290
37291+ pax_open_kernel();
37292+
37293 for_each_possible_cpu(i) {
37294 struct desc_struct *gdt = get_cpu_gdt_table(i);
37295 if (!gdt)
37296@@ -487,4 +495,6 @@ void pnpbios_calls_init(union pnp_bios_i
37297 set_desc_base(&gdt[GDT_ENTRY_PNPBIOS_DS],
37298 (unsigned long)__va(header->fields.pm16dseg));
37299 }
37300+
37301+ pax_close_kernel();
37302 }
37303diff -urNp linux-2.6.39/drivers/pnp/resource.c linux-2.6.39/drivers/pnp/resource.c
37304--- linux-2.6.39/drivers/pnp/resource.c 2011-05-19 00:06:34.000000000 -0400
37305+++ linux-2.6.39/drivers/pnp/resource.c 2011-05-22 19:36:32.000000000 -0400
37306@@ -360,7 +360,7 @@ int pnp_check_irq(struct pnp_dev *dev, s
37307 return 1;
37308
37309 /* check if the resource is valid */
37310- if (*irq < 0 || *irq > 15)
37311+ if (*irq > 15)
37312 return 0;
37313
37314 /* check if the resource is reserved */
37315@@ -424,7 +424,7 @@ int pnp_check_dma(struct pnp_dev *dev, s
37316 return 1;
37317
37318 /* check if the resource is valid */
37319- if (*dma < 0 || *dma == 4 || *dma > 7)
37320+ if (*dma == 4 || *dma > 7)
37321 return 0;
37322
37323 /* check if the resource is reserved */
37324diff -urNp linux-2.6.39/drivers/power/max8925_power.c linux-2.6.39/drivers/power/max8925_power.c
37325--- linux-2.6.39/drivers/power/max8925_power.c 2011-05-19 00:06:34.000000000 -0400
37326+++ linux-2.6.39/drivers/power/max8925_power.c 2011-05-22 19:36:32.000000000 -0400
37327@@ -426,7 +426,7 @@ static __devinit int max8925_power_probe
37328 {
37329 struct max8925_chip *chip = dev_get_drvdata(pdev->dev.parent);
37330 struct max8925_platform_data *max8925_pdata;
37331- struct max8925_power_pdata *pdata = NULL;
37332+ const struct max8925_power_pdata *pdata = NULL;
37333 struct max8925_power_info *info;
37334 int ret;
37335
37336diff -urNp linux-2.6.39/drivers/regulator/core.c linux-2.6.39/drivers/regulator/core.c
37337--- linux-2.6.39/drivers/regulator/core.c 2011-05-19 00:06:34.000000000 -0400
37338+++ linux-2.6.39/drivers/regulator/core.c 2011-05-22 19:36:32.000000000 -0400
37339@@ -2883,7 +2883,7 @@ core_initcall(regulator_init);
37340 static int __init regulator_init_complete(void)
37341 {
37342 struct regulator_dev *rdev;
37343- struct regulator_ops *ops;
37344+ const struct regulator_ops *ops;
37345 struct regulation_constraints *c;
37346 int enabled, ret;
37347
37348diff -urNp linux-2.6.39/drivers/rtc/rtc-at32ap700x.c linux-2.6.39/drivers/rtc/rtc-at32ap700x.c
37349--- linux-2.6.39/drivers/rtc/rtc-at32ap700x.c 2011-05-19 00:06:34.000000000 -0400
37350+++ linux-2.6.39/drivers/rtc/rtc-at32ap700x.c 2011-05-22 19:36:32.000000000 -0400
37351@@ -187,7 +187,7 @@ static irqreturn_t at32_rtc_interrupt(in
37352 return ret;
37353 }
37354
37355-static struct rtc_class_ops at32_rtc_ops = {
37356+static const struct rtc_class_ops at32_rtc_ops = {
37357 .read_time = at32_rtc_readtime,
37358 .set_time = at32_rtc_settime,
37359 .read_alarm = at32_rtc_readalarm,
37360diff -urNp linux-2.6.39/drivers/rtc/rtc-au1xxx.c linux-2.6.39/drivers/rtc/rtc-au1xxx.c
37361--- linux-2.6.39/drivers/rtc/rtc-au1xxx.c 2011-05-19 00:06:34.000000000 -0400
37362+++ linux-2.6.39/drivers/rtc/rtc-au1xxx.c 2011-05-22 19:36:32.000000000 -0400
37363@@ -57,7 +57,7 @@ static int au1xtoy_rtc_set_time(struct d
37364 return 0;
37365 }
37366
37367-static struct rtc_class_ops au1xtoy_rtc_ops = {
37368+static const struct rtc_class_ops au1xtoy_rtc_ops = {
37369 .read_time = au1xtoy_rtc_read_time,
37370 .set_time = au1xtoy_rtc_set_time,
37371 };
37372diff -urNp linux-2.6.39/drivers/rtc/rtc-bfin.c linux-2.6.39/drivers/rtc/rtc-bfin.c
37373--- linux-2.6.39/drivers/rtc/rtc-bfin.c 2011-05-19 00:06:34.000000000 -0400
37374+++ linux-2.6.39/drivers/rtc/rtc-bfin.c 2011-05-22 19:36:32.000000000 -0400
37375@@ -333,7 +333,7 @@ static int bfin_rtc_proc(struct device *
37376 #undef yesno
37377 }
37378
37379-static struct rtc_class_ops bfin_rtc_ops = {
37380+static const struct rtc_class_ops bfin_rtc_ops = {
37381 .read_time = bfin_rtc_read_time,
37382 .set_time = bfin_rtc_set_time,
37383 .read_alarm = bfin_rtc_read_alarm,
37384diff -urNp linux-2.6.39/drivers/rtc/rtc-coh901331.c linux-2.6.39/drivers/rtc/rtc-coh901331.c
37385--- linux-2.6.39/drivers/rtc/rtc-coh901331.c 2011-05-19 00:06:34.000000000 -0400
37386+++ linux-2.6.39/drivers/rtc/rtc-coh901331.c 2011-05-22 19:36:32.000000000 -0400
37387@@ -142,7 +142,7 @@ static int coh901331_alarm_irq_enable(st
37388 return 0;
37389 }
37390
37391-static struct rtc_class_ops coh901331_ops = {
37392+static const struct rtc_class_ops coh901331_ops = {
37393 .read_time = coh901331_read_time,
37394 .set_mmss = coh901331_set_mmss,
37395 .read_alarm = coh901331_read_alarm,
37396diff -urNp linux-2.6.39/drivers/rtc/rtc-davinci.c linux-2.6.39/drivers/rtc/rtc-davinci.c
37397--- linux-2.6.39/drivers/rtc/rtc-davinci.c 2011-05-19 00:06:34.000000000 -0400
37398+++ linux-2.6.39/drivers/rtc/rtc-davinci.c 2011-05-22 19:36:32.000000000 -0400
37399@@ -469,7 +469,7 @@ static int davinci_rtc_set_alarm(struct
37400 return 0;
37401 }
37402
37403-static struct rtc_class_ops davinci_rtc_ops = {
37404+static const struct rtc_class_ops davinci_rtc_ops = {
37405 .ioctl = davinci_rtc_ioctl,
37406 .read_time = davinci_rtc_read_time,
37407 .set_time = davinci_rtc_set_time,
37408diff -urNp linux-2.6.39/drivers/rtc/rtc-dev.c linux-2.6.39/drivers/rtc/rtc-dev.c
37409--- linux-2.6.39/drivers/rtc/rtc-dev.c 2011-05-19 00:06:34.000000000 -0400
37410+++ linux-2.6.39/drivers/rtc/rtc-dev.c 2011-05-22 19:41:37.000000000 -0400
37411@@ -14,6 +14,7 @@
37412 #include <linux/module.h>
37413 #include <linux/rtc.h>
37414 #include <linux/sched.h>
37415+#include <linux/grsecurity.h>
37416 #include "rtc-core.h"
37417
37418 static dev_t rtc_devt;
37419@@ -345,6 +346,8 @@ static long rtc_dev_ioctl(struct file *f
37420 if (copy_from_user(&tm, uarg, sizeof(tm)))
37421 return -EFAULT;
37422
37423+ gr_log_timechange();
37424+
37425 return rtc_set_time(rtc, &tm);
37426
37427 case RTC_PIE_ON:
37428diff -urNp linux-2.6.39/drivers/rtc/rtc-dm355evm.c linux-2.6.39/drivers/rtc/rtc-dm355evm.c
37429--- linux-2.6.39/drivers/rtc/rtc-dm355evm.c 2011-05-19 00:06:34.000000000 -0400
37430+++ linux-2.6.39/drivers/rtc/rtc-dm355evm.c 2011-05-22 19:36:32.000000000 -0400
37431@@ -115,7 +115,7 @@ static int dm355evm_rtc_set_time(struct
37432 return 0;
37433 }
37434
37435-static struct rtc_class_ops dm355evm_rtc_ops = {
37436+static const struct rtc_class_ops dm355evm_rtc_ops = {
37437 .read_time = dm355evm_rtc_read_time,
37438 .set_time = dm355evm_rtc_set_time,
37439 };
37440diff -urNp linux-2.6.39/drivers/rtc/rtc-ds1302.c linux-2.6.39/drivers/rtc/rtc-ds1302.c
37441--- linux-2.6.39/drivers/rtc/rtc-ds1302.c 2011-05-19 00:06:34.000000000 -0400
37442+++ linux-2.6.39/drivers/rtc/rtc-ds1302.c 2011-05-22 19:36:32.000000000 -0400
37443@@ -199,7 +199,7 @@ static int ds1302_rtc_ioctl(struct devic
37444 return -ENOIOCTLCMD;
37445 }
37446
37447-static struct rtc_class_ops ds1302_rtc_ops = {
37448+static const struct rtc_class_ops ds1302_rtc_ops = {
37449 .read_time = ds1302_rtc_read_time,
37450 .set_time = ds1302_rtc_set_time,
37451 .ioctl = ds1302_rtc_ioctl,
37452diff -urNp linux-2.6.39/drivers/rtc/rtc-imxdi.c linux-2.6.39/drivers/rtc/rtc-imxdi.c
37453--- linux-2.6.39/drivers/rtc/rtc-imxdi.c 2011-05-19 00:06:34.000000000 -0400
37454+++ linux-2.6.39/drivers/rtc/rtc-imxdi.c 2011-05-22 19:36:32.000000000 -0400
37455@@ -290,7 +290,7 @@ static int dryice_rtc_set_alarm(struct d
37456 return 0;
37457 }
37458
37459-static struct rtc_class_ops dryice_rtc_ops = {
37460+static const struct rtc_class_ops dryice_rtc_ops = {
37461 .read_time = dryice_rtc_read_time,
37462 .set_mmss = dryice_rtc_set_mmss,
37463 .alarm_irq_enable = dryice_rtc_alarm_irq_enable,
37464diff -urNp linux-2.6.39/drivers/rtc/rtc-jz4740.c linux-2.6.39/drivers/rtc/rtc-jz4740.c
37465--- linux-2.6.39/drivers/rtc/rtc-jz4740.c 2011-05-19 00:06:34.000000000 -0400
37466+++ linux-2.6.39/drivers/rtc/rtc-jz4740.c 2011-05-22 19:36:32.000000000 -0400
37467@@ -174,7 +174,7 @@ static int jz4740_rtc_alarm_irq_enable(s
37468 return jz4740_rtc_ctrl_set_bits(rtc, JZ_RTC_CTRL_AF_IRQ, enable);
37469 }
37470
37471-static struct rtc_class_ops jz4740_rtc_ops = {
37472+static const struct rtc_class_ops jz4740_rtc_ops = {
37473 .read_time = jz4740_rtc_read_time,
37474 .set_mmss = jz4740_rtc_set_mmss,
37475 .read_alarm = jz4740_rtc_read_alarm,
37476diff -urNp linux-2.6.39/drivers/rtc/rtc-m41t80.c linux-2.6.39/drivers/rtc/rtc-m41t80.c
37477--- linux-2.6.39/drivers/rtc/rtc-m41t80.c 2011-05-19 00:06:34.000000000 -0400
37478+++ linux-2.6.39/drivers/rtc/rtc-m41t80.c 2011-05-22 19:36:32.000000000 -0400
37479@@ -354,7 +354,7 @@ static int m41t80_rtc_read_alarm(struct
37480 return 0;
37481 }
37482
37483-static struct rtc_class_ops m41t80_rtc_ops = {
37484+static const struct rtc_class_ops m41t80_rtc_ops = {
37485 .read_time = m41t80_rtc_read_time,
37486 .set_time = m41t80_rtc_set_time,
37487 .read_alarm = m41t80_rtc_read_alarm,
37488diff -urNp linux-2.6.39/drivers/rtc/rtc-mxc.c linux-2.6.39/drivers/rtc/rtc-mxc.c
37489--- linux-2.6.39/drivers/rtc/rtc-mxc.c 2011-05-19 00:06:34.000000000 -0400
37490+++ linux-2.6.39/drivers/rtc/rtc-mxc.c 2011-05-22 19:36:32.000000000 -0400
37491@@ -355,7 +355,7 @@ static int mxc_rtc_set_alarm(struct devi
37492 }
37493
37494 /* RTC layer */
37495-static struct rtc_class_ops mxc_rtc_ops = {
37496+static const struct rtc_class_ops mxc_rtc_ops = {
37497 .release = mxc_rtc_release,
37498 .read_time = mxc_rtc_read_time,
37499 .set_mmss = mxc_rtc_set_mmss,
37500diff -urNp linux-2.6.39/drivers/rtc/rtc-nuc900.c linux-2.6.39/drivers/rtc/rtc-nuc900.c
37501--- linux-2.6.39/drivers/rtc/rtc-nuc900.c 2011-05-19 00:06:34.000000000 -0400
37502+++ linux-2.6.39/drivers/rtc/rtc-nuc900.c 2011-05-22 19:36:32.000000000 -0400
37503@@ -214,7 +214,7 @@ static int nuc900_rtc_set_alarm(struct d
37504 return 0;
37505 }
37506
37507-static struct rtc_class_ops nuc900_rtc_ops = {
37508+static const struct rtc_class_ops nuc900_rtc_ops = {
37509 .read_time = nuc900_rtc_read_time,
37510 .set_time = nuc900_rtc_set_time,
37511 .read_alarm = nuc900_rtc_read_alarm,
37512diff -urNp linux-2.6.39/drivers/rtc/rtc-omap.c linux-2.6.39/drivers/rtc/rtc-omap.c
37513--- linux-2.6.39/drivers/rtc/rtc-omap.c 2011-05-19 00:06:34.000000000 -0400
37514+++ linux-2.6.39/drivers/rtc/rtc-omap.c 2011-05-22 19:36:32.000000000 -0400
37515@@ -274,7 +274,7 @@ static int omap_rtc_set_alarm(struct dev
37516 return 0;
37517 }
37518
37519-static struct rtc_class_ops omap_rtc_ops = {
37520+static const struct rtc_class_ops omap_rtc_ops = {
37521 .read_time = omap_rtc_read_time,
37522 .set_time = omap_rtc_set_time,
37523 .read_alarm = omap_rtc_read_alarm,
37524diff -urNp linux-2.6.39/drivers/rtc/rtc-pcf50633.c linux-2.6.39/drivers/rtc/rtc-pcf50633.c
37525--- linux-2.6.39/drivers/rtc/rtc-pcf50633.c 2011-05-19 00:06:34.000000000 -0400
37526+++ linux-2.6.39/drivers/rtc/rtc-pcf50633.c 2011-05-22 19:36:32.000000000 -0400
37527@@ -238,7 +238,7 @@ static int pcf50633_rtc_set_alarm(struct
37528 return ret;
37529 }
37530
37531-static struct rtc_class_ops pcf50633_rtc_ops = {
37532+static const struct rtc_class_ops pcf50633_rtc_ops = {
37533 .read_time = pcf50633_rtc_read_time,
37534 .set_time = pcf50633_rtc_set_time,
37535 .read_alarm = pcf50633_rtc_read_alarm,
37536diff -urNp linux-2.6.39/drivers/rtc/rtc-pl031.c linux-2.6.39/drivers/rtc/rtc-pl031.c
37537--- linux-2.6.39/drivers/rtc/rtc-pl031.c 2011-05-19 00:06:34.000000000 -0400
37538+++ linux-2.6.39/drivers/rtc/rtc-pl031.c 2011-05-22 19:36:32.000000000 -0400
37539@@ -374,7 +374,7 @@ err_req:
37540 }
37541
37542 /* Operations for the original ARM version */
37543-static struct rtc_class_ops arm_pl031_ops = {
37544+static const struct rtc_class_ops arm_pl031_ops = {
37545 .read_time = pl031_read_time,
37546 .set_time = pl031_set_time,
37547 .read_alarm = pl031_read_alarm,
37548@@ -383,7 +383,7 @@ static struct rtc_class_ops arm_pl031_op
37549 };
37550
37551 /* The First ST derivative */
37552-static struct rtc_class_ops stv1_pl031_ops = {
37553+static const struct rtc_class_ops stv1_pl031_ops = {
37554 .read_time = pl031_read_time,
37555 .set_time = pl031_set_time,
37556 .read_alarm = pl031_read_alarm,
37557@@ -392,7 +392,7 @@ static struct rtc_class_ops stv1_pl031_o
37558 };
37559
37560 /* And the second ST derivative */
37561-static struct rtc_class_ops stv2_pl031_ops = {
37562+static const struct rtc_class_ops stv2_pl031_ops = {
37563 .read_time = pl031_stv2_read_time,
37564 .set_time = pl031_stv2_set_time,
37565 .read_alarm = pl031_stv2_read_alarm,
37566diff -urNp linux-2.6.39/drivers/rtc/rtc-rx8025.c linux-2.6.39/drivers/rtc/rtc-rx8025.c
37567--- linux-2.6.39/drivers/rtc/rtc-rx8025.c 2011-05-19 00:06:34.000000000 -0400
37568+++ linux-2.6.39/drivers/rtc/rtc-rx8025.c 2011-05-22 19:36:32.000000000 -0400
37569@@ -424,7 +424,7 @@ static int rx8025_alarm_irq_enable(struc
37570 return 0;
37571 }
37572
37573-static struct rtc_class_ops rx8025_rtc_ops = {
37574+static const struct rtc_class_ops rx8025_rtc_ops = {
37575 .read_time = rx8025_get_time,
37576 .set_time = rx8025_set_time,
37577 .read_alarm = rx8025_read_alarm,
37578diff -urNp linux-2.6.39/drivers/rtc/rtc-sh.c linux-2.6.39/drivers/rtc/rtc-sh.c
37579--- linux-2.6.39/drivers/rtc/rtc-sh.c 2011-05-19 00:06:34.000000000 -0400
37580+++ linux-2.6.39/drivers/rtc/rtc-sh.c 2011-05-22 19:36:32.000000000 -0400
37581@@ -576,7 +576,7 @@ static int sh_rtc_set_alarm(struct devic
37582 return 0;
37583 }
37584
37585-static struct rtc_class_ops sh_rtc_ops = {
37586+static const struct rtc_class_ops sh_rtc_ops = {
37587 .read_time = sh_rtc_read_time,
37588 .set_time = sh_rtc_set_time,
37589 .read_alarm = sh_rtc_read_alarm,
37590diff -urNp linux-2.6.39/drivers/rtc/rtc-stmp3xxx.c linux-2.6.39/drivers/rtc/rtc-stmp3xxx.c
37591--- linux-2.6.39/drivers/rtc/rtc-stmp3xxx.c 2011-05-19 00:06:34.000000000 -0400
37592+++ linux-2.6.39/drivers/rtc/rtc-stmp3xxx.c 2011-05-22 19:36:32.000000000 -0400
37593@@ -133,7 +133,7 @@ static int stmp3xxx_rtc_set_alarm(struct
37594 return 0;
37595 }
37596
37597-static struct rtc_class_ops stmp3xxx_rtc_ops = {
37598+static const struct rtc_class_ops stmp3xxx_rtc_ops = {
37599 .alarm_irq_enable =
37600 stmp3xxx_alarm_irq_enable,
37601 .read_time = stmp3xxx_rtc_gettime,
37602diff -urNp linux-2.6.39/drivers/rtc/rtc-tegra.c linux-2.6.39/drivers/rtc/rtc-tegra.c
37603--- linux-2.6.39/drivers/rtc/rtc-tegra.c 2011-05-19 00:06:34.000000000 -0400
37604+++ linux-2.6.39/drivers/rtc/rtc-tegra.c 2011-05-22 19:36:32.000000000 -0400
37605@@ -294,7 +294,7 @@ static irqreturn_t tegra_rtc_irq_handler
37606 return IRQ_HANDLED;
37607 }
37608
37609-static struct rtc_class_ops tegra_rtc_ops = {
37610+static const struct rtc_class_ops tegra_rtc_ops = {
37611 .read_time = tegra_rtc_read_time,
37612 .set_time = tegra_rtc_set_time,
37613 .read_alarm = tegra_rtc_read_alarm,
37614diff -urNp linux-2.6.39/drivers/rtc/rtc-twl.c linux-2.6.39/drivers/rtc/rtc-twl.c
37615--- linux-2.6.39/drivers/rtc/rtc-twl.c 2011-05-19 00:06:34.000000000 -0400
37616+++ linux-2.6.39/drivers/rtc/rtc-twl.c 2011-05-22 19:36:32.000000000 -0400
37617@@ -415,7 +415,7 @@ out:
37618 return ret;
37619 }
37620
37621-static struct rtc_class_ops twl_rtc_ops = {
37622+static const struct rtc_class_ops twl_rtc_ops = {
37623 .read_time = twl_rtc_read_time,
37624 .set_time = twl_rtc_set_time,
37625 .read_alarm = twl_rtc_read_alarm,
37626diff -urNp linux-2.6.39/drivers/rtc/rtc-v3020.c linux-2.6.39/drivers/rtc/rtc-v3020.c
37627--- linux-2.6.39/drivers/rtc/rtc-v3020.c 2011-05-19 00:06:34.000000000 -0400
37628+++ linux-2.6.39/drivers/rtc/rtc-v3020.c 2011-05-22 19:36:32.000000000 -0400
37629@@ -62,7 +62,7 @@ struct v3020 {
37630 /* GPIO access */
37631 struct v3020_gpio *gpio;
37632
37633- struct v3020_chip_ops *ops;
37634+ const struct v3020_chip_ops *ops;
37635
37636 struct rtc_device *rtc;
37637 };
37638@@ -100,7 +100,7 @@ static unsigned char v3020_mmio_read_bit
37639 return !!(readl(chip->ioaddress) & (1 << chip->leftshift));
37640 }
37641
37642-static struct v3020_chip_ops v3020_mmio_ops = {
37643+static const struct v3020_chip_ops v3020_mmio_ops = {
37644 .map_io = v3020_mmio_map,
37645 .unmap_io = v3020_mmio_unmap,
37646 .read_bit = v3020_mmio_read_bit,
37647@@ -177,7 +177,7 @@ static unsigned char v3020_gpio_read_bit
37648 return bit;
37649 }
37650
37651-static struct v3020_chip_ops v3020_gpio_ops = {
37652+static const struct v3020_chip_ops v3020_gpio_ops = {
37653 .map_io = v3020_gpio_map,
37654 .unmap_io = v3020_gpio_unmap,
37655 .read_bit = v3020_gpio_read_bit,
37656diff -urNp linux-2.6.39/drivers/s390/char/con3270.c linux-2.6.39/drivers/s390/char/con3270.c
37657--- linux-2.6.39/drivers/s390/char/con3270.c 2011-05-19 00:06:34.000000000 -0400
37658+++ linux-2.6.39/drivers/s390/char/con3270.c 2011-05-22 19:36:32.000000000 -0400
37659@@ -28,7 +28,7 @@
37660 #define CON3270_OUTPUT_BUFFER_SIZE 1024
37661 #define CON3270_STRING_PAGES 4
37662
37663-static struct raw3270_fn con3270_fn;
37664+static const struct raw3270_fn con3270_fn;
37665
37666 /*
37667 * Main 3270 console view data structure.
37668@@ -413,7 +413,7 @@ con3270_irq(struct con3270 *cp, struct r
37669 }
37670
37671 /* Console view to a 3270 device. */
37672-static struct raw3270_fn con3270_fn = {
37673+static const struct raw3270_fn con3270_fn = {
37674 .activate = con3270_activate,
37675 .deactivate = con3270_deactivate,
37676 .intv = (void *) con3270_irq
37677diff -urNp linux-2.6.39/drivers/s390/char/fs3270.c linux-2.6.39/drivers/s390/char/fs3270.c
37678--- linux-2.6.39/drivers/s390/char/fs3270.c 2011-05-19 00:06:34.000000000 -0400
37679+++ linux-2.6.39/drivers/s390/char/fs3270.c 2011-05-22 19:36:32.000000000 -0400
37680@@ -24,7 +24,7 @@
37681 #include "raw3270.h"
37682 #include "ctrlchar.h"
37683
37684-static struct raw3270_fn fs3270_fn;
37685+static const struct raw3270_fn fs3270_fn;
37686
37687 struct fs3270 {
37688 struct raw3270_view view;
37689@@ -413,7 +413,7 @@ fs3270_release(struct raw3270_view *view
37690 }
37691
37692 /* View to a 3270 device. Can be console, tty or fullscreen. */
37693-static struct raw3270_fn fs3270_fn = {
37694+static const struct raw3270_fn fs3270_fn = {
37695 .activate = fs3270_activate,
37696 .deactivate = fs3270_deactivate,
37697 .intv = (void *) fs3270_irq,
37698diff -urNp linux-2.6.39/drivers/s390/char/raw3270.c linux-2.6.39/drivers/s390/char/raw3270.c
37699--- linux-2.6.39/drivers/s390/char/raw3270.c 2011-05-19 00:06:34.000000000 -0400
37700+++ linux-2.6.39/drivers/s390/char/raw3270.c 2011-05-22 19:36:32.000000000 -0400
37701@@ -488,7 +488,7 @@ raw3270_init_irq(struct raw3270_view *vi
37702 return RAW3270_IO_DONE;
37703 }
37704
37705-static struct raw3270_fn raw3270_init_fn = {
37706+static const struct raw3270_fn raw3270_init_fn = {
37707 .intv = raw3270_init_irq
37708 };
37709
37710diff -urNp linux-2.6.39/drivers/s390/char/tty3270.c linux-2.6.39/drivers/s390/char/tty3270.c
37711--- linux-2.6.39/drivers/s390/char/tty3270.c 2011-05-19 00:06:34.000000000 -0400
37712+++ linux-2.6.39/drivers/s390/char/tty3270.c 2011-05-22 19:36:32.000000000 -0400
37713@@ -37,7 +37,7 @@
37714 struct tty_driver *tty3270_driver;
37715 static int tty3270_max_index;
37716
37717-static struct raw3270_fn tty3270_fn;
37718+static const struct raw3270_fn tty3270_fn;
37719
37720 struct tty3270_cell {
37721 unsigned char character;
37722@@ -834,7 +834,7 @@ tty3270_del_views(void)
37723 }
37724 }
37725
37726-static struct raw3270_fn tty3270_fn = {
37727+static const struct raw3270_fn tty3270_fn = {
37728 .activate = tty3270_activate,
37729 .deactivate = tty3270_deactivate,
37730 .intv = (void *) tty3270_irq,
37731diff -urNp linux-2.6.39/drivers/s390/cio/qdio_debug.c linux-2.6.39/drivers/s390/cio/qdio_debug.c
37732--- linux-2.6.39/drivers/s390/cio/qdio_debug.c 2011-05-19 00:06:34.000000000 -0400
37733+++ linux-2.6.39/drivers/s390/cio/qdio_debug.c 2011-05-22 19:36:32.000000000 -0400
37734@@ -225,7 +225,7 @@ static int qperf_seq_open(struct inode *
37735 filp->f_path.dentry->d_inode->i_private);
37736 }
37737
37738-static struct file_operations debugfs_perf_fops = {
37739+static const struct file_operations debugfs_perf_fops = {
37740 .owner = THIS_MODULE,
37741 .open = qperf_seq_open,
37742 .read = seq_read,
37743diff -urNp linux-2.6.39/drivers/s390/crypto/zcrypt_cex2a.c linux-2.6.39/drivers/s390/crypto/zcrypt_cex2a.c
37744--- linux-2.6.39/drivers/s390/crypto/zcrypt_cex2a.c 2011-05-19 00:06:34.000000000 -0400
37745+++ linux-2.6.39/drivers/s390/crypto/zcrypt_cex2a.c 2011-05-22 19:36:32.000000000 -0400
37746@@ -415,7 +415,7 @@ out_free:
37747 /**
37748 * The crypto operations for a CEX2A card.
37749 */
37750-static struct zcrypt_ops zcrypt_cex2a_ops = {
37751+static const struct zcrypt_ops zcrypt_cex2a_ops = {
37752 .rsa_modexpo = zcrypt_cex2a_modexpo,
37753 .rsa_modexpo_crt = zcrypt_cex2a_modexpo_crt,
37754 };
37755diff -urNp linux-2.6.39/drivers/s390/crypto/zcrypt_pcica.c linux-2.6.39/drivers/s390/crypto/zcrypt_pcica.c
37756--- linux-2.6.39/drivers/s390/crypto/zcrypt_pcica.c 2011-05-19 00:06:34.000000000 -0400
37757+++ linux-2.6.39/drivers/s390/crypto/zcrypt_pcica.c 2011-05-22 19:36:32.000000000 -0400
37758@@ -347,7 +347,7 @@ out_free:
37759 /**
37760 * The crypto operations for a PCICA card.
37761 */
37762-static struct zcrypt_ops zcrypt_pcica_ops = {
37763+static const struct zcrypt_ops zcrypt_pcica_ops = {
37764 .rsa_modexpo = zcrypt_pcica_modexpo,
37765 .rsa_modexpo_crt = zcrypt_pcica_modexpo_crt,
37766 };
37767diff -urNp linux-2.6.39/drivers/s390/crypto/zcrypt_pcicc.c linux-2.6.39/drivers/s390/crypto/zcrypt_pcicc.c
37768--- linux-2.6.39/drivers/s390/crypto/zcrypt_pcicc.c 2011-05-19 00:06:34.000000000 -0400
37769+++ linux-2.6.39/drivers/s390/crypto/zcrypt_pcicc.c 2011-05-22 19:36:32.000000000 -0400
37770@@ -553,7 +553,7 @@ out_free:
37771 /**
37772 * The crypto operations for a PCICC card.
37773 */
37774-static struct zcrypt_ops zcrypt_pcicc_ops = {
37775+static const struct zcrypt_ops zcrypt_pcicc_ops = {
37776 .rsa_modexpo = zcrypt_pcicc_modexpo,
37777 .rsa_modexpo_crt = zcrypt_pcicc_modexpo_crt,
37778 };
37779diff -urNp linux-2.6.39/drivers/s390/crypto/zcrypt_pcixcc.c linux-2.6.39/drivers/s390/crypto/zcrypt_pcixcc.c
37780--- linux-2.6.39/drivers/s390/crypto/zcrypt_pcixcc.c 2011-05-19 00:06:34.000000000 -0400
37781+++ linux-2.6.39/drivers/s390/crypto/zcrypt_pcixcc.c 2011-05-22 19:36:32.000000000 -0400
37782@@ -851,13 +851,13 @@ static long zcrypt_pcixcc_rng(struct zcr
37783 /**
37784 * The crypto operations for a PCIXCC/CEX2C card.
37785 */
37786-static struct zcrypt_ops zcrypt_pcixcc_ops = {
37787+static const struct zcrypt_ops zcrypt_pcixcc_ops = {
37788 .rsa_modexpo = zcrypt_pcixcc_modexpo,
37789 .rsa_modexpo_crt = zcrypt_pcixcc_modexpo_crt,
37790 .send_cprb = zcrypt_pcixcc_send_cprb,
37791 };
37792
37793-static struct zcrypt_ops zcrypt_pcixcc_with_rng_ops = {
37794+static const struct zcrypt_ops zcrypt_pcixcc_with_rng_ops = {
37795 .rsa_modexpo = zcrypt_pcixcc_modexpo,
37796 .rsa_modexpo_crt = zcrypt_pcixcc_modexpo_crt,
37797 .send_cprb = zcrypt_pcixcc_send_cprb,
37798diff -urNp linux-2.6.39/drivers/s390/kvm/kvm_virtio.c linux-2.6.39/drivers/s390/kvm/kvm_virtio.c
37799--- linux-2.6.39/drivers/s390/kvm/kvm_virtio.c 2011-05-19 00:06:34.000000000 -0400
37800+++ linux-2.6.39/drivers/s390/kvm/kvm_virtio.c 2011-05-22 19:36:32.000000000 -0400
37801@@ -266,7 +266,7 @@ error:
37802 /*
37803 * The config ops structure as defined by virtio config
37804 */
37805-static struct virtio_config_ops kvm_vq_configspace_ops = {
37806+static const struct virtio_config_ops kvm_vq_configspace_ops = {
37807 .get_features = kvm_get_features,
37808 .finalize_features = kvm_finalize_features,
37809 .get = kvm_get,
37810diff -urNp linux-2.6.39/drivers/s390/net/qeth_core.h linux-2.6.39/drivers/s390/net/qeth_core.h
37811--- linux-2.6.39/drivers/s390/net/qeth_core.h 2011-05-19 00:06:34.000000000 -0400
37812+++ linux-2.6.39/drivers/s390/net/qeth_core.h 2011-05-22 19:36:32.000000000 -0400
37813@@ -743,7 +743,7 @@ struct qeth_card {
37814 struct qeth_qdio_info qdio;
37815 struct qeth_perf_stats perf_stats;
37816 int read_or_write_problem;
37817- struct qeth_osn_info osn_info;
37818+ const struct qeth_osn_info osn_info;
37819 struct qeth_discipline discipline;
37820 atomic_t force_alloc_skb;
37821 struct service_level qeth_service_level;
37822diff -urNp linux-2.6.39/drivers/scsi/53c700.c linux-2.6.39/drivers/scsi/53c700.c
37823--- linux-2.6.39/drivers/scsi/53c700.c 2011-05-19 00:06:34.000000000 -0400
37824+++ linux-2.6.39/drivers/scsi/53c700.c 2011-05-22 19:36:32.000000000 -0400
37825@@ -2153,7 +2153,7 @@ EXPORT_SYMBOL(NCR_700_detect);
37826 EXPORT_SYMBOL(NCR_700_release);
37827 EXPORT_SYMBOL(NCR_700_intr);
37828
37829-static struct spi_function_template NCR_700_transport_functions = {
37830+static struct spi_function_template NCR_700_transport_functions = {
37831 .set_period = NCR_700_set_period,
37832 .show_period = 1,
37833 .set_offset = NCR_700_set_offset,
37834diff -urNp linux-2.6.39/drivers/scsi/aacraid/commctrl.c linux-2.6.39/drivers/scsi/aacraid/commctrl.c
37835--- linux-2.6.39/drivers/scsi/aacraid/commctrl.c 2011-05-19 00:06:34.000000000 -0400
37836+++ linux-2.6.39/drivers/scsi/aacraid/commctrl.c 2011-05-22 19:36:32.000000000 -0400
37837@@ -482,6 +482,7 @@ static int aac_send_raw_srb(struct aac_d
37838 u32 actual_fibsize64, actual_fibsize = 0;
37839 int i;
37840
37841+ pax_track_stack();
37842
37843 if (dev->in_reset) {
37844 dprintk((KERN_DEBUG"aacraid: send raw srb -EBUSY\n"));
37845diff -urNp linux-2.6.39/drivers/scsi/aic94xx/aic94xx_init.c linux-2.6.39/drivers/scsi/aic94xx/aic94xx_init.c
37846--- linux-2.6.39/drivers/scsi/aic94xx/aic94xx_init.c 2011-05-19 00:06:34.000000000 -0400
37847+++ linux-2.6.39/drivers/scsi/aic94xx/aic94xx_init.c 2011-05-22 19:41:37.000000000 -0400
37848@@ -486,7 +486,7 @@ static ssize_t asd_show_update_bios(stru
37849 flash_error_table[i].reason);
37850 }
37851
37852-static DEVICE_ATTR(update_bios, S_IRUGO|S_IWUGO,
37853+static DEVICE_ATTR(update_bios, S_IRUGO|S_IWUSR,
37854 asd_show_update_bios, asd_store_update_bios);
37855
37856 static int asd_create_dev_attrs(struct asd_ha_struct *asd_ha)
37857diff -urNp linux-2.6.39/drivers/scsi/bfa/bfa_core.c linux-2.6.39/drivers/scsi/bfa/bfa_core.c
37858--- linux-2.6.39/drivers/scsi/bfa/bfa_core.c 2011-05-19 00:06:34.000000000 -0400
37859+++ linux-2.6.39/drivers/scsi/bfa/bfa_core.c 2011-05-22 19:36:32.000000000 -0400
37860@@ -24,7 +24,7 @@ BFA_TRC_FILE(HAL, CORE);
37861 /*
37862 * BFA module list terminated by NULL
37863 */
37864-static struct bfa_module_s *hal_mods[] = {
37865+static const struct bfa_module_s *hal_mods[] = {
37866 &hal_mod_sgpg,
37867 &hal_mod_fcport,
37868 &hal_mod_fcxp,
37869diff -urNp linux-2.6.39/drivers/scsi/bfa/bfad.c linux-2.6.39/drivers/scsi/bfa/bfad.c
37870--- linux-2.6.39/drivers/scsi/bfa/bfad.c 2011-05-19 00:06:34.000000000 -0400
37871+++ linux-2.6.39/drivers/scsi/bfa/bfad.c 2011-05-22 19:36:32.000000000 -0400
37872@@ -1027,6 +1027,8 @@ bfad_start_ops(struct bfad_s *bfad) {
37873 struct bfad_vport_s *vport, *vport_new;
37874 struct bfa_fcs_driver_info_s driver_info;
37875
37876+ pax_track_stack();
37877+
37878 /* Fill the driver_info info to fcs*/
37879 memset(&driver_info, 0, sizeof(driver_info));
37880 strncpy(driver_info.version, BFAD_DRIVER_VERSION,
37881diff -urNp linux-2.6.39/drivers/scsi/bfa/bfa_fcs.c linux-2.6.39/drivers/scsi/bfa/bfa_fcs.c
37882--- linux-2.6.39/drivers/scsi/bfa/bfa_fcs.c 2011-05-19 00:06:34.000000000 -0400
37883+++ linux-2.6.39/drivers/scsi/bfa/bfa_fcs.c 2011-05-22 19:36:32.000000000 -0400
37884@@ -70,7 +70,7 @@ bfa_fcs_attach(struct bfa_fcs_s *fcs, st
37885 bfa_boolean_t min_cfg)
37886 {
37887 int i;
37888- struct bfa_fcs_mod_s *mod;
37889+ const struct bfa_fcs_mod_s *mod;
37890
37891 fcs->bfa = bfa;
37892 fcs->bfad = bfad;
37893@@ -93,7 +93,7 @@ void
37894 bfa_fcs_init(struct bfa_fcs_s *fcs)
37895 {
37896 int i, npbc_vports;
37897- struct bfa_fcs_mod_s *mod;
37898+ const struct bfa_fcs_mod_s *mod;
37899 struct bfi_pbc_vport_s pbc_vports[BFI_PBC_MAX_VPORTS];
37900
37901 for (i = 0; i < sizeof(fcs_modules) / sizeof(fcs_modules[0]); i++) {
37902@@ -140,7 +140,7 @@ bfa_fcs_driver_info_init(struct bfa_fcs_
37903 void
37904 bfa_fcs_exit(struct bfa_fcs_s *fcs)
37905 {
37906- struct bfa_fcs_mod_s *mod;
37907+ const struct bfa_fcs_mod_s *mod;
37908 int nmods, i;
37909
37910 bfa_wc_init(&fcs->wc, bfa_fcs_exit_comp, fcs);
37911diff -urNp linux-2.6.39/drivers/scsi/bfa/bfa_fcs_lport.c linux-2.6.39/drivers/scsi/bfa/bfa_fcs_lport.c
37912--- linux-2.6.39/drivers/scsi/bfa/bfa_fcs_lport.c 2011-05-19 00:06:34.000000000 -0400
37913+++ linux-2.6.39/drivers/scsi/bfa/bfa_fcs_lport.c 2011-05-22 19:36:32.000000000 -0400
37914@@ -1559,6 +1559,8 @@ bfa_fcs_lport_fdmi_build_rhba_pyld(struc
37915 u16 len, count;
37916 u16 templen;
37917
37918+ pax_track_stack();
37919+
37920 /*
37921 * get hba attributes
37922 */
37923@@ -1836,6 +1838,8 @@ bfa_fcs_lport_fdmi_build_portattr_block(
37924 u8 count = 0;
37925 u16 templen;
37926
37927+ pax_track_stack();
37928+
37929 /*
37930 * get port attributes
37931 */
37932diff -urNp linux-2.6.39/drivers/scsi/bfa/bfa_fcs_rport.c linux-2.6.39/drivers/scsi/bfa/bfa_fcs_rport.c
37933--- linux-2.6.39/drivers/scsi/bfa/bfa_fcs_rport.c 2011-05-19 00:06:34.000000000 -0400
37934+++ linux-2.6.39/drivers/scsi/bfa/bfa_fcs_rport.c 2011-05-22 19:36:32.000000000 -0400
37935@@ -1844,6 +1844,8 @@ bfa_fcs_rport_process_rpsc(struct bfa_fc
37936 struct fc_rpsc_speed_info_s speeds;
37937 struct bfa_port_attr_s pport_attr;
37938
37939+ pax_track_stack();
37940+
37941 bfa_trc(port->fcs, rx_fchs->s_id);
37942 bfa_trc(port->fcs, rx_fchs->d_id);
37943
37944diff -urNp linux-2.6.39/drivers/scsi/bfa/bfa_modules.h linux-2.6.39/drivers/scsi/bfa/bfa_modules.h
37945--- linux-2.6.39/drivers/scsi/bfa/bfa_modules.h 2011-05-19 00:06:34.000000000 -0400
37946+++ linux-2.6.39/drivers/scsi/bfa/bfa_modules.h 2011-05-22 19:36:32.000000000 -0400
37947@@ -68,8 +68,8 @@ enum {
37948 static void bfa_ ## __mod ## _stop(struct bfa_s *bfa); \
37949 static void bfa_ ## __mod ## _iocdisable(struct bfa_s *bfa); \
37950 \
37951- extern struct bfa_module_s hal_mod_ ## __mod; \
37952- struct bfa_module_s hal_mod_ ## __mod = { \
37953+ extern const struct bfa_module_s hal_mod_ ## __mod; \
37954+ const struct bfa_module_s hal_mod_ ## __mod = { \
37955 bfa_ ## __mod ## _meminfo, \
37956 bfa_ ## __mod ## _attach, \
37957 bfa_ ## __mod ## _detach, \
37958@@ -116,12 +116,12 @@ struct bfa_s {
37959 };
37960
37961 extern bfa_boolean_t bfa_auto_recover;
37962-extern struct bfa_module_s hal_mod_sgpg;
37963-extern struct bfa_module_s hal_mod_fcport;
37964-extern struct bfa_module_s hal_mod_fcxp;
37965-extern struct bfa_module_s hal_mod_lps;
37966-extern struct bfa_module_s hal_mod_uf;
37967-extern struct bfa_module_s hal_mod_rport;
37968-extern struct bfa_module_s hal_mod_fcpim;
37969+extern const struct bfa_module_s hal_mod_sgpg;
37970+extern const struct bfa_module_s hal_mod_fcport;
37971+extern const struct bfa_module_s hal_mod_fcxp;
37972+extern const struct bfa_module_s hal_mod_lps;
37973+extern const struct bfa_module_s hal_mod_uf;
37974+extern const struct bfa_module_s hal_mod_rport;
37975+extern const struct bfa_module_s hal_mod_fcpim;
37976
37977 #endif /* __BFA_MODULES_H__ */
37978diff -urNp linux-2.6.39/drivers/scsi/BusLogic.c linux-2.6.39/drivers/scsi/BusLogic.c
37979--- linux-2.6.39/drivers/scsi/BusLogic.c 2011-05-19 00:06:34.000000000 -0400
37980+++ linux-2.6.39/drivers/scsi/BusLogic.c 2011-05-22 19:36:32.000000000 -0400
37981@@ -962,6 +962,8 @@ static int __init BusLogic_InitializeFla
37982 static void __init BusLogic_InitializeProbeInfoList(struct BusLogic_HostAdapter
37983 *PrototypeHostAdapter)
37984 {
37985+ pax_track_stack();
37986+
37987 /*
37988 If a PCI BIOS is present, interrogate it for MultiMaster and FlashPoint
37989 Host Adapters; otherwise, default to the standard ISA MultiMaster probe.
37990diff -urNp linux-2.6.39/drivers/scsi/dpt_i2o.c linux-2.6.39/drivers/scsi/dpt_i2o.c
37991--- linux-2.6.39/drivers/scsi/dpt_i2o.c 2011-05-19 00:06:34.000000000 -0400
37992+++ linux-2.6.39/drivers/scsi/dpt_i2o.c 2011-05-22 19:36:32.000000000 -0400
37993@@ -1811,6 +1811,8 @@ static int adpt_i2o_passthru(adpt_hba* p
37994 dma_addr_t addr;
37995 ulong flags = 0;
37996
37997+ pax_track_stack();
37998+
37999 memset(&msg, 0, MAX_MESSAGE_SIZE*4);
38000 // get user msg size in u32s
38001 if(get_user(size, &user_msg[0])){
38002@@ -2317,6 +2319,8 @@ static s32 adpt_scsi_to_i2o(adpt_hba* pH
38003 s32 rcode;
38004 dma_addr_t addr;
38005
38006+ pax_track_stack();
38007+
38008 memset(msg, 0 , sizeof(msg));
38009 len = scsi_bufflen(cmd);
38010 direction = 0x00000000;
38011diff -urNp linux-2.6.39/drivers/scsi/eata.c linux-2.6.39/drivers/scsi/eata.c
38012--- linux-2.6.39/drivers/scsi/eata.c 2011-05-19 00:06:34.000000000 -0400
38013+++ linux-2.6.39/drivers/scsi/eata.c 2011-05-22 19:36:32.000000000 -0400
38014@@ -1087,6 +1087,8 @@ static int port_detect(unsigned long por
38015 struct hostdata *ha;
38016 char name[16];
38017
38018+ pax_track_stack();
38019+
38020 sprintf(name, "%s%d", driver_name, j);
38021
38022 if (!request_region(port_base, REGION_SIZE, driver_name)) {
38023diff -urNp linux-2.6.39/drivers/scsi/esp_scsi.c linux-2.6.39/drivers/scsi/esp_scsi.c
38024--- linux-2.6.39/drivers/scsi/esp_scsi.c 2011-05-19 00:06:34.000000000 -0400
38025+++ linux-2.6.39/drivers/scsi/esp_scsi.c 2011-05-22 19:36:32.000000000 -0400
38026@@ -2680,7 +2680,7 @@ static void esp_set_width(struct scsi_ta
38027 tp->flags |= ESP_TGT_CHECK_NEGO;
38028 }
38029
38030-static struct spi_function_template esp_transport_ops = {
38031+static const struct spi_function_template esp_transport_ops = {
38032 .set_offset = esp_set_offset,
38033 .show_offset = 1,
38034 .set_period = esp_set_period,
38035diff -urNp linux-2.6.39/drivers/scsi/fcoe/fcoe.c linux-2.6.39/drivers/scsi/fcoe/fcoe.c
38036--- linux-2.6.39/drivers/scsi/fcoe/fcoe.c 2011-05-19 00:06:34.000000000 -0400
38037+++ linux-2.6.39/drivers/scsi/fcoe/fcoe.c 2011-05-22 19:36:32.000000000 -0400
38038@@ -138,7 +138,7 @@ static int fcoe_vport_disable(struct fc_
38039 static void fcoe_set_vport_symbolic_name(struct fc_vport *);
38040 static void fcoe_set_port_id(struct fc_lport *, u32, struct fc_frame *);
38041
38042-static struct libfc_function_template fcoe_libfc_fcn_templ = {
38043+static const struct libfc_function_template fcoe_libfc_fcn_templ = {
38044 .frame_send = fcoe_xmit,
38045 .ddp_setup = fcoe_ddp_setup,
38046 .ddp_done = fcoe_ddp_done,
38047diff -urNp linux-2.6.39/drivers/scsi/fcoe/fcoe_ctlr.c linux-2.6.39/drivers/scsi/fcoe/fcoe_ctlr.c
38048--- linux-2.6.39/drivers/scsi/fcoe/fcoe_ctlr.c 2011-05-19 00:06:34.000000000 -0400
38049+++ linux-2.6.39/drivers/scsi/fcoe/fcoe_ctlr.c 2011-05-22 19:36:32.000000000 -0400
38050@@ -1912,7 +1912,7 @@ static void fcoe_ctlr_vn_rport_callback(
38051 mutex_unlock(&fip->ctlr_mutex);
38052 }
38053
38054-static struct fc_rport_operations fcoe_ctlr_vn_rport_ops = {
38055+static const struct fc_rport_operations fcoe_ctlr_vn_rport_ops = {
38056 .event_callback = fcoe_ctlr_vn_rport_callback,
38057 };
38058
38059@@ -2458,6 +2458,8 @@ static int fcoe_ctlr_vn_recv(struct fcoe
38060 } buf;
38061 int rc;
38062
38063+ pax_track_stack();
38064+
38065 fiph = (struct fip_header *)skb->data;
38066 sub = fiph->fip_subcode;
38067
38068diff -urNp linux-2.6.39/drivers/scsi/fnic/fnic_main.c linux-2.6.39/drivers/scsi/fnic/fnic_main.c
38069--- linux-2.6.39/drivers/scsi/fnic/fnic_main.c 2011-05-19 00:06:34.000000000 -0400
38070+++ linux-2.6.39/drivers/scsi/fnic/fnic_main.c 2011-05-22 19:36:32.000000000 -0400
38071@@ -69,7 +69,7 @@ module_param(fnic_log_level, int, S_IRUG
38072 MODULE_PARM_DESC(fnic_log_level, "bit mask of fnic logging levels");
38073
38074
38075-static struct libfc_function_template fnic_transport_template = {
38076+static const struct libfc_function_template fnic_transport_template = {
38077 .frame_send = fnic_send,
38078 .lport_set_port_id = fnic_set_port_id,
38079 .fcp_abort_io = fnic_empty_scsi_cleanup,
38080diff -urNp linux-2.6.39/drivers/scsi/gdth.c linux-2.6.39/drivers/scsi/gdth.c
38081--- linux-2.6.39/drivers/scsi/gdth.c 2011-05-19 00:06:34.000000000 -0400
38082+++ linux-2.6.39/drivers/scsi/gdth.c 2011-05-22 19:36:32.000000000 -0400
38083@@ -4107,6 +4107,8 @@ static int ioc_lockdrv(void __user *arg)
38084 unsigned long flags;
38085 gdth_ha_str *ha;
38086
38087+ pax_track_stack();
38088+
38089 if (copy_from_user(&ldrv, arg, sizeof(gdth_ioctl_lockdrv)))
38090 return -EFAULT;
38091 ha = gdth_find_ha(ldrv.ionode);
38092@@ -4139,6 +4141,8 @@ static int ioc_resetdrv(void __user *arg
38093 gdth_ha_str *ha;
38094 int rval;
38095
38096+ pax_track_stack();
38097+
38098 if (copy_from_user(&res, arg, sizeof(gdth_ioctl_reset)) ||
38099 res.number >= MAX_HDRIVES)
38100 return -EFAULT;
38101@@ -4174,6 +4178,8 @@ static int ioc_general(void __user *arg,
38102 gdth_ha_str *ha;
38103 int rval;
38104
38105+ pax_track_stack();
38106+
38107 if (copy_from_user(&gen, arg, sizeof(gdth_ioctl_general)))
38108 return -EFAULT;
38109 ha = gdth_find_ha(gen.ionode);
38110@@ -4642,6 +4648,9 @@ static void gdth_flush(gdth_ha_str *ha)
38111 int i;
38112 gdth_cmd_str gdtcmd;
38113 char cmnd[MAX_COMMAND_SIZE];
38114+
38115+ pax_track_stack();
38116+
38117 memset(cmnd, 0xff, MAX_COMMAND_SIZE);
38118
38119 TRACE2(("gdth_flush() hanum %d\n", ha->hanum));
38120diff -urNp linux-2.6.39/drivers/scsi/gdth_proc.c linux-2.6.39/drivers/scsi/gdth_proc.c
38121--- linux-2.6.39/drivers/scsi/gdth_proc.c 2011-05-19 00:06:34.000000000 -0400
38122+++ linux-2.6.39/drivers/scsi/gdth_proc.c 2011-05-22 19:36:32.000000000 -0400
38123@@ -47,6 +47,9 @@ static int gdth_set_asc_info(struct Scsi
38124 u64 paddr;
38125
38126 char cmnd[MAX_COMMAND_SIZE];
38127+
38128+ pax_track_stack();
38129+
38130 memset(cmnd, 0xff, 12);
38131 memset(&gdtcmd, 0, sizeof(gdth_cmd_str));
38132
38133@@ -175,6 +178,8 @@ static int gdth_get_info(char *buffer,ch
38134 gdth_hget_str *phg;
38135 char cmnd[MAX_COMMAND_SIZE];
38136
38137+ pax_track_stack();
38138+
38139 gdtcmd = kmalloc(sizeof(*gdtcmd), GFP_KERNEL);
38140 estr = kmalloc(sizeof(*estr), GFP_KERNEL);
38141 if (!gdtcmd || !estr)
38142diff -urNp linux-2.6.39/drivers/scsi/hosts.c linux-2.6.39/drivers/scsi/hosts.c
38143--- linux-2.6.39/drivers/scsi/hosts.c 2011-05-19 00:06:34.000000000 -0400
38144+++ linux-2.6.39/drivers/scsi/hosts.c 2011-05-22 19:36:32.000000000 -0400
38145@@ -42,7 +42,7 @@
38146 #include "scsi_logging.h"
38147
38148
38149-static atomic_t scsi_host_next_hn; /* host_no for next new host */
38150+static atomic_unchecked_t scsi_host_next_hn; /* host_no for next new host */
38151
38152
38153 static void scsi_host_cls_release(struct device *dev)
38154@@ -354,7 +354,7 @@ struct Scsi_Host *scsi_host_alloc(struct
38155 * subtract one because we increment first then return, but we need to
38156 * know what the next host number was before increment
38157 */
38158- shost->host_no = atomic_inc_return(&scsi_host_next_hn) - 1;
38159+ shost->host_no = atomic_inc_return_unchecked(&scsi_host_next_hn) - 1;
38160 shost->dma_channel = 0xff;
38161
38162 /* These three are default values which can be overridden */
38163diff -urNp linux-2.6.39/drivers/scsi/hpsa.h linux-2.6.39/drivers/scsi/hpsa.h
38164--- linux-2.6.39/drivers/scsi/hpsa.h 2011-05-19 00:06:34.000000000 -0400
38165+++ linux-2.6.39/drivers/scsi/hpsa.h 2011-05-22 19:36:32.000000000 -0400
38166@@ -347,7 +347,7 @@ static struct access_method SA5_access =
38167 SA5_completed,
38168 };
38169
38170-static struct access_method SA5_performant_access = {
38171+static const struct access_method SA5_performant_access = {
38172 SA5_submit_command,
38173 SA5_performant_intr_mask,
38174 SA5_fifo_full,
38175diff -urNp linux-2.6.39/drivers/scsi/hptiop.c linux-2.6.39/drivers/scsi/hptiop.c
38176--- linux-2.6.39/drivers/scsi/hptiop.c 2011-05-19 00:06:34.000000000 -0400
38177+++ linux-2.6.39/drivers/scsi/hptiop.c 2011-05-22 19:36:32.000000000 -0400
38178@@ -1226,7 +1226,7 @@ static void hptiop_remove(struct pci_dev
38179 scsi_host_put(host);
38180 }
38181
38182-static struct hptiop_adapter_ops hptiop_itl_ops = {
38183+static const struct hptiop_adapter_ops hptiop_itl_ops = {
38184 .iop_wait_ready = iop_wait_ready_itl,
38185 .internal_memalloc = NULL,
38186 .internal_memfree = NULL,
38187@@ -1241,7 +1241,7 @@ static struct hptiop_adapter_ops hptiop_
38188 .post_req = hptiop_post_req_itl,
38189 };
38190
38191-static struct hptiop_adapter_ops hptiop_mv_ops = {
38192+static const struct hptiop_adapter_ops hptiop_mv_ops = {
38193 .iop_wait_ready = iop_wait_ready_mv,
38194 .internal_memalloc = hptiop_internal_memalloc_mv,
38195 .internal_memfree = hptiop_internal_memfree_mv,
38196diff -urNp linux-2.6.39/drivers/scsi/ibmvscsi/ibmvfc.c linux-2.6.39/drivers/scsi/ibmvscsi/ibmvfc.c
38197--- linux-2.6.39/drivers/scsi/ibmvscsi/ibmvfc.c 2011-05-19 00:06:34.000000000 -0400
38198+++ linux-2.6.39/drivers/scsi/ibmvscsi/ibmvfc.c 2011-05-22 19:36:32.000000000 -0400
38199@@ -4881,7 +4881,7 @@ static struct vio_device_id ibmvfc_devic
38200 };
38201 MODULE_DEVICE_TABLE(vio, ibmvfc_device_table);
38202
38203-static struct dev_pm_ops ibmvfc_pm_ops = {
38204+static const struct dev_pm_ops ibmvfc_pm_ops = {
38205 .resume = ibmvfc_resume
38206 };
38207
38208diff -urNp linux-2.6.39/drivers/scsi/ibmvscsi/ibmvscsi.c linux-2.6.39/drivers/scsi/ibmvscsi/ibmvscsi.c
38209--- linux-2.6.39/drivers/scsi/ibmvscsi/ibmvscsi.c 2011-05-19 00:06:34.000000000 -0400
38210+++ linux-2.6.39/drivers/scsi/ibmvscsi/ibmvscsi.c 2011-05-22 19:36:32.000000000 -0400
38211@@ -104,7 +104,7 @@ static struct scsi_transport_template *i
38212
38213 #define IBMVSCSI_VERSION "1.5.9"
38214
38215-static struct ibmvscsi_ops *ibmvscsi_ops;
38216+static const struct ibmvscsi_ops *ibmvscsi_ops;
38217
38218 MODULE_DESCRIPTION("IBM Virtual SCSI");
38219 MODULE_AUTHOR("Dave Boutcher");
38220@@ -2059,7 +2059,7 @@ static struct vio_device_id ibmvscsi_dev
38221 };
38222 MODULE_DEVICE_TABLE(vio, ibmvscsi_device_table);
38223
38224-static struct dev_pm_ops ibmvscsi_pm_ops = {
38225+static const struct dev_pm_ops ibmvscsi_pm_ops = {
38226 .resume = ibmvscsi_resume
38227 };
38228
38229@@ -2075,7 +2075,7 @@ static struct vio_driver ibmvscsi_driver
38230 }
38231 };
38232
38233-static struct srp_function_template ibmvscsi_transport_functions = {
38234+static const struct srp_function_template ibmvscsi_transport_functions = {
38235 };
38236
38237 int __init ibmvscsi_module_init(void)
38238diff -urNp linux-2.6.39/drivers/scsi/ibmvscsi/ibmvscsi.h linux-2.6.39/drivers/scsi/ibmvscsi/ibmvscsi.h
38239--- linux-2.6.39/drivers/scsi/ibmvscsi/ibmvscsi.h 2011-05-19 00:06:34.000000000 -0400
38240+++ linux-2.6.39/drivers/scsi/ibmvscsi/ibmvscsi.h 2011-05-22 19:36:32.000000000 -0400
38241@@ -127,7 +127,7 @@ struct ibmvscsi_ops {
38242 int (*resume) (struct ibmvscsi_host_data *hostdata);
38243 };
38244
38245-extern struct ibmvscsi_ops iseriesvscsi_ops;
38246-extern struct ibmvscsi_ops rpavscsi_ops;
38247+extern const struct ibmvscsi_ops iseriesvscsi_ops;
38248+extern const struct ibmvscsi_ops rpavscsi_ops;
38249
38250 #endif /* IBMVSCSI_H */
38251diff -urNp linux-2.6.39/drivers/scsi/ibmvscsi/ibmvstgt.c linux-2.6.39/drivers/scsi/ibmvscsi/ibmvstgt.c
38252--- linux-2.6.39/drivers/scsi/ibmvscsi/ibmvstgt.c 2011-05-19 00:06:34.000000000 -0400
38253+++ linux-2.6.39/drivers/scsi/ibmvscsi/ibmvstgt.c 2011-05-22 19:36:32.000000000 -0400
38254@@ -951,7 +951,7 @@ static int get_system_info(void)
38255 return 0;
38256 }
38257
38258-static struct srp_function_template ibmvstgt_transport_functions = {
38259+static const struct srp_function_template ibmvstgt_transport_functions = {
38260 .tsk_mgmt_response = ibmvstgt_tsk_mgmt_response,
38261 .it_nexus_response = ibmvstgt_it_nexus_response,
38262 };
38263diff -urNp linux-2.6.39/drivers/scsi/ibmvscsi/iseries_vscsi.c linux-2.6.39/drivers/scsi/ibmvscsi/iseries_vscsi.c
38264--- linux-2.6.39/drivers/scsi/ibmvscsi/iseries_vscsi.c 2011-05-19 00:06:34.000000000 -0400
38265+++ linux-2.6.39/drivers/scsi/ibmvscsi/iseries_vscsi.c 2011-05-22 19:36:32.000000000 -0400
38266@@ -163,7 +163,7 @@ static int iseriesvscsi_resume(struct ib
38267 return 0;
38268 }
38269
38270-struct ibmvscsi_ops iseriesvscsi_ops = {
38271+const struct ibmvscsi_ops iseriesvscsi_ops = {
38272 .init_crq_queue = iseriesvscsi_init_crq_queue,
38273 .release_crq_queue = iseriesvscsi_release_crq_queue,
38274 .reset_crq_queue = iseriesvscsi_reset_crq_queue,
38275diff -urNp linux-2.6.39/drivers/scsi/ibmvscsi/rpa_vscsi.c linux-2.6.39/drivers/scsi/ibmvscsi/rpa_vscsi.c
38276--- linux-2.6.39/drivers/scsi/ibmvscsi/rpa_vscsi.c 2011-05-19 00:06:34.000000000 -0400
38277+++ linux-2.6.39/drivers/scsi/ibmvscsi/rpa_vscsi.c 2011-05-22 19:36:32.000000000 -0400
38278@@ -358,7 +358,7 @@ static int rpavscsi_resume(struct ibmvsc
38279 return 0;
38280 }
38281
38282-struct ibmvscsi_ops rpavscsi_ops = {
38283+const struct ibmvscsi_ops rpavscsi_ops = {
38284 .init_crq_queue = rpavscsi_init_crq_queue,
38285 .release_crq_queue = rpavscsi_release_crq_queue,
38286 .reset_crq_queue = rpavscsi_reset_crq_queue,
38287diff -urNp linux-2.6.39/drivers/scsi/ipr.c linux-2.6.39/drivers/scsi/ipr.c
38288--- linux-2.6.39/drivers/scsi/ipr.c 2011-05-19 00:06:34.000000000 -0400
38289+++ linux-2.6.39/drivers/scsi/ipr.c 2011-05-22 19:36:32.000000000 -0400
38290@@ -6210,7 +6210,7 @@ static bool ipr_qc_fill_rtf(struct ata_q
38291 return true;
38292 }
38293
38294-static struct ata_port_operations ipr_sata_ops = {
38295+static const struct ata_port_operations ipr_sata_ops = {
38296 .phy_reset = ipr_ata_phy_reset,
38297 .hardreset = ipr_sata_reset,
38298 .post_internal_cmd = ipr_ata_post_internal,
38299diff -urNp linux-2.6.39/drivers/scsi/libfc/fc_exch.c linux-2.6.39/drivers/scsi/libfc/fc_exch.c
38300--- linux-2.6.39/drivers/scsi/libfc/fc_exch.c 2011-05-19 00:06:34.000000000 -0400
38301+++ linux-2.6.39/drivers/scsi/libfc/fc_exch.c 2011-05-22 19:36:32.000000000 -0400
38302@@ -105,12 +105,12 @@ struct fc_exch_mgr {
38303 * all together if not used XXX
38304 */
38305 struct {
38306- atomic_t no_free_exch;
38307- atomic_t no_free_exch_xid;
38308- atomic_t xid_not_found;
38309- atomic_t xid_busy;
38310- atomic_t seq_not_found;
38311- atomic_t non_bls_resp;
38312+ atomic_unchecked_t no_free_exch;
38313+ atomic_unchecked_t no_free_exch_xid;
38314+ atomic_unchecked_t xid_not_found;
38315+ atomic_unchecked_t xid_busy;
38316+ atomic_unchecked_t seq_not_found;
38317+ atomic_unchecked_t non_bls_resp;
38318 } stats;
38319 };
38320
38321@@ -700,7 +700,7 @@ static struct fc_exch *fc_exch_em_alloc(
38322 /* allocate memory for exchange */
38323 ep = mempool_alloc(mp->ep_pool, GFP_ATOMIC);
38324 if (!ep) {
38325- atomic_inc(&mp->stats.no_free_exch);
38326+ atomic_inc_unchecked(&mp->stats.no_free_exch);
38327 goto out;
38328 }
38329 memset(ep, 0, sizeof(*ep));
38330@@ -761,7 +761,7 @@ out:
38331 return ep;
38332 err:
38333 spin_unlock_bh(&pool->lock);
38334- atomic_inc(&mp->stats.no_free_exch_xid);
38335+ atomic_inc_unchecked(&mp->stats.no_free_exch_xid);
38336 mempool_free(ep, mp->ep_pool);
38337 return NULL;
38338 }
38339@@ -906,7 +906,7 @@ static enum fc_pf_rjt_reason fc_seq_look
38340 xid = ntohs(fh->fh_ox_id); /* we originated exch */
38341 ep = fc_exch_find(mp, xid);
38342 if (!ep) {
38343- atomic_inc(&mp->stats.xid_not_found);
38344+ atomic_inc_unchecked(&mp->stats.xid_not_found);
38345 reject = FC_RJT_OX_ID;
38346 goto out;
38347 }
38348@@ -936,7 +936,7 @@ static enum fc_pf_rjt_reason fc_seq_look
38349 ep = fc_exch_find(mp, xid);
38350 if ((f_ctl & FC_FC_FIRST_SEQ) && fc_sof_is_init(fr_sof(fp))) {
38351 if (ep) {
38352- atomic_inc(&mp->stats.xid_busy);
38353+ atomic_inc_unchecked(&mp->stats.xid_busy);
38354 reject = FC_RJT_RX_ID;
38355 goto rel;
38356 }
38357@@ -947,7 +947,7 @@ static enum fc_pf_rjt_reason fc_seq_look
38358 }
38359 xid = ep->xid; /* get our XID */
38360 } else if (!ep) {
38361- atomic_inc(&mp->stats.xid_not_found);
38362+ atomic_inc_unchecked(&mp->stats.xid_not_found);
38363 reject = FC_RJT_RX_ID; /* XID not found */
38364 goto out;
38365 }
38366@@ -964,7 +964,7 @@ static enum fc_pf_rjt_reason fc_seq_look
38367 } else {
38368 sp = &ep->seq;
38369 if (sp->id != fh->fh_seq_id) {
38370- atomic_inc(&mp->stats.seq_not_found);
38371+ atomic_inc_unchecked(&mp->stats.seq_not_found);
38372 reject = FC_RJT_SEQ_ID; /* sequence/exch should exist */
38373 goto rel;
38374 }
38375@@ -1392,22 +1392,22 @@ static void fc_exch_recv_seq_resp(struct
38376
38377 ep = fc_exch_find(mp, ntohs(fh->fh_ox_id));
38378 if (!ep) {
38379- atomic_inc(&mp->stats.xid_not_found);
38380+ atomic_inc_unchecked(&mp->stats.xid_not_found);
38381 goto out;
38382 }
38383 if (ep->esb_stat & ESB_ST_COMPLETE) {
38384- atomic_inc(&mp->stats.xid_not_found);
38385+ atomic_inc_unchecked(&mp->stats.xid_not_found);
38386 goto rel;
38387 }
38388 if (ep->rxid == FC_XID_UNKNOWN)
38389 ep->rxid = ntohs(fh->fh_rx_id);
38390 if (ep->sid != 0 && ep->sid != ntoh24(fh->fh_d_id)) {
38391- atomic_inc(&mp->stats.xid_not_found);
38392+ atomic_inc_unchecked(&mp->stats.xid_not_found);
38393 goto rel;
38394 }
38395 if (ep->did != ntoh24(fh->fh_s_id) &&
38396 ep->did != FC_FID_FLOGI) {
38397- atomic_inc(&mp->stats.xid_not_found);
38398+ atomic_inc_unchecked(&mp->stats.xid_not_found);
38399 goto rel;
38400 }
38401 sof = fr_sof(fp);
38402@@ -1416,7 +1416,7 @@ static void fc_exch_recv_seq_resp(struct
38403 sp->ssb_stat |= SSB_ST_RESP;
38404 sp->id = fh->fh_seq_id;
38405 } else if (sp->id != fh->fh_seq_id) {
38406- atomic_inc(&mp->stats.seq_not_found);
38407+ atomic_inc_unchecked(&mp->stats.seq_not_found);
38408 goto rel;
38409 }
38410
38411@@ -1479,9 +1479,9 @@ static void fc_exch_recv_resp(struct fc_
38412 sp = fc_seq_lookup_orig(mp, fp); /* doesn't hold sequence */
38413
38414 if (!sp)
38415- atomic_inc(&mp->stats.xid_not_found);
38416+ atomic_inc_unchecked(&mp->stats.xid_not_found);
38417 else
38418- atomic_inc(&mp->stats.non_bls_resp);
38419+ atomic_inc_unchecked(&mp->stats.non_bls_resp);
38420
38421 fc_frame_free(fp);
38422 }
38423diff -urNp linux-2.6.39/drivers/scsi/libfc/fc_lport.c linux-2.6.39/drivers/scsi/libfc/fc_lport.c
38424--- linux-2.6.39/drivers/scsi/libfc/fc_lport.c 2011-05-19 00:06:34.000000000 -0400
38425+++ linux-2.6.39/drivers/scsi/libfc/fc_lport.c 2011-05-22 19:36:32.000000000 -0400
38426@@ -1299,7 +1299,7 @@ static void fc_lport_enter_ns(struct fc_
38427 fc_lport_error(lport, fp);
38428 }
38429
38430-static struct fc_rport_operations fc_lport_rport_ops = {
38431+static const struct fc_rport_operations fc_lport_rport_ops = {
38432 .event_callback = fc_lport_rport_callback,
38433 };
38434
38435diff -urNp linux-2.6.39/drivers/scsi/libfc/fc_rport.c linux-2.6.39/drivers/scsi/libfc/fc_rport.c
38436--- linux-2.6.39/drivers/scsi/libfc/fc_rport.c 2011-05-19 00:06:34.000000000 -0400
38437+++ linux-2.6.39/drivers/scsi/libfc/fc_rport.c 2011-05-22 19:36:32.000000000 -0400
38438@@ -256,7 +256,7 @@ static void fc_rport_work(struct work_st
38439 struct fc_rport_libfc_priv *rpriv;
38440 enum fc_rport_event event;
38441 struct fc_lport *lport = rdata->local_port;
38442- struct fc_rport_operations *rport_ops;
38443+ const struct fc_rport_operations *rport_ops;
38444 struct fc_rport_identifiers ids;
38445 struct fc_rport *rport;
38446 struct fc4_prov *prov;
38447diff -urNp linux-2.6.39/drivers/scsi/libsas/sas_ata.c linux-2.6.39/drivers/scsi/libsas/sas_ata.c
38448--- linux-2.6.39/drivers/scsi/libsas/sas_ata.c 2011-05-19 00:06:34.000000000 -0400
38449+++ linux-2.6.39/drivers/scsi/libsas/sas_ata.c 2011-05-22 19:36:32.000000000 -0400
38450@@ -307,14 +307,14 @@ static void sas_ata_post_internal(struct
38451 }
38452 }
38453
38454-static struct ata_port_operations sas_sata_ops = {
38455+static const struct ata_port_operations sas_sata_ops = {
38456 .prereset = ata_std_prereset,
38457 .softreset = NULL,
38458 .hardreset = sas_ata_hard_reset,
38459 .postreset = ata_std_postreset,
38460 .error_handler = ata_std_error_handler,
38461 .post_internal_cmd = sas_ata_post_internal,
38462- .qc_defer = ata_std_qc_defer,
38463+ .qc_defer = ata_std_qc_defer,
38464 .qc_prep = ata_noop_qc_prep,
38465 .qc_issue = sas_ata_qc_issue,
38466 .qc_fill_rtf = sas_ata_qc_fill_rtf,
38467diff -urNp linux-2.6.39/drivers/scsi/lpfc/lpfc_debugfs.c linux-2.6.39/drivers/scsi/lpfc/lpfc_debugfs.c
38468--- linux-2.6.39/drivers/scsi/lpfc/lpfc_debugfs.c 2011-05-19 00:06:34.000000000 -0400
38469+++ linux-2.6.39/drivers/scsi/lpfc/lpfc_debugfs.c 2011-05-22 19:36:32.000000000 -0400
38470@@ -104,7 +104,7 @@ MODULE_PARM_DESC(lpfc_debugfs_mask_disc_
38471
38472 #include <linux/debugfs.h>
38473
38474-static atomic_t lpfc_debugfs_seq_trc_cnt = ATOMIC_INIT(0);
38475+static atomic_unchecked_t lpfc_debugfs_seq_trc_cnt = ATOMIC_INIT(0);
38476 static unsigned long lpfc_debugfs_start_time = 0L;
38477
38478 /* iDiag */
38479@@ -141,7 +141,7 @@ lpfc_debugfs_disc_trc_data(struct lpfc_v
38480 lpfc_debugfs_enable = 0;
38481
38482 len = 0;
38483- index = (atomic_read(&vport->disc_trc_cnt) + 1) &
38484+ index = (atomic_read_unchecked(&vport->disc_trc_cnt) + 1) &
38485 (lpfc_debugfs_max_disc_trc - 1);
38486 for (i = index; i < lpfc_debugfs_max_disc_trc; i++) {
38487 dtp = vport->disc_trc + i;
38488@@ -202,7 +202,7 @@ lpfc_debugfs_slow_ring_trc_data(struct l
38489 lpfc_debugfs_enable = 0;
38490
38491 len = 0;
38492- index = (atomic_read(&phba->slow_ring_trc_cnt) + 1) &
38493+ index = (atomic_read_unchecked(&phba->slow_ring_trc_cnt) + 1) &
38494 (lpfc_debugfs_max_slow_ring_trc - 1);
38495 for (i = index; i < lpfc_debugfs_max_slow_ring_trc; i++) {
38496 dtp = phba->slow_ring_trc + i;
38497@@ -380,6 +380,8 @@ lpfc_debugfs_dumpHBASlim_data(struct lpf
38498 uint32_t *ptr;
38499 char buffer[1024];
38500
38501+ pax_track_stack();
38502+
38503 off = 0;
38504 spin_lock_irq(&phba->hbalock);
38505
38506@@ -617,14 +619,14 @@ lpfc_debugfs_disc_trc(struct lpfc_vport
38507 !vport || !vport->disc_trc)
38508 return;
38509
38510- index = atomic_inc_return(&vport->disc_trc_cnt) &
38511+ index = atomic_inc_return_unchecked(&vport->disc_trc_cnt) &
38512 (lpfc_debugfs_max_disc_trc - 1);
38513 dtp = vport->disc_trc + index;
38514 dtp->fmt = fmt;
38515 dtp->data1 = data1;
38516 dtp->data2 = data2;
38517 dtp->data3 = data3;
38518- dtp->seq_cnt = atomic_inc_return(&lpfc_debugfs_seq_trc_cnt);
38519+ dtp->seq_cnt = atomic_inc_return_unchecked(&lpfc_debugfs_seq_trc_cnt);
38520 dtp->jif = jiffies;
38521 #endif
38522 return;
38523@@ -655,14 +657,14 @@ lpfc_debugfs_slow_ring_trc(struct lpfc_h
38524 !phba || !phba->slow_ring_trc)
38525 return;
38526
38527- index = atomic_inc_return(&phba->slow_ring_trc_cnt) &
38528+ index = atomic_inc_return_unchecked(&phba->slow_ring_trc_cnt) &
38529 (lpfc_debugfs_max_slow_ring_trc - 1);
38530 dtp = phba->slow_ring_trc + index;
38531 dtp->fmt = fmt;
38532 dtp->data1 = data1;
38533 dtp->data2 = data2;
38534 dtp->data3 = data3;
38535- dtp->seq_cnt = atomic_inc_return(&lpfc_debugfs_seq_trc_cnt);
38536+ dtp->seq_cnt = atomic_inc_return_unchecked(&lpfc_debugfs_seq_trc_cnt);
38537 dtp->jif = jiffies;
38538 #endif
38539 return;
38540@@ -2145,7 +2147,7 @@ lpfc_debugfs_initialize(struct lpfc_vpor
38541 "slow_ring buffer\n");
38542 goto debug_failed;
38543 }
38544- atomic_set(&phba->slow_ring_trc_cnt, 0);
38545+ atomic_set_unchecked(&phba->slow_ring_trc_cnt, 0);
38546 memset(phba->slow_ring_trc, 0,
38547 (sizeof(struct lpfc_debugfs_trc) *
38548 lpfc_debugfs_max_slow_ring_trc));
38549@@ -2191,7 +2193,7 @@ lpfc_debugfs_initialize(struct lpfc_vpor
38550 "buffer\n");
38551 goto debug_failed;
38552 }
38553- atomic_set(&vport->disc_trc_cnt, 0);
38554+ atomic_set_unchecked(&vport->disc_trc_cnt, 0);
38555
38556 snprintf(name, sizeof(name), "discovery_trace");
38557 vport->debug_disc_trc =
38558diff -urNp linux-2.6.39/drivers/scsi/lpfc/lpfc.h linux-2.6.39/drivers/scsi/lpfc/lpfc.h
38559--- linux-2.6.39/drivers/scsi/lpfc/lpfc.h 2011-05-19 00:06:34.000000000 -0400
38560+++ linux-2.6.39/drivers/scsi/lpfc/lpfc.h 2011-05-22 19:36:32.000000000 -0400
38561@@ -419,7 +419,7 @@ struct lpfc_vport {
38562 struct dentry *debug_nodelist;
38563 struct dentry *vport_debugfs_root;
38564 struct lpfc_debugfs_trc *disc_trc;
38565- atomic_t disc_trc_cnt;
38566+ atomic_unchecked_t disc_trc_cnt;
38567 #endif
38568 uint8_t stat_data_enabled;
38569 uint8_t stat_data_blocked;
38570@@ -785,8 +785,8 @@ struct lpfc_hba {
38571 struct timer_list fabric_block_timer;
38572 unsigned long bit_flags;
38573 #define FABRIC_COMANDS_BLOCKED 0
38574- atomic_t num_rsrc_err;
38575- atomic_t num_cmd_success;
38576+ atomic_unchecked_t num_rsrc_err;
38577+ atomic_unchecked_t num_cmd_success;
38578 unsigned long last_rsrc_error_time;
38579 unsigned long last_ramp_down_time;
38580 unsigned long last_ramp_up_time;
38581@@ -800,7 +800,7 @@ struct lpfc_hba {
38582 struct dentry *debug_dumpDif; /* BlockGuard BPL*/
38583 struct dentry *debug_slow_ring_trc;
38584 struct lpfc_debugfs_trc *slow_ring_trc;
38585- atomic_t slow_ring_trc_cnt;
38586+ atomic_unchecked_t slow_ring_trc_cnt;
38587 /* iDiag debugfs sub-directory */
38588 struct dentry *idiag_root;
38589 struct dentry *idiag_pci_cfg;
38590diff -urNp linux-2.6.39/drivers/scsi/lpfc/lpfc_scsi.c linux-2.6.39/drivers/scsi/lpfc/lpfc_scsi.c
38591--- linux-2.6.39/drivers/scsi/lpfc/lpfc_scsi.c 2011-05-19 00:06:34.000000000 -0400
38592+++ linux-2.6.39/drivers/scsi/lpfc/lpfc_scsi.c 2011-05-22 19:36:32.000000000 -0400
38593@@ -297,7 +297,7 @@ lpfc_rampdown_queue_depth(struct lpfc_hb
38594 uint32_t evt_posted;
38595
38596 spin_lock_irqsave(&phba->hbalock, flags);
38597- atomic_inc(&phba->num_rsrc_err);
38598+ atomic_inc_unchecked(&phba->num_rsrc_err);
38599 phba->last_rsrc_error_time = jiffies;
38600
38601 if ((phba->last_ramp_down_time + QUEUE_RAMP_DOWN_INTERVAL) > jiffies) {
38602@@ -338,7 +338,7 @@ lpfc_rampup_queue_depth(struct lpfc_vpor
38603 unsigned long flags;
38604 struct lpfc_hba *phba = vport->phba;
38605 uint32_t evt_posted;
38606- atomic_inc(&phba->num_cmd_success);
38607+ atomic_inc_unchecked(&phba->num_cmd_success);
38608
38609 if (vport->cfg_lun_queue_depth <= queue_depth)
38610 return;
38611@@ -382,8 +382,8 @@ lpfc_ramp_down_queue_handler(struct lpfc
38612 unsigned long num_rsrc_err, num_cmd_success;
38613 int i;
38614
38615- num_rsrc_err = atomic_read(&phba->num_rsrc_err);
38616- num_cmd_success = atomic_read(&phba->num_cmd_success);
38617+ num_rsrc_err = atomic_read_unchecked(&phba->num_rsrc_err);
38618+ num_cmd_success = atomic_read_unchecked(&phba->num_cmd_success);
38619
38620 vports = lpfc_create_vport_work_array(phba);
38621 if (vports != NULL)
38622@@ -403,8 +403,8 @@ lpfc_ramp_down_queue_handler(struct lpfc
38623 }
38624 }
38625 lpfc_destroy_vport_work_array(phba, vports);
38626- atomic_set(&phba->num_rsrc_err, 0);
38627- atomic_set(&phba->num_cmd_success, 0);
38628+ atomic_set_unchecked(&phba->num_rsrc_err, 0);
38629+ atomic_set_unchecked(&phba->num_cmd_success, 0);
38630 }
38631
38632 /**
38633@@ -438,8 +438,8 @@ lpfc_ramp_up_queue_handler(struct lpfc_h
38634 }
38635 }
38636 lpfc_destroy_vport_work_array(phba, vports);
38637- atomic_set(&phba->num_rsrc_err, 0);
38638- atomic_set(&phba->num_cmd_success, 0);
38639+ atomic_set_unchecked(&phba->num_rsrc_err, 0);
38640+ atomic_set_unchecked(&phba->num_cmd_success, 0);
38641 }
38642
38643 /**
38644diff -urNp linux-2.6.39/drivers/scsi/mac_esp.c linux-2.6.39/drivers/scsi/mac_esp.c
38645--- linux-2.6.39/drivers/scsi/mac_esp.c 2011-05-19 00:06:34.000000000 -0400
38646+++ linux-2.6.39/drivers/scsi/mac_esp.c 2011-05-22 19:36:32.000000000 -0400
38647@@ -473,7 +473,7 @@ static irqreturn_t mac_scsi_esp_intr(int
38648 return IRQ_HANDLED;
38649 }
38650
38651-static struct esp_driver_ops mac_esp_ops = {
38652+static const struct esp_driver_ops mac_esp_ops = {
38653 .esp_write8 = mac_esp_write8,
38654 .esp_read8 = mac_esp_read8,
38655 .map_single = mac_esp_map_single,
38656diff -urNp linux-2.6.39/drivers/scsi/megaraid/megaraid_mbox.c linux-2.6.39/drivers/scsi/megaraid/megaraid_mbox.c
38657--- linux-2.6.39/drivers/scsi/megaraid/megaraid_mbox.c 2011-05-19 00:06:34.000000000 -0400
38658+++ linux-2.6.39/drivers/scsi/megaraid/megaraid_mbox.c 2011-05-22 19:36:32.000000000 -0400
38659@@ -3510,6 +3510,8 @@ megaraid_cmm_register(adapter_t *adapter
38660 int rval;
38661 int i;
38662
38663+ pax_track_stack();
38664+
38665 // Allocate memory for the base list of scb for management module.
38666 adapter->uscb_list = kcalloc(MBOX_MAX_USER_CMDS, sizeof(scb_t), GFP_KERNEL);
38667
38668diff -urNp linux-2.6.39/drivers/scsi/megaraid/megaraid_sas_base.c linux-2.6.39/drivers/scsi/megaraid/megaraid_sas_base.c
38669--- linux-2.6.39/drivers/scsi/megaraid/megaraid_sas_base.c 2011-05-19 00:06:34.000000000 -0400
38670+++ linux-2.6.39/drivers/scsi/megaraid/megaraid_sas_base.c 2011-05-22 19:36:32.000000000 -0400
38671@@ -366,7 +366,7 @@ megasas_check_reset_xscale(struct megasa
38672 return 0;
38673 }
38674
38675-static struct megasas_instance_template megasas_instance_template_xscale = {
38676+static const struct megasas_instance_template megasas_instance_template_xscale = {
38677
38678 .fire_cmd = megasas_fire_cmd_xscale,
38679 .enable_intr = megasas_enable_intr_xscale,
38680@@ -497,7 +497,7 @@ megasas_check_reset_ppc(struct megasas_i
38681 {
38682 return 0;
38683 }
38684-static struct megasas_instance_template megasas_instance_template_ppc = {
38685+static const struct megasas_instance_template megasas_instance_template_ppc = {
38686
38687 .fire_cmd = megasas_fire_cmd_ppc,
38688 .enable_intr = megasas_enable_intr_ppc,
38689@@ -623,7 +623,7 @@ megasas_check_reset_skinny(struct megasa
38690 return 0;
38691 }
38692
38693-static struct megasas_instance_template megasas_instance_template_skinny = {
38694+static const struct megasas_instance_template megasas_instance_template_skinny = {
38695
38696 .fire_cmd = megasas_fire_cmd_skinny,
38697 .enable_intr = megasas_enable_intr_skinny,
38698@@ -810,7 +810,7 @@ megasas_check_reset_gen2(struct megasas_
38699 return 0;
38700 }
38701
38702-static struct megasas_instance_template megasas_instance_template_gen2 = {
38703+static const struct megasas_instance_template megasas_instance_template_gen2 = {
38704
38705 .fire_cmd = megasas_fire_cmd_gen2,
38706 .enable_intr = megasas_enable_intr_gen2,
38707@@ -834,7 +834,7 @@ static struct megasas_instance_template
38708 /*
38709 * Template added for TB (Fusion)
38710 */
38711-extern struct megasas_instance_template megasas_instance_template_fusion;
38712+extern const struct megasas_instance_template megasas_instance_template_fusion;
38713
38714 /**
38715 * megasas_issue_polled - Issues a polling command
38716diff -urNp linux-2.6.39/drivers/scsi/megaraid/megaraid_sas_fusion.c linux-2.6.39/drivers/scsi/megaraid/megaraid_sas_fusion.c
38717--- linux-2.6.39/drivers/scsi/megaraid/megaraid_sas_fusion.c 2011-05-19 00:06:34.000000000 -0400
38718+++ linux-2.6.39/drivers/scsi/megaraid/megaraid_sas_fusion.c 2011-05-22 19:36:32.000000000 -0400
38719@@ -2236,7 +2236,7 @@ void megasas_fusion_ocr_wq(struct work_s
38720 megasas_reset_fusion(instance->host);
38721 }
38722
38723-struct megasas_instance_template megasas_instance_template_fusion = {
38724+const struct megasas_instance_template megasas_instance_template_fusion = {
38725 .fire_cmd = megasas_fire_cmd_fusion,
38726 .enable_intr = megasas_enable_intr_fusion,
38727 .disable_intr = megasas_disable_intr_fusion,
38728diff -urNp linux-2.6.39/drivers/scsi/megaraid/megaraid_sas.h linux-2.6.39/drivers/scsi/megaraid/megaraid_sas.h
38729--- linux-2.6.39/drivers/scsi/megaraid/megaraid_sas.h 2011-05-19 00:06:34.000000000 -0400
38730+++ linux-2.6.39/drivers/scsi/megaraid/megaraid_sas.h 2011-05-22 19:36:32.000000000 -0400
38731@@ -1330,7 +1330,7 @@ struct megasas_instance {
38732 atomic_t fw_outstanding;
38733 atomic_t fw_reset_no_pci_access;
38734
38735- struct megasas_instance_template *instancet;
38736+ const struct megasas_instance_template *instancet;
38737 struct tasklet_struct isr_tasklet;
38738 struct work_struct work_init;
38739
38740diff -urNp linux-2.6.39/drivers/scsi/ncr53c8xx.c linux-2.6.39/drivers/scsi/ncr53c8xx.c
38741--- linux-2.6.39/drivers/scsi/ncr53c8xx.c 2011-05-19 00:06:34.000000000 -0400
38742+++ linux-2.6.39/drivers/scsi/ncr53c8xx.c 2011-05-22 19:36:32.000000000 -0400
38743@@ -8606,7 +8606,7 @@ static void ncr53c8xx_get_signalling(str
38744 spi_signalling(shost) = type;
38745 }
38746
38747-static struct spi_function_template ncr53c8xx_transport_functions = {
38748+static struct spi_function_template ncr53c8xx_transport_functions = {
38749 .set_period = ncr53c8xx_set_period,
38750 .show_period = 1,
38751 .set_offset = ncr53c8xx_set_offset,
38752diff -urNp linux-2.6.39/drivers/scsi/osd/osd_initiator.c linux-2.6.39/drivers/scsi/osd/osd_initiator.c
38753--- linux-2.6.39/drivers/scsi/osd/osd_initiator.c 2011-05-19 00:06:34.000000000 -0400
38754+++ linux-2.6.39/drivers/scsi/osd/osd_initiator.c 2011-05-22 19:36:32.000000000 -0400
38755@@ -97,6 +97,8 @@ static int _osd_get_print_system_info(st
38756 int nelem = ARRAY_SIZE(get_attrs), a = 0;
38757 int ret;
38758
38759+ pax_track_stack();
38760+
38761 or = osd_start_request(od, GFP_KERNEL);
38762 if (!or)
38763 return -ENOMEM;
38764diff -urNp linux-2.6.39/drivers/scsi/pmcraid.c linux-2.6.39/drivers/scsi/pmcraid.c
38765--- linux-2.6.39/drivers/scsi/pmcraid.c 2011-05-19 00:06:34.000000000 -0400
38766+++ linux-2.6.39/drivers/scsi/pmcraid.c 2011-05-22 19:36:32.000000000 -0400
38767@@ -201,8 +201,8 @@ static int pmcraid_slave_alloc(struct sc
38768 res->scsi_dev = scsi_dev;
38769 scsi_dev->hostdata = res;
38770 res->change_detected = 0;
38771- atomic_set(&res->read_failures, 0);
38772- atomic_set(&res->write_failures, 0);
38773+ atomic_set_unchecked(&res->read_failures, 0);
38774+ atomic_set_unchecked(&res->write_failures, 0);
38775 rc = 0;
38776 }
38777 spin_unlock_irqrestore(&pinstance->resource_lock, lock_flags);
38778@@ -2677,9 +2677,9 @@ static int pmcraid_error_handler(struct
38779
38780 /* If this was a SCSI read/write command keep count of errors */
38781 if (SCSI_CMD_TYPE(scsi_cmd->cmnd[0]) == SCSI_READ_CMD)
38782- atomic_inc(&res->read_failures);
38783+ atomic_inc_unchecked(&res->read_failures);
38784 else if (SCSI_CMD_TYPE(scsi_cmd->cmnd[0]) == SCSI_WRITE_CMD)
38785- atomic_inc(&res->write_failures);
38786+ atomic_inc_unchecked(&res->write_failures);
38787
38788 if (!RES_IS_GSCSI(res->cfg_entry) &&
38789 masked_ioasc != PMCRAID_IOASC_HW_DEVICE_BUS_STATUS_ERROR) {
38790@@ -3535,7 +3535,7 @@ static int pmcraid_queuecommand_lck(
38791 * block of scsi_cmd which is re-used (e.g. cancel/abort), which uses
38792 * hrrq_id assigned here in queuecommand
38793 */
38794- ioarcb->hrrq_id = atomic_add_return(1, &(pinstance->last_message_id)) %
38795+ ioarcb->hrrq_id = atomic_add_return_unchecked(1, &(pinstance->last_message_id)) %
38796 pinstance->num_hrrq;
38797 cmd->cmd_done = pmcraid_io_done;
38798
38799@@ -3860,7 +3860,7 @@ static long pmcraid_ioctl_passthrough(
38800 * block of scsi_cmd which is re-used (e.g. cancel/abort), which uses
38801 * hrrq_id assigned here in queuecommand
38802 */
38803- ioarcb->hrrq_id = atomic_add_return(1, &(pinstance->last_message_id)) %
38804+ ioarcb->hrrq_id = atomic_add_return_unchecked(1, &(pinstance->last_message_id)) %
38805 pinstance->num_hrrq;
38806
38807 if (request_size) {
38808@@ -4495,7 +4495,7 @@ static void pmcraid_worker_function(stru
38809
38810 pinstance = container_of(workp, struct pmcraid_instance, worker_q);
38811 /* add resources only after host is added into system */
38812- if (!atomic_read(&pinstance->expose_resources))
38813+ if (!atomic_read_unchecked(&pinstance->expose_resources))
38814 return;
38815
38816 fw_version = be16_to_cpu(pinstance->inq_data->fw_version);
38817@@ -5329,8 +5329,8 @@ static int __devinit pmcraid_init_instan
38818 init_waitqueue_head(&pinstance->reset_wait_q);
38819
38820 atomic_set(&pinstance->outstanding_cmds, 0);
38821- atomic_set(&pinstance->last_message_id, 0);
38822- atomic_set(&pinstance->expose_resources, 0);
38823+ atomic_set_unchecked(&pinstance->last_message_id, 0);
38824+ atomic_set_unchecked(&pinstance->expose_resources, 0);
38825
38826 INIT_LIST_HEAD(&pinstance->free_res_q);
38827 INIT_LIST_HEAD(&pinstance->used_res_q);
38828@@ -6045,7 +6045,7 @@ static int __devinit pmcraid_probe(
38829 /* Schedule worker thread to handle CCN and take care of adding and
38830 * removing devices to OS
38831 */
38832- atomic_set(&pinstance->expose_resources, 1);
38833+ atomic_set_unchecked(&pinstance->expose_resources, 1);
38834 schedule_work(&pinstance->worker_q);
38835 return rc;
38836
38837diff -urNp linux-2.6.39/drivers/scsi/pmcraid.h linux-2.6.39/drivers/scsi/pmcraid.h
38838--- linux-2.6.39/drivers/scsi/pmcraid.h 2011-05-19 00:06:34.000000000 -0400
38839+++ linux-2.6.39/drivers/scsi/pmcraid.h 2011-05-22 19:36:32.000000000 -0400
38840@@ -750,7 +750,7 @@ struct pmcraid_instance {
38841 struct pmcraid_isr_param hrrq_vector[PMCRAID_NUM_MSIX_VECTORS];
38842
38843 /* Message id as filled in last fired IOARCB, used to identify HRRQ */
38844- atomic_t last_message_id;
38845+ atomic_unchecked_t last_message_id;
38846
38847 /* configuration table */
38848 struct pmcraid_config_table *cfg_table;
38849@@ -779,7 +779,7 @@ struct pmcraid_instance {
38850 atomic_t outstanding_cmds;
38851
38852 /* should add/delete resources to mid-layer now ?*/
38853- atomic_t expose_resources;
38854+ atomic_unchecked_t expose_resources;
38855
38856
38857
38858@@ -815,8 +815,8 @@ struct pmcraid_resource_entry {
38859 struct pmcraid_config_table_entry_ext cfg_entry_ext;
38860 };
38861 struct scsi_device *scsi_dev; /* Link scsi_device structure */
38862- atomic_t read_failures; /* count of failed READ commands */
38863- atomic_t write_failures; /* count of failed WRITE commands */
38864+ atomic_unchecked_t read_failures; /* count of failed READ commands */
38865+ atomic_unchecked_t write_failures; /* count of failed WRITE commands */
38866
38867 /* To indicate add/delete/modify during CCN */
38868 u8 change_detected;
38869diff -urNp linux-2.6.39/drivers/scsi/qla2xxx/qla_os.c linux-2.6.39/drivers/scsi/qla2xxx/qla_os.c
38870--- linux-2.6.39/drivers/scsi/qla2xxx/qla_os.c 2011-05-19 00:06:34.000000000 -0400
38871+++ linux-2.6.39/drivers/scsi/qla2xxx/qla_os.c 2011-05-22 19:36:32.000000000 -0400
38872@@ -4097,7 +4097,7 @@ static struct pci_driver qla2xxx_pci_dri
38873 .err_handler = &qla2xxx_err_handler,
38874 };
38875
38876-static struct file_operations apidev_fops = {
38877+static const struct file_operations apidev_fops = {
38878 .owner = THIS_MODULE,
38879 .llseek = noop_llseek,
38880 };
38881diff -urNp linux-2.6.39/drivers/scsi/qla4xxx/ql4_def.h linux-2.6.39/drivers/scsi/qla4xxx/ql4_def.h
38882--- linux-2.6.39/drivers/scsi/qla4xxx/ql4_def.h 2011-05-19 00:06:34.000000000 -0400
38883+++ linux-2.6.39/drivers/scsi/qla4xxx/ql4_def.h 2011-05-22 19:36:32.000000000 -0400
38884@@ -256,7 +256,7 @@ struct ddb_entry {
38885 atomic_t retry_relogin_timer; /* Min Time between relogins
38886 * (4000 only) */
38887 atomic_t relogin_timer; /* Max Time to wait for relogin to complete */
38888- atomic_t relogin_retry_count; /* Num of times relogin has been
38889+ atomic_unchecked_t relogin_retry_count; /* Num of times relogin has been
38890 * retried */
38891
38892 uint16_t port;
38893diff -urNp linux-2.6.39/drivers/scsi/qla4xxx/ql4_init.c linux-2.6.39/drivers/scsi/qla4xxx/ql4_init.c
38894--- linux-2.6.39/drivers/scsi/qla4xxx/ql4_init.c 2011-05-19 00:06:34.000000000 -0400
38895+++ linux-2.6.39/drivers/scsi/qla4xxx/ql4_init.c 2011-05-22 19:36:32.000000000 -0400
38896@@ -680,7 +680,7 @@ static struct ddb_entry * qla4xxx_alloc_
38897 ddb_entry->fw_ddb_index = fw_ddb_index;
38898 atomic_set(&ddb_entry->retry_relogin_timer, INVALID_ENTRY);
38899 atomic_set(&ddb_entry->relogin_timer, 0);
38900- atomic_set(&ddb_entry->relogin_retry_count, 0);
38901+ atomic_set_unchecked(&ddb_entry->relogin_retry_count, 0);
38902 atomic_set(&ddb_entry->state, DDB_STATE_ONLINE);
38903 list_add_tail(&ddb_entry->list, &ha->ddb_list);
38904 ha->fw_ddb_index_map[fw_ddb_index] = ddb_entry;
38905@@ -1433,7 +1433,7 @@ int qla4xxx_process_ddb_changed(struct s
38906 if ((ddb_entry->fw_ddb_device_state == DDB_DS_SESSION_ACTIVE) &&
38907 (atomic_read(&ddb_entry->state) != DDB_STATE_ONLINE)) {
38908 atomic_set(&ddb_entry->state, DDB_STATE_ONLINE);
38909- atomic_set(&ddb_entry->relogin_retry_count, 0);
38910+ atomic_set_unchecked(&ddb_entry->relogin_retry_count, 0);
38911 atomic_set(&ddb_entry->relogin_timer, 0);
38912 clear_bit(DF_RELOGIN, &ddb_entry->flags);
38913 iscsi_unblock_session(ddb_entry->sess);
38914diff -urNp linux-2.6.39/drivers/scsi/qla4xxx/ql4_os.c linux-2.6.39/drivers/scsi/qla4xxx/ql4_os.c
38915--- linux-2.6.39/drivers/scsi/qla4xxx/ql4_os.c 2011-05-19 00:06:34.000000000 -0400
38916+++ linux-2.6.39/drivers/scsi/qla4xxx/ql4_os.c 2011-05-22 19:36:32.000000000 -0400
38917@@ -802,13 +802,13 @@ static void qla4xxx_timer(struct scsi_ql
38918 ddb_entry->fw_ddb_device_state ==
38919 DDB_DS_SESSION_FAILED) {
38920 /* Reset retry relogin timer */
38921- atomic_inc(&ddb_entry->relogin_retry_count);
38922+ atomic_inc_unchecked(&ddb_entry->relogin_retry_count);
38923 DEBUG2(printk("scsi%ld: ddb [%d] relogin"
38924 " timed out-retrying"
38925 " relogin (%d)\n",
38926 ha->host_no,
38927 ddb_entry->fw_ddb_index,
38928- atomic_read(&ddb_entry->
38929+ atomic_read_unchecked(&ddb_entry->
38930 relogin_retry_count))
38931 );
38932 start_dpc++;
38933diff -urNp linux-2.6.39/drivers/scsi/scsi.c linux-2.6.39/drivers/scsi/scsi.c
38934--- linux-2.6.39/drivers/scsi/scsi.c 2011-05-19 00:06:34.000000000 -0400
38935+++ linux-2.6.39/drivers/scsi/scsi.c 2011-05-22 19:36:32.000000000 -0400
38936@@ -655,7 +655,7 @@ int scsi_dispatch_cmd(struct scsi_cmnd *
38937 unsigned long timeout;
38938 int rtn = 0;
38939
38940- atomic_inc(&cmd->device->iorequest_cnt);
38941+ atomic_inc_unchecked(&cmd->device->iorequest_cnt);
38942
38943 /* check if the device is still usable */
38944 if (unlikely(cmd->device->sdev_state == SDEV_DEL)) {
38945diff -urNp linux-2.6.39/drivers/scsi/scsi_debug.c linux-2.6.39/drivers/scsi/scsi_debug.c
38946--- linux-2.6.39/drivers/scsi/scsi_debug.c 2011-05-19 00:06:34.000000000 -0400
38947+++ linux-2.6.39/drivers/scsi/scsi_debug.c 2011-05-22 19:36:32.000000000 -0400
38948@@ -1493,6 +1493,8 @@ static int resp_mode_select(struct scsi_
38949 unsigned char arr[SDEBUG_MAX_MSELECT_SZ];
38950 unsigned char *cmd = (unsigned char *)scp->cmnd;
38951
38952+ pax_track_stack();
38953+
38954 if ((errsts = check_readiness(scp, 1, devip)))
38955 return errsts;
38956 memset(arr, 0, sizeof(arr));
38957@@ -1590,6 +1592,8 @@ static int resp_log_sense(struct scsi_cm
38958 unsigned char arr[SDEBUG_MAX_LSENSE_SZ];
38959 unsigned char *cmd = (unsigned char *)scp->cmnd;
38960
38961+ pax_track_stack();
38962+
38963 if ((errsts = check_readiness(scp, 1, devip)))
38964 return errsts;
38965 memset(arr, 0, sizeof(arr));
38966diff -urNp linux-2.6.39/drivers/scsi/scsi_lib.c linux-2.6.39/drivers/scsi/scsi_lib.c
38967--- linux-2.6.39/drivers/scsi/scsi_lib.c 2011-05-19 00:06:34.000000000 -0400
38968+++ linux-2.6.39/drivers/scsi/scsi_lib.c 2011-05-22 19:36:32.000000000 -0400
38969@@ -1410,7 +1410,7 @@ static void scsi_kill_request(struct req
38970 shost = sdev->host;
38971 scsi_init_cmd_errh(cmd);
38972 cmd->result = DID_NO_CONNECT << 16;
38973- atomic_inc(&cmd->device->iorequest_cnt);
38974+ atomic_inc_unchecked(&cmd->device->iorequest_cnt);
38975
38976 /*
38977 * SCSI request completion path will do scsi_device_unbusy(),
38978@@ -1436,9 +1436,9 @@ static void scsi_softirq_done(struct req
38979
38980 INIT_LIST_HEAD(&cmd->eh_entry);
38981
38982- atomic_inc(&cmd->device->iodone_cnt);
38983+ atomic_inc_unchecked(&cmd->device->iodone_cnt);
38984 if (cmd->result)
38985- atomic_inc(&cmd->device->ioerr_cnt);
38986+ atomic_inc_unchecked(&cmd->device->ioerr_cnt);
38987
38988 disposition = scsi_decide_disposition(cmd);
38989 if (disposition != SUCCESS &&
38990diff -urNp linux-2.6.39/drivers/scsi/scsi_sysfs.c linux-2.6.39/drivers/scsi/scsi_sysfs.c
38991--- linux-2.6.39/drivers/scsi/scsi_sysfs.c 2011-05-19 00:06:34.000000000 -0400
38992+++ linux-2.6.39/drivers/scsi/scsi_sysfs.c 2011-05-22 19:36:32.000000000 -0400
38993@@ -621,7 +621,7 @@ show_iostat_##field(struct device *dev,
38994 char *buf) \
38995 { \
38996 struct scsi_device *sdev = to_scsi_device(dev); \
38997- unsigned long long count = atomic_read(&sdev->field); \
38998+ unsigned long long count = atomic_read_unchecked(&sdev->field); \
38999 return snprintf(buf, 20, "0x%llx\n", count); \
39000 } \
39001 static DEVICE_ATTR(field, S_IRUGO, show_iostat_##field, NULL)
39002diff -urNp linux-2.6.39/drivers/scsi/scsi_transport_fc.c linux-2.6.39/drivers/scsi/scsi_transport_fc.c
39003--- linux-2.6.39/drivers/scsi/scsi_transport_fc.c 2011-05-19 00:06:34.000000000 -0400
39004+++ linux-2.6.39/drivers/scsi/scsi_transport_fc.c 2011-05-22 19:36:32.000000000 -0400
39005@@ -485,7 +485,7 @@ static DECLARE_TRANSPORT_CLASS(fc_vport_
39006 * Netlink Infrastructure
39007 */
39008
39009-static atomic_t fc_event_seq;
39010+static atomic_unchecked_t fc_event_seq;
39011
39012 /**
39013 * fc_get_event_number - Obtain the next sequential FC event number
39014@@ -498,7 +498,7 @@ static atomic_t fc_event_seq;
39015 u32
39016 fc_get_event_number(void)
39017 {
39018- return atomic_add_return(1, &fc_event_seq);
39019+ return atomic_add_return_unchecked(1, &fc_event_seq);
39020 }
39021 EXPORT_SYMBOL(fc_get_event_number);
39022
39023@@ -646,7 +646,7 @@ static __init int fc_transport_init(void
39024 {
39025 int error;
39026
39027- atomic_set(&fc_event_seq, 0);
39028+ atomic_set_unchecked(&fc_event_seq, 0);
39029
39030 error = transport_class_register(&fc_host_class);
39031 if (error)
39032@@ -836,7 +836,7 @@ static int fc_str_to_dev_loss(const char
39033 char *cp;
39034
39035 *val = simple_strtoul(buf, &cp, 0);
39036- if ((*cp && (*cp != '\n')) || (*val < 0))
39037+ if (*cp && (*cp != '\n'))
39038 return -EINVAL;
39039 /*
39040 * Check for overflow; dev_loss_tmo is u32
39041diff -urNp linux-2.6.39/drivers/scsi/scsi_transport_iscsi.c linux-2.6.39/drivers/scsi/scsi_transport_iscsi.c
39042--- linux-2.6.39/drivers/scsi/scsi_transport_iscsi.c 2011-05-19 00:06:34.000000000 -0400
39043+++ linux-2.6.39/drivers/scsi/scsi_transport_iscsi.c 2011-05-22 19:36:32.000000000 -0400
39044@@ -83,7 +83,7 @@ struct iscsi_internal {
39045 struct device_attribute *session_attrs[ISCSI_SESSION_ATTRS + 1];
39046 };
39047
39048-static atomic_t iscsi_session_nr; /* sysfs session id for next new session */
39049+static atomic_unchecked_t iscsi_session_nr; /* sysfs session id for next new session */
39050 static struct workqueue_struct *iscsi_eh_timer_workq;
39051
39052 /*
39053@@ -761,7 +761,7 @@ int iscsi_add_session(struct iscsi_cls_s
39054 int err;
39055
39056 ihost = shost->shost_data;
39057- session->sid = atomic_add_return(1, &iscsi_session_nr);
39058+ session->sid = atomic_add_return_unchecked(1, &iscsi_session_nr);
39059
39060 if (id == ISCSI_MAX_TARGET) {
39061 for (id = 0; id < ISCSI_MAX_TARGET; id++) {
39062@@ -2200,7 +2200,7 @@ static __init int iscsi_transport_init(v
39063 printk(KERN_INFO "Loading iSCSI transport class v%s.\n",
39064 ISCSI_TRANSPORT_VERSION);
39065
39066- atomic_set(&iscsi_session_nr, 0);
39067+ atomic_set_unchecked(&iscsi_session_nr, 0);
39068
39069 err = class_register(&iscsi_transport_class);
39070 if (err)
39071diff -urNp linux-2.6.39/drivers/scsi/scsi_transport_srp.c linux-2.6.39/drivers/scsi/scsi_transport_srp.c
39072--- linux-2.6.39/drivers/scsi/scsi_transport_srp.c 2011-05-19 00:06:34.000000000 -0400
39073+++ linux-2.6.39/drivers/scsi/scsi_transport_srp.c 2011-05-22 19:36:32.000000000 -0400
39074@@ -33,7 +33,7 @@
39075 #include "scsi_transport_srp_internal.h"
39076
39077 struct srp_host_attrs {
39078- atomic_t next_port_id;
39079+ atomic_unchecked_t next_port_id;
39080 };
39081 #define to_srp_host_attrs(host) ((struct srp_host_attrs *)(host)->shost_data)
39082
39083@@ -62,7 +62,7 @@ static int srp_host_setup(struct transpo
39084 struct Scsi_Host *shost = dev_to_shost(dev);
39085 struct srp_host_attrs *srp_host = to_srp_host_attrs(shost);
39086
39087- atomic_set(&srp_host->next_port_id, 0);
39088+ atomic_set_unchecked(&srp_host->next_port_id, 0);
39089 return 0;
39090 }
39091
39092@@ -211,7 +211,7 @@ struct srp_rport *srp_rport_add(struct S
39093 memcpy(rport->port_id, ids->port_id, sizeof(rport->port_id));
39094 rport->roles = ids->roles;
39095
39096- id = atomic_inc_return(&to_srp_host_attrs(shost)->next_port_id);
39097+ id = atomic_inc_return_unchecked(&to_srp_host_attrs(shost)->next_port_id);
39098 dev_set_name(&rport->dev, "port-%d:%d", shost->host_no, id);
39099
39100 transport_setup_device(&rport->dev);
39101diff -urNp linux-2.6.39/drivers/scsi/sg.c linux-2.6.39/drivers/scsi/sg.c
39102--- linux-2.6.39/drivers/scsi/sg.c 2011-05-19 00:06:34.000000000 -0400
39103+++ linux-2.6.39/drivers/scsi/sg.c 2011-05-22 19:36:32.000000000 -0400
39104@@ -2310,7 +2310,7 @@ struct sg_proc_leaf {
39105 const struct file_operations * fops;
39106 };
39107
39108-static struct sg_proc_leaf sg_proc_leaf_arr[] = {
39109+static const struct sg_proc_leaf sg_proc_leaf_arr[] = {
39110 {"allow_dio", &adio_fops},
39111 {"debug", &debug_fops},
39112 {"def_reserved_size", &dressz_fops},
39113@@ -2325,7 +2325,7 @@ sg_proc_init(void)
39114 {
39115 int k, mask;
39116 int num_leaves = ARRAY_SIZE(sg_proc_leaf_arr);
39117- struct sg_proc_leaf * leaf;
39118+ const struct sg_proc_leaf * leaf;
39119
39120 sg_proc_sgp = proc_mkdir(sg_proc_sg_dirname, NULL);
39121 if (!sg_proc_sgp)
39122diff -urNp linux-2.6.39/drivers/scsi/sym53c8xx_2/sym_glue.c linux-2.6.39/drivers/scsi/sym53c8xx_2/sym_glue.c
39123--- linux-2.6.39/drivers/scsi/sym53c8xx_2/sym_glue.c 2011-05-19 00:06:34.000000000 -0400
39124+++ linux-2.6.39/drivers/scsi/sym53c8xx_2/sym_glue.c 2011-05-22 19:36:32.000000000 -0400
39125@@ -1756,6 +1756,8 @@ static int __devinit sym2_probe(struct p
39126 int do_iounmap = 0;
39127 int do_disable_device = 1;
39128
39129+ pax_track_stack();
39130+
39131 memset(&sym_dev, 0, sizeof(sym_dev));
39132 memset(&nvram, 0, sizeof(nvram));
39133 sym_dev.pdev = pdev;
39134diff -urNp linux-2.6.39/drivers/scsi/vmw_pvscsi.c linux-2.6.39/drivers/scsi/vmw_pvscsi.c
39135--- linux-2.6.39/drivers/scsi/vmw_pvscsi.c 2011-05-19 00:06:34.000000000 -0400
39136+++ linux-2.6.39/drivers/scsi/vmw_pvscsi.c 2011-05-22 19:36:32.000000000 -0400
39137@@ -447,6 +447,8 @@ static void pvscsi_setup_all_rings(const
39138 dma_addr_t base;
39139 unsigned i;
39140
39141+ pax_track_stack();
39142+
39143 cmd.ringsStatePPN = adapter->ringStatePA >> PAGE_SHIFT;
39144 cmd.reqRingNumPages = adapter->req_pages;
39145 cmd.cmpRingNumPages = adapter->cmp_pages;
39146diff -urNp linux-2.6.39/drivers/sh/clk/cpg.c linux-2.6.39/drivers/sh/clk/cpg.c
39147--- linux-2.6.39/drivers/sh/clk/cpg.c 2011-05-19 00:06:34.000000000 -0400
39148+++ linux-2.6.39/drivers/sh/clk/cpg.c 2011-05-22 19:36:32.000000000 -0400
39149@@ -26,7 +26,7 @@ static void sh_clk_mstp32_disable(struct
39150 clk->enable_reg);
39151 }
39152
39153-static struct clk_ops sh_clk_mstp32_clk_ops = {
39154+static const struct clk_ops sh_clk_mstp32_clk_ops = {
39155 .enable = sh_clk_mstp32_enable,
39156 .disable = sh_clk_mstp32_disable,
39157 .recalc = followparent_recalc,
39158@@ -150,7 +150,7 @@ static void sh_clk_div6_disable(struct c
39159 __raw_writel(value, clk->enable_reg);
39160 }
39161
39162-static struct clk_ops sh_clk_div6_clk_ops = {
39163+static const struct clk_ops sh_clk_div6_clk_ops = {
39164 .recalc = sh_clk_div6_recalc,
39165 .round_rate = sh_clk_div_round_rate,
39166 .set_rate = sh_clk_div6_set_rate,
39167@@ -158,7 +158,7 @@ static struct clk_ops sh_clk_div6_clk_op
39168 .disable = sh_clk_div6_disable,
39169 };
39170
39171-static struct clk_ops sh_clk_div6_reparent_clk_ops = {
39172+static const struct clk_ops sh_clk_div6_reparent_clk_ops = {
39173 .recalc = sh_clk_div6_recalc,
39174 .round_rate = sh_clk_div_round_rate,
39175 .set_rate = sh_clk_div6_set_rate,
39176@@ -282,13 +282,13 @@ static void sh_clk_div4_disable(struct c
39177 __raw_writel(__raw_readl(clk->enable_reg) | (1 << 8), clk->enable_reg);
39178 }
39179
39180-static struct clk_ops sh_clk_div4_clk_ops = {
39181+static const struct clk_ops sh_clk_div4_clk_ops = {
39182 .recalc = sh_clk_div4_recalc,
39183 .set_rate = sh_clk_div4_set_rate,
39184 .round_rate = sh_clk_div_round_rate,
39185 };
39186
39187-static struct clk_ops sh_clk_div4_enable_clk_ops = {
39188+static const struct clk_ops sh_clk_div4_enable_clk_ops = {
39189 .recalc = sh_clk_div4_recalc,
39190 .set_rate = sh_clk_div4_set_rate,
39191 .round_rate = sh_clk_div_round_rate,
39192@@ -296,7 +296,7 @@ static struct clk_ops sh_clk_div4_enable
39193 .disable = sh_clk_div4_disable,
39194 };
39195
39196-static struct clk_ops sh_clk_div4_reparent_clk_ops = {
39197+static const struct clk_ops sh_clk_div4_reparent_clk_ops = {
39198 .recalc = sh_clk_div4_recalc,
39199 .set_rate = sh_clk_div4_set_rate,
39200 .round_rate = sh_clk_div_round_rate,
39201diff -urNp linux-2.6.39/drivers/spi/dw_spi.h linux-2.6.39/drivers/spi/dw_spi.h
39202--- linux-2.6.39/drivers/spi/dw_spi.h 2011-05-19 00:06:34.000000000 -0400
39203+++ linux-2.6.39/drivers/spi/dw_spi.h 2011-05-22 19:36:32.000000000 -0400
39204@@ -151,7 +151,7 @@ struct dw_spi {
39205 int dma_chan_done;
39206 struct device *dma_dev;
39207 dma_addr_t dma_addr; /* phy address of the Data register */
39208- struct dw_spi_dma_ops *dma_ops;
39209+ const struct dw_spi_dma_ops *dma_ops;
39210 void *dma_priv; /* platform relate info */
39211 struct pci_dev *dmac;
39212
39213diff -urNp linux-2.6.39/drivers/spi/dw_spi_mid.c linux-2.6.39/drivers/spi/dw_spi_mid.c
39214--- linux-2.6.39/drivers/spi/dw_spi_mid.c 2011-05-19 00:06:34.000000000 -0400
39215+++ linux-2.6.39/drivers/spi/dw_spi_mid.c 2011-05-22 19:36:32.000000000 -0400
39216@@ -180,7 +180,7 @@ static int mid_spi_dma_transfer(struct d
39217 return 0;
39218 }
39219
39220-static struct dw_spi_dma_ops mid_dma_ops = {
39221+static const struct dw_spi_dma_ops mid_dma_ops = {
39222 .dma_init = mid_spi_dma_init,
39223 .dma_exit = mid_spi_dma_exit,
39224 .dma_transfer = mid_spi_dma_transfer,
39225diff -urNp linux-2.6.39/drivers/spi/spi.c linux-2.6.39/drivers/spi/spi.c
39226--- linux-2.6.39/drivers/spi/spi.c 2011-05-19 00:06:34.000000000 -0400
39227+++ linux-2.6.39/drivers/spi/spi.c 2011-05-22 19:36:32.000000000 -0400
39228@@ -1023,7 +1023,7 @@ int spi_bus_unlock(struct spi_master *ma
39229 EXPORT_SYMBOL_GPL(spi_bus_unlock);
39230
39231 /* portable code must never pass more than 32 bytes */
39232-#define SPI_BUFSIZ max(32,SMP_CACHE_BYTES)
39233+#define SPI_BUFSIZ max(32U,SMP_CACHE_BYTES)
39234
39235 static u8 *buf;
39236
39237diff -urNp linux-2.6.39/drivers/ssb/driver_pcicore.c linux-2.6.39/drivers/ssb/driver_pcicore.c
39238--- linux-2.6.39/drivers/ssb/driver_pcicore.c 2011-05-19 00:06:34.000000000 -0400
39239+++ linux-2.6.39/drivers/ssb/driver_pcicore.c 2011-05-22 19:36:32.000000000 -0400
39240@@ -223,7 +223,7 @@ static int ssb_pcicore_write_config(stru
39241 return err ? PCIBIOS_DEVICE_NOT_FOUND : PCIBIOS_SUCCESSFUL;
39242 }
39243
39244-static struct pci_ops ssb_pcicore_pciops = {
39245+static const struct pci_ops ssb_pcicore_pciops = {
39246 .read = ssb_pcicore_read_config,
39247 .write = ssb_pcicore_write_config,
39248 };
39249diff -urNp linux-2.6.39/drivers/staging/ath6kl/os/linux/cfg80211.c linux-2.6.39/drivers/staging/ath6kl/os/linux/cfg80211.c
39250--- linux-2.6.39/drivers/staging/ath6kl/os/linux/cfg80211.c 2011-05-19 00:06:34.000000000 -0400
39251+++ linux-2.6.39/drivers/staging/ath6kl/os/linux/cfg80211.c 2011-05-22 19:36:32.000000000 -0400
39252@@ -1391,8 +1391,7 @@ u32 cipher_suites[] = {
39253 WLAN_CIPHER_SUITE_CCMP,
39254 };
39255
39256-static struct
39257-cfg80211_ops ar6k_cfg80211_ops = {
39258+static const struct cfg80211_ops ar6k_cfg80211_ops = {
39259 .change_virtual_intf = ar6k_cfg80211_change_iface,
39260 .add_virtual_intf = ar6k_cfg80211_add_virtual_intf,
39261 .del_virtual_intf = ar6k_cfg80211_del_virtual_intf,
39262diff -urNp linux-2.6.39/drivers/staging/brcm80211/brcmfmac/dhd_linux.c linux-2.6.39/drivers/staging/brcm80211/brcmfmac/dhd_linux.c
39263--- linux-2.6.39/drivers/staging/brcm80211/brcmfmac/dhd_linux.c 2011-05-19 00:06:34.000000000 -0400
39264+++ linux-2.6.39/drivers/staging/brcm80211/brcmfmac/dhd_linux.c 2011-05-22 19:36:32.000000000 -0400
39265@@ -857,14 +857,14 @@ static void dhd_op_if(dhd_if_t *ifp)
39266 free_netdev(ifp->net);
39267 }
39268 /* Allocate etherdev, including space for private structure */
39269- ifp->net = alloc_etherdev(sizeof(dhd));
39270+ ifp->net = alloc_etherdev(sizeof(*dhd));
39271 if (!ifp->net) {
39272 DHD_ERROR(("%s: OOM - alloc_etherdev\n", __func__));
39273 ret = -ENOMEM;
39274 }
39275 if (ret == 0) {
39276 strcpy(ifp->net->name, ifp->name);
39277- memcpy(netdev_priv(ifp->net), &dhd, sizeof(dhd));
39278+ memcpy(netdev_priv(ifp->net), dhd, sizeof(*dhd));
39279 err = dhd_net_attach(&dhd->pub, ifp->idx);
39280 if (err != 0) {
39281 DHD_ERROR(("%s: dhd_net_attach failed, "
39282@@ -1500,7 +1500,7 @@ static void dhd_ethtool_get_drvinfo(stru
39283 sprintf(info->bus_info, "%s", dev_name(&wl_cfg80211_get_sdio_func()->dev));
39284 }
39285
39286-struct ethtool_ops dhd_ethtool_ops = {
39287+const struct ethtool_ops dhd_ethtool_ops = {
39288 .get_drvinfo = dhd_ethtool_get_drvinfo
39289 };
39290
39291@@ -1923,7 +1923,7 @@ dhd_pub_t *dhd_attach(struct dhd_bus *bu
39292 strcpy(nv_path, nvram_path);
39293
39294 /* Allocate etherdev, including space for private structure */
39295- net = alloc_etherdev(sizeof(dhd));
39296+ net = alloc_etherdev(sizeof(*dhd));
39297 if (!net) {
39298 DHD_ERROR(("%s: OOM - alloc_etherdev\n", __func__));
39299 goto fail;
39300@@ -1939,7 +1939,7 @@ dhd_pub_t *dhd_attach(struct dhd_bus *bu
39301 /*
39302 * Save the dhd_info into the priv
39303 */
39304- memcpy(netdev_priv(net), &dhd, sizeof(dhd));
39305+ memcpy(netdev_priv(net), dhd, sizeof(*dhd));
39306
39307 /* Set network interface name if it was provided as module parameter */
39308 if (iface_name[0]) {
39309@@ -2056,7 +2056,7 @@ dhd_pub_t *dhd_attach(struct dhd_bus *bu
39310 /*
39311 * Save the dhd_info into the priv
39312 */
39313- memcpy(netdev_priv(net), &dhd, sizeof(dhd));
39314+ memcpy(netdev_priv(net), dhd, sizeof(*dhd));
39315
39316 #if defined(CUSTOMER_HW2) && defined(CONFIG_WIFI_CONTROL_FUNC)
39317 g_bus = bus;
39318@@ -2206,7 +2206,7 @@ dhd_iovar(dhd_pub_t *pub, int ifidx, cha
39319 return ret;
39320 }
39321
39322-static struct net_device_ops dhd_ops_pri = {
39323+static const struct net_device_ops dhd_ops_pri = {
39324 .ndo_open = dhd_open,
39325 .ndo_stop = dhd_stop,
39326 .ndo_get_stats = dhd_get_stats,
39327diff -urNp linux-2.6.39/drivers/staging/brcm80211/brcmfmac/wl_cfg80211.c linux-2.6.39/drivers/staging/brcm80211/brcmfmac/wl_cfg80211.c
39328--- linux-2.6.39/drivers/staging/brcm80211/brcmfmac/wl_cfg80211.c 2011-05-19 00:06:34.000000000 -0400
39329+++ linux-2.6.39/drivers/staging/brcm80211/brcmfmac/wl_cfg80211.c 2011-05-22 19:36:32.000000000 -0400
39330@@ -2109,7 +2109,7 @@ wl_cfg80211_flush_pmksa(struct wiphy *wi
39331
39332 }
39333
39334-static struct cfg80211_ops wl_cfg80211_ops = {
39335+static const struct cfg80211_ops wl_cfg80211_ops = {
39336 .change_virtual_intf = wl_cfg80211_change_iface,
39337 .scan = wl_cfg80211_scan,
39338 .set_wiphy_params = wl_cfg80211_set_wiphy_params,
39339diff -urNp linux-2.6.39/drivers/staging/brcm80211/brcmfmac/wl_iw.c linux-2.6.39/drivers/staging/brcm80211/brcmfmac/wl_iw.c
39340--- linux-2.6.39/drivers/staging/brcm80211/brcmfmac/wl_iw.c 2011-05-19 00:06:34.000000000 -0400
39341+++ linux-2.6.39/drivers/staging/brcm80211/brcmfmac/wl_iw.c 2011-05-22 19:36:32.000000000 -0400
39342@@ -495,7 +495,7 @@ wl_iw_get_range(struct net_device *dev,
39343 list = (wl_u32_list_t *) channels;
39344
39345 dwrq->length = sizeof(struct iw_range);
39346- memset(range, 0, sizeof(range));
39347+ memset(range, 0, sizeof(*range));
39348
39349 range->min_nwid = range->max_nwid = 0;
39350
39351diff -urNp linux-2.6.39/drivers/staging/comedi/comedi_fops.c linux-2.6.39/drivers/staging/comedi/comedi_fops.c
39352--- linux-2.6.39/drivers/staging/comedi/comedi_fops.c 2011-05-19 00:06:34.000000000 -0400
39353+++ linux-2.6.39/drivers/staging/comedi/comedi_fops.c 2011-05-22 19:36:32.000000000 -0400
39354@@ -1445,7 +1445,7 @@ static void comedi_unmap(struct vm_area_
39355 mutex_unlock(&dev->mutex);
39356 }
39357
39358-static struct vm_operations_struct comedi_vm_ops = {
39359+static const struct vm_operations_struct comedi_vm_ops = {
39360 .close = comedi_unmap,
39361 };
39362
39363diff -urNp linux-2.6.39/drivers/staging/cx25821/cx25821-alsa.c linux-2.6.39/drivers/staging/cx25821/cx25821-alsa.c
39364--- linux-2.6.39/drivers/staging/cx25821/cx25821-alsa.c 2011-05-19 00:06:34.000000000 -0400
39365+++ linux-2.6.39/drivers/staging/cx25821/cx25821-alsa.c 2011-05-22 19:36:32.000000000 -0400
39366@@ -586,7 +586,7 @@ static struct page *snd_cx25821_page(str
39367 /*
39368 * operators
39369 */
39370-static struct snd_pcm_ops snd_cx25821_pcm_ops = {
39371+static const struct snd_pcm_ops snd_cx25821_pcm_ops = {
39372 .open = snd_cx25821_pcm_open,
39373 .close = snd_cx25821_close,
39374 .ioctl = snd_pcm_lib_ioctl,
39375diff -urNp linux-2.6.39/drivers/staging/cx25821/cx25821-i2c.c linux-2.6.39/drivers/staging/cx25821/cx25821-i2c.c
39376--- linux-2.6.39/drivers/staging/cx25821/cx25821-i2c.c 2011-05-19 00:06:34.000000000 -0400
39377+++ linux-2.6.39/drivers/staging/cx25821/cx25821-i2c.c 2011-05-22 19:36:32.000000000 -0400
39378@@ -282,7 +282,7 @@ static u32 cx25821_functionality(struct
39379 I2C_FUNC_SMBUS_READ_WORD_DATA | I2C_FUNC_SMBUS_WRITE_WORD_DATA;
39380 }
39381
39382-static struct i2c_algorithm cx25821_i2c_algo_template = {
39383+static const struct i2c_algorithm cx25821_i2c_algo_template = {
39384 .master_xfer = i2c_xfer,
39385 .functionality = cx25821_functionality,
39386 #ifdef NEED_ALGO_CONTROL
39387diff -urNp linux-2.6.39/drivers/staging/et131x/et1310_tx.c linux-2.6.39/drivers/staging/et131x/et1310_tx.c
39388--- linux-2.6.39/drivers/staging/et131x/et1310_tx.c 2011-05-19 00:06:34.000000000 -0400
39389+++ linux-2.6.39/drivers/staging/et131x/et1310_tx.c 2011-05-22 19:36:32.000000000 -0400
39390@@ -635,11 +635,11 @@ inline void et131x_free_send_packet(stru
39391 struct net_device_stats *stats = &etdev->net_stats;
39392
39393 if (tcb->flags & fMP_DEST_BROAD)
39394- atomic_inc(&etdev->Stats.brdcstxmt);
39395+ atomic_inc_unchecked(&etdev->Stats.brdcstxmt);
39396 else if (tcb->flags & fMP_DEST_MULTI)
39397- atomic_inc(&etdev->Stats.multixmt);
39398+ atomic_inc_unchecked(&etdev->Stats.multixmt);
39399 else
39400- atomic_inc(&etdev->Stats.unixmt);
39401+ atomic_inc_unchecked(&etdev->Stats.unixmt);
39402
39403 if (tcb->skb) {
39404 stats->tx_bytes += tcb->skb->len;
39405diff -urNp linux-2.6.39/drivers/staging/et131x/et131x_adapter.h linux-2.6.39/drivers/staging/et131x/et131x_adapter.h
39406--- linux-2.6.39/drivers/staging/et131x/et131x_adapter.h 2011-05-19 00:06:34.000000000 -0400
39407+++ linux-2.6.39/drivers/staging/et131x/et131x_adapter.h 2011-05-22 19:36:32.000000000 -0400
39408@@ -110,11 +110,11 @@ typedef struct _ce_stats_t {
39409 * operations
39410 */
39411 u32 unircv; /* # multicast packets received */
39412- atomic_t unixmt; /* # multicast packets for Tx */
39413+ atomic_unchecked_t unixmt; /* # multicast packets for Tx */
39414 u32 multircv; /* # multicast packets received */
39415- atomic_t multixmt; /* # multicast packets for Tx */
39416+ atomic_unchecked_t multixmt; /* # multicast packets for Tx */
39417 u32 brdcstrcv; /* # broadcast packets received */
39418- atomic_t brdcstxmt; /* # broadcast packets for Tx */
39419+ atomic_unchecked_t brdcstxmt; /* # broadcast packets for Tx */
39420 u32 norcvbuf; /* # Rx packets discarded */
39421 u32 noxmtbuf; /* # Tx packets discarded */
39422
39423diff -urNp linux-2.6.39/drivers/staging/ft1000/ft1000-usb/ft1000_debug.c linux-2.6.39/drivers/staging/ft1000/ft1000-usb/ft1000_debug.c
39424--- linux-2.6.39/drivers/staging/ft1000/ft1000-usb/ft1000_debug.c 2011-05-19 00:06:34.000000000 -0400
39425+++ linux-2.6.39/drivers/staging/ft1000/ft1000-usb/ft1000_debug.c 2011-05-22 19:36:32.000000000 -0400
39426@@ -55,7 +55,7 @@ int numofmsgbuf = 0;
39427 //
39428 // Table of entry-point routines for char device
39429 //
39430-static struct file_operations ft1000fops =
39431+static const struct file_operations ft1000fops =
39432 {
39433 .unlocked_ioctl = ft1000_ioctl,
39434 .poll = ft1000_poll_dev,
39435diff -urNp linux-2.6.39/drivers/staging/generic_serial/rio/rio_linux.c linux-2.6.39/drivers/staging/generic_serial/rio/rio_linux.c
39436--- linux-2.6.39/drivers/staging/generic_serial/rio/rio_linux.c 2011-05-19 00:06:34.000000000 -0400
39437+++ linux-2.6.39/drivers/staging/generic_serial/rio/rio_linux.c 2011-05-22 19:36:32.000000000 -0400
39438@@ -221,7 +221,7 @@ module_param(rio_poll, int, 0);
39439 module_param(rio_debug, int, 0644);
39440 module_param(rio_irqmask, long, 0);
39441
39442-static struct real_driver rio_real_driver = {
39443+static const struct real_driver rio_real_driver = {
39444 rio_disable_tx_interrupts,
39445 rio_enable_tx_interrupts,
39446 rio_disable_rx_interrupts,
39447diff -urNp linux-2.6.39/drivers/staging/generic_serial/ser_a2232.c linux-2.6.39/drivers/staging/generic_serial/ser_a2232.c
39448--- linux-2.6.39/drivers/staging/generic_serial/ser_a2232.c 2011-05-19 00:06:34.000000000 -0400
39449+++ linux-2.6.39/drivers/staging/generic_serial/ser_a2232.c 2011-05-22 19:36:32.000000000 -0400
39450@@ -144,7 +144,7 @@ static int a2232_open(struct tty_struct
39451 /*---------------------------------------------------------------------------
39452 * Interface from generic_serial.c back here
39453 *--------------------------------------------------------------------------*/
39454-static struct real_driver a2232_real_driver = {
39455+static const struct real_driver a2232_real_driver = {
39456 a2232_disable_tx_interrupts,
39457 a2232_enable_tx_interrupts,
39458 a2232_disable_rx_interrupts,
39459diff -urNp linux-2.6.39/drivers/staging/generic_serial/sx.c linux-2.6.39/drivers/staging/generic_serial/sx.c
39460--- linux-2.6.39/drivers/staging/generic_serial/sx.c 2011-05-19 00:06:34.000000000 -0400
39461+++ linux-2.6.39/drivers/staging/generic_serial/sx.c 2011-05-22 19:36:32.000000000 -0400
39462@@ -355,7 +355,7 @@ module_param(sx_irqmask, int, 0);
39463
39464 MODULE_LICENSE("GPL");
39465
39466-static struct real_driver sx_real_driver = {
39467+static const struct real_driver sx_real_driver = {
39468 sx_disable_tx_interrupts,
39469 sx_enable_tx_interrupts,
39470 sx_disable_rx_interrupts,
39471diff -urNp linux-2.6.39/drivers/staging/generic_serial/vme_scc.c linux-2.6.39/drivers/staging/generic_serial/vme_scc.c
39472--- linux-2.6.39/drivers/staging/generic_serial/vme_scc.c 2011-05-19 00:06:34.000000000 -0400
39473+++ linux-2.6.39/drivers/staging/generic_serial/vme_scc.c 2011-05-22 19:36:32.000000000 -0400
39474@@ -94,7 +94,7 @@ static struct scc_port scc_ports[2];
39475 * Interface from generic_serial.c back here
39476 *--------------------------------------------------------------------------*/
39477
39478-static struct real_driver scc_real_driver = {
39479+static const struct real_driver scc_real_driver = {
39480 scc_disable_tx_interrupts,
39481 scc_enable_tx_interrupts,
39482 scc_disable_rx_interrupts,
39483diff -urNp linux-2.6.39/drivers/staging/gma500/psb_fb.c linux-2.6.39/drivers/staging/gma500/psb_fb.c
39484--- linux-2.6.39/drivers/staging/gma500/psb_fb.c 2011-05-19 00:06:34.000000000 -0400
39485+++ linux-2.6.39/drivers/staging/gma500/psb_fb.c 2011-05-22 19:36:32.000000000 -0400
39486@@ -230,7 +230,7 @@ static void psbfb_vm_close(struct vm_are
39487 DRM_DEBUG("vm_close\n");
39488 }
39489
39490-static struct vm_operations_struct psbfb_vm_ops = {
39491+static const struct vm_operations_struct psbfb_vm_ops = {
39492 .fault = psbfb_vm_fault,
39493 .open = psbfb_vm_open,
39494 .close = psbfb_vm_close
39495diff -urNp linux-2.6.39/drivers/staging/go7007/go7007-i2c.c linux-2.6.39/drivers/staging/go7007/go7007-i2c.c
39496--- linux-2.6.39/drivers/staging/go7007/go7007-i2c.c 2011-05-19 00:06:34.000000000 -0400
39497+++ linux-2.6.39/drivers/staging/go7007/go7007-i2c.c 2011-05-22 19:36:32.000000000 -0400
39498@@ -198,7 +198,7 @@ static u32 go7007_functionality(struct i
39499 return I2C_FUNC_SMBUS_BYTE_DATA;
39500 }
39501
39502-static struct i2c_algorithm go7007_algo = {
39503+static const struct i2c_algorithm go7007_algo = {
39504 .smbus_xfer = go7007_smbus_xfer,
39505 .master_xfer = go7007_i2c_master_xfer,
39506 .functionality = go7007_functionality,
39507diff -urNp linux-2.6.39/drivers/staging/go7007/go7007-usb.c linux-2.6.39/drivers/staging/go7007/go7007-usb.c
39508--- linux-2.6.39/drivers/staging/go7007/go7007-usb.c 2011-05-19 00:06:34.000000000 -0400
39509+++ linux-2.6.39/drivers/staging/go7007/go7007-usb.c 2011-05-22 19:36:32.000000000 -0400
39510@@ -849,7 +849,7 @@ static int go7007_usb_send_firmware(stru
39511 &transferred, timeout);
39512 }
39513
39514-static struct go7007_hpi_ops go7007_usb_ezusb_hpi_ops = {
39515+static const struct go7007_hpi_ops go7007_usb_ezusb_hpi_ops = {
39516 .interface_reset = go7007_usb_interface_reset,
39517 .write_interrupt = go7007_usb_ezusb_write_interrupt,
39518 .read_interrupt = go7007_usb_read_interrupt,
39519@@ -858,7 +858,7 @@ static struct go7007_hpi_ops go7007_usb_
39520 .send_firmware = go7007_usb_send_firmware,
39521 };
39522
39523-static struct go7007_hpi_ops go7007_usb_onboard_hpi_ops = {
39524+static const struct go7007_hpi_ops go7007_usb_onboard_hpi_ops = {
39525 .interface_reset = go7007_usb_interface_reset,
39526 .write_interrupt = go7007_usb_onboard_write_interrupt,
39527 .read_interrupt = go7007_usb_read_interrupt,
39528@@ -950,7 +950,7 @@ static u32 go7007_usb_functionality(stru
39529 return (I2C_FUNC_SMBUS_EMUL) & ~I2C_FUNC_SMBUS_QUICK;
39530 }
39531
39532-static struct i2c_algorithm go7007_usb_algo = {
39533+static const struct i2c_algorithm go7007_usb_algo = {
39534 .master_xfer = go7007_usb_i2c_master_xfer,
39535 .functionality = go7007_usb_functionality,
39536 };
39537diff -urNp linux-2.6.39/drivers/staging/go7007/go7007-v4l2.c linux-2.6.39/drivers/staging/go7007/go7007-v4l2.c
39538--- linux-2.6.39/drivers/staging/go7007/go7007-v4l2.c 2011-05-19 00:06:34.000000000 -0400
39539+++ linux-2.6.39/drivers/staging/go7007/go7007-v4l2.c 2011-05-22 19:36:32.000000000 -0400
39540@@ -1672,7 +1672,7 @@ static int go7007_vm_fault(struct vm_are
39541 return 0;
39542 }
39543
39544-static struct vm_operations_struct go7007_vm_ops = {
39545+static const struct vm_operations_struct go7007_vm_ops = {
39546 .open = go7007_vm_open,
39547 .close = go7007_vm_close,
39548 .fault = go7007_vm_fault,
39549diff -urNp linux-2.6.39/drivers/staging/go7007/saa7134-go7007.c linux-2.6.39/drivers/staging/go7007/saa7134-go7007.c
39550--- linux-2.6.39/drivers/staging/go7007/saa7134-go7007.c 2011-05-19 00:06:34.000000000 -0400
39551+++ linux-2.6.39/drivers/staging/go7007/saa7134-go7007.c 2011-05-22 19:36:32.000000000 -0400
39552@@ -421,7 +421,7 @@ static int saa7134_go7007_send_command(s
39553
39554 }
39555
39556-static struct go7007_hpi_ops saa7134_go7007_hpi_ops = {
39557+static const struct go7007_hpi_ops saa7134_go7007_hpi_ops = {
39558 .interface_reset = saa7134_go7007_interface_reset,
39559 .write_interrupt = saa7134_go7007_write_interrupt,
39560 .read_interrupt = saa7134_go7007_read_interrupt,
39561diff -urNp linux-2.6.39/drivers/staging/go7007/snd-go7007.c linux-2.6.39/drivers/staging/go7007/snd-go7007.c
39562--- linux-2.6.39/drivers/staging/go7007/snd-go7007.c 2011-05-19 00:06:34.000000000 -0400
39563+++ linux-2.6.39/drivers/staging/go7007/snd-go7007.c 2011-05-22 19:36:32.000000000 -0400
39564@@ -204,7 +204,7 @@ static struct page *go7007_snd_pcm_page(
39565 return vmalloc_to_page(substream->runtime->dma_area + offset);
39566 }
39567
39568-static struct snd_pcm_ops go7007_snd_capture_ops = {
39569+static const struct snd_pcm_ops go7007_snd_capture_ops = {
39570 .open = go7007_snd_capture_open,
39571 .close = go7007_snd_capture_close,
39572 .ioctl = snd_pcm_lib_ioctl,
39573@@ -227,7 +227,7 @@ static int go7007_snd_free(struct snd_de
39574 return 0;
39575 }
39576
39577-static struct snd_device_ops go7007_snd_device_ops = {
39578+static const struct snd_device_ops go7007_snd_device_ops = {
39579 .dev_free = go7007_snd_free,
39580 };
39581
39582diff -urNp linux-2.6.39/drivers/staging/hv/channel.c linux-2.6.39/drivers/staging/hv/channel.c
39583--- linux-2.6.39/drivers/staging/hv/channel.c 2011-05-19 00:06:34.000000000 -0400
39584+++ linux-2.6.39/drivers/staging/hv/channel.c 2011-05-22 19:36:32.000000000 -0400
39585@@ -509,8 +509,8 @@ int vmbus_establish_gpadl(struct vmbus_c
39586 unsigned long flags;
39587 int ret = 0;
39588
39589- next_gpadl_handle = atomic_read(&vmbus_connection.next_gpadl_handle);
39590- atomic_inc(&vmbus_connection.next_gpadl_handle);
39591+ next_gpadl_handle = atomic_read_unchecked(&vmbus_connection.next_gpadl_handle);
39592+ atomic_inc_unchecked(&vmbus_connection.next_gpadl_handle);
39593
39594 ret = create_gpadl_header(kbuffer, size, &msginfo, &msgcount);
39595 if (ret)
39596diff -urNp linux-2.6.39/drivers/staging/hv/hv.c linux-2.6.39/drivers/staging/hv/hv.c
39597--- linux-2.6.39/drivers/staging/hv/hv.c 2011-05-19 00:06:34.000000000 -0400
39598+++ linux-2.6.39/drivers/staging/hv/hv.c 2011-05-22 19:36:32.000000000 -0400
39599@@ -163,7 +163,7 @@ static u64 do_hypercall(u64 control, voi
39600 u64 output_address = (output) ? virt_to_phys(output) : 0;
39601 u32 output_address_hi = output_address >> 32;
39602 u32 output_address_lo = output_address & 0xFFFFFFFF;
39603- volatile void *hypercall_page = hv_context.hypercall_page;
39604+ volatile void *hypercall_page = ktva_ktla(hv_context.hypercall_page);
39605
39606 DPRINT_DBG(VMBUS, "Hypercall <control %llx input %p output %p>",
39607 control, input, output);
39608diff -urNp linux-2.6.39/drivers/staging/hv/rndis_filter.c linux-2.6.39/drivers/staging/hv/rndis_filter.c
39609--- linux-2.6.39/drivers/staging/hv/rndis_filter.c 2011-05-19 00:06:34.000000000 -0400
39610+++ linux-2.6.39/drivers/staging/hv/rndis_filter.c 2011-05-22 19:36:32.000000000 -0400
39611@@ -49,7 +49,7 @@ struct rndis_device {
39612
39613 enum rndis_device_state state;
39614 u32 link_stat;
39615- atomic_t new_req_id;
39616+ atomic_unchecked_t new_req_id;
39617
39618 spinlock_t request_lock;
39619 struct list_head req_list;
39620@@ -144,7 +144,7 @@ static struct rndis_request *get_rndis_r
39621 * template
39622 */
39623 set = &rndis_msg->msg.set_req;
39624- set->req_id = atomic_inc_return(&dev->new_req_id);
39625+ set->req_id = atomic_inc_return_unchecked(&dev->new_req_id);
39626
39627 /* Add to the request list */
39628 spin_lock_irqsave(&dev->request_lock, flags);
39629@@ -709,7 +709,7 @@ static void rndis_filter_halt_device(str
39630
39631 /* Setup the rndis set */
39632 halt = &request->request_msg.msg.halt_req;
39633- halt->req_id = atomic_inc_return(&dev->new_req_id);
39634+ halt->req_id = atomic_inc_return_unchecked(&dev->new_req_id);
39635
39636 /* Ignore return since this msg is optional. */
39637 rndis_filter_send_request(dev, request);
39638diff -urNp linux-2.6.39/drivers/staging/hv/vmbus_drv.c linux-2.6.39/drivers/staging/hv/vmbus_drv.c
39639--- linux-2.6.39/drivers/staging/hv/vmbus_drv.c 2011-05-19 00:06:34.000000000 -0400
39640+++ linux-2.6.39/drivers/staging/hv/vmbus_drv.c 2011-05-22 19:36:32.000000000 -0400
39641@@ -661,14 +661,14 @@ int vmbus_child_device_register(struct h
39642 {
39643 int ret = 0;
39644
39645- static atomic_t device_num = ATOMIC_INIT(0);
39646+ static atomic_unchecked_t device_num = ATOMIC_INIT(0);
39647
39648 DPRINT_DBG(VMBUS_DRV, "child device (%p) registering",
39649 child_device_obj);
39650
39651 /* Set the device name. Otherwise, device_register() will fail. */
39652 dev_set_name(&child_device_obj->device, "vmbus_0_%d",
39653- atomic_inc_return(&device_num));
39654+ atomic_inc_return_unchecked(&device_num));
39655
39656 /* The new device belongs to this bus */
39657 child_device_obj->device.bus = &vmbus_drv.bus; /* device->dev.bus; */
39658diff -urNp linux-2.6.39/drivers/staging/hv/vmbus_private.h linux-2.6.39/drivers/staging/hv/vmbus_private.h
39659--- linux-2.6.39/drivers/staging/hv/vmbus_private.h 2011-05-19 00:06:34.000000000 -0400
39660+++ linux-2.6.39/drivers/staging/hv/vmbus_private.h 2011-05-22 19:36:32.000000000 -0400
39661@@ -58,7 +58,7 @@ enum vmbus_connect_state {
39662 struct vmbus_connection {
39663 enum vmbus_connect_state conn_state;
39664
39665- atomic_t next_gpadl_handle;
39666+ atomic_unchecked_t next_gpadl_handle;
39667
39668 /*
39669 * Represents channel interrupts. Each bit position represents a
39670diff -urNp linux-2.6.39/drivers/staging/iio/ring_generic.h linux-2.6.39/drivers/staging/iio/ring_generic.h
39671--- linux-2.6.39/drivers/staging/iio/ring_generic.h 2011-05-19 00:06:34.000000000 -0400
39672+++ linux-2.6.39/drivers/staging/iio/ring_generic.h 2011-05-25 16:55:27.000000000 -0400
39673@@ -134,7 +134,7 @@ struct iio_ring_buffer {
39674 struct iio_handler access_handler;
39675 struct iio_event_interface ev_int;
39676 struct iio_shared_ev_pointer shared_ev_pointer;
39677- struct iio_ring_access_funcs access;
39678+ struct iio_ring_access_funcs access;
39679 int (*preenable)(struct iio_dev *);
39680 int (*postenable)(struct iio_dev *);
39681 int (*predisable)(struct iio_dev *);
39682diff -urNp linux-2.6.39/drivers/staging/intel_sst/intelmid_ctrl.c linux-2.6.39/drivers/staging/intel_sst/intelmid_ctrl.c
39683--- linux-2.6.39/drivers/staging/intel_sst/intelmid_ctrl.c 2011-05-19 00:06:34.000000000 -0400
39684+++ linux-2.6.39/drivers/staging/intel_sst/intelmid_ctrl.c 2011-05-22 19:36:32.000000000 -0400
39685@@ -494,7 +494,7 @@ static int snd_intelmad_device_set(struc
39686 struct snd_intelmad *intelmaddata;
39687 struct snd_pmic_ops *scard_ops;
39688 int ret_val = 0, vendor, status;
39689- struct intel_sst_pcm_control *pcm_control;
39690+ const struct intel_sst_pcm_control *pcm_control;
39691
39692 pr_debug("snd_intelmad_device_set called\n");
39693
39694diff -urNp linux-2.6.39/drivers/staging/intel_sst/intel_sst_drv_interface.c linux-2.6.39/drivers/staging/intel_sst/intel_sst_drv_interface.c
39695--- linux-2.6.39/drivers/staging/intel_sst/intel_sst_drv_interface.c 2011-05-19 00:06:34.000000000 -0400
39696+++ linux-2.6.39/drivers/staging/intel_sst/intel_sst_drv_interface.c 2011-05-22 19:36:32.000000000 -0400
39697@@ -470,7 +470,7 @@ int sst_device_control(int cmd, void *ar
39698 }
39699
39700
39701-struct intel_sst_pcm_control pcm_ops = {
39702+const struct intel_sst_pcm_control pcm_ops = {
39703 .open = sst_open_pcm_stream,
39704 .device_control = sst_device_control,
39705 .close = sst_close_pcm_stream,
39706diff -urNp linux-2.6.39/drivers/staging/line6/capture.c linux-2.6.39/drivers/staging/line6/capture.c
39707--- linux-2.6.39/drivers/staging/line6/capture.c 2011-05-19 00:06:34.000000000 -0400
39708+++ linux-2.6.39/drivers/staging/line6/capture.c 2011-05-22 19:36:32.000000000 -0400
39709@@ -378,7 +378,7 @@ snd_line6_capture_pointer(struct snd_pcm
39710 }
39711
39712 /* capture operators */
39713-struct snd_pcm_ops snd_line6_capture_ops = {
39714+const struct snd_pcm_ops snd_line6_capture_ops = {
39715 .open = snd_line6_capture_open,
39716 .close = snd_line6_capture_close,
39717 .ioctl = snd_pcm_lib_ioctl,
39718diff -urNp linux-2.6.39/drivers/staging/line6/capture.h linux-2.6.39/drivers/staging/line6/capture.h
39719--- linux-2.6.39/drivers/staging/line6/capture.h 2011-05-19 00:06:34.000000000 -0400
39720+++ linux-2.6.39/drivers/staging/line6/capture.h 2011-05-22 19:36:32.000000000 -0400
39721@@ -17,7 +17,7 @@
39722 #include "driver.h"
39723 #include "pcm.h"
39724
39725-extern struct snd_pcm_ops snd_line6_capture_ops;
39726+extern const struct snd_pcm_ops snd_line6_capture_ops;
39727
39728 extern void line6_capture_copy(struct snd_line6_pcm *line6pcm, char *fbuf,
39729 int fsize);
39730diff -urNp linux-2.6.39/drivers/staging/line6/midi.c linux-2.6.39/drivers/staging/line6/midi.c
39731--- linux-2.6.39/drivers/staging/line6/midi.c 2011-05-19 00:06:34.000000000 -0400
39732+++ linux-2.6.39/drivers/staging/line6/midi.c 2011-05-22 19:36:32.000000000 -0400
39733@@ -239,14 +239,14 @@ static void line6_midi_input_trigger(str
39734 line6->line6midi->substream_receive = 0;
39735 }
39736
39737-static struct snd_rawmidi_ops line6_midi_output_ops = {
39738+static const struct snd_rawmidi_ops line6_midi_output_ops = {
39739 .open = line6_midi_output_open,
39740 .close = line6_midi_output_close,
39741 .trigger = line6_midi_output_trigger,
39742 .drain = line6_midi_output_drain,
39743 };
39744
39745-static struct snd_rawmidi_ops line6_midi_input_ops = {
39746+static const struct snd_rawmidi_ops line6_midi_input_ops = {
39747 .open = line6_midi_input_open,
39748 .close = line6_midi_input_close,
39749 .trigger = line6_midi_input_trigger,
39750@@ -373,7 +373,7 @@ static int snd_line6_midi_free(struct sn
39751 */
39752 int line6_init_midi(struct usb_line6 *line6)
39753 {
39754- static struct snd_device_ops midi_ops = {
39755+ static const struct snd_device_ops midi_ops = {
39756 .dev_free = snd_line6_midi_free,
39757 };
39758
39759diff -urNp linux-2.6.39/drivers/staging/line6/pcm.c linux-2.6.39/drivers/staging/line6/pcm.c
39760--- linux-2.6.39/drivers/staging/line6/pcm.c 2011-05-19 00:06:34.000000000 -0400
39761+++ linux-2.6.39/drivers/staging/line6/pcm.c 2011-05-22 19:36:32.000000000 -0400
39762@@ -384,7 +384,7 @@ void line6_pcm_disconnect(struct snd_lin
39763 int line6_init_pcm(struct usb_line6 *line6,
39764 struct line6_pcm_properties *properties)
39765 {
39766- static struct snd_device_ops pcm_ops = {
39767+ static const struct snd_device_ops pcm_ops = {
39768 .dev_free = snd_line6_pcm_free,
39769 };
39770
39771diff -urNp linux-2.6.39/drivers/staging/line6/playback.c linux-2.6.39/drivers/staging/line6/playback.c
39772--- linux-2.6.39/drivers/staging/line6/playback.c 2011-05-19 00:06:34.000000000 -0400
39773+++ linux-2.6.39/drivers/staging/line6/playback.c 2011-05-22 19:36:32.000000000 -0400
39774@@ -536,7 +536,7 @@ snd_line6_playback_pointer(struct snd_pc
39775 }
39776
39777 /* playback operators */
39778-struct snd_pcm_ops snd_line6_playback_ops = {
39779+const struct snd_pcm_ops snd_line6_playback_ops = {
39780 .open = snd_line6_playback_open,
39781 .close = snd_line6_playback_close,
39782 .ioctl = snd_pcm_lib_ioctl,
39783diff -urNp linux-2.6.39/drivers/staging/line6/playback.h linux-2.6.39/drivers/staging/line6/playback.h
39784--- linux-2.6.39/drivers/staging/line6/playback.h 2011-05-19 00:06:34.000000000 -0400
39785+++ linux-2.6.39/drivers/staging/line6/playback.h 2011-05-22 19:36:32.000000000 -0400
39786@@ -27,7 +27,7 @@
39787 */
39788 #define USE_CLEAR_BUFFER_WORKAROUND 1
39789
39790-extern struct snd_pcm_ops snd_line6_playback_ops;
39791+extern const struct snd_pcm_ops snd_line6_playback_ops;
39792
39793 extern int line6_create_audio_out_urbs(struct snd_line6_pcm *line6pcm);
39794 extern int line6_submit_audio_out_all_urbs(struct snd_line6_pcm *line6pcm);
39795diff -urNp linux-2.6.39/drivers/staging/msm/staging-devices.c linux-2.6.39/drivers/staging/msm/staging-devices.c
39796--- linux-2.6.39/drivers/staging/msm/staging-devices.c 2011-05-19 00:06:34.000000000 -0400
39797+++ linux-2.6.39/drivers/staging/msm/staging-devices.c 2011-05-22 19:36:32.000000000 -0400
39798@@ -211,7 +211,7 @@ static int msm_fb_lcdc_gpio_config(int o
39799 }
39800
39801
39802-static struct lcdc_platform_data lcdc_pdata = {
39803+static const struct lcdc_platform_data lcdc_pdata = {
39804 .lcdc_gpio_config = msm_fb_lcdc_gpio_config,
39805 };
39806
39807diff -urNp linux-2.6.39/drivers/staging/octeon/ethernet.c linux-2.6.39/drivers/staging/octeon/ethernet.c
39808--- linux-2.6.39/drivers/staging/octeon/ethernet.c 2011-05-19 00:06:34.000000000 -0400
39809+++ linux-2.6.39/drivers/staging/octeon/ethernet.c 2011-05-22 19:36:32.000000000 -0400
39810@@ -258,11 +258,11 @@ static struct net_device_stats *cvm_oct_
39811 * since the RX tasklet also increments it.
39812 */
39813 #ifdef CONFIG_64BIT
39814- atomic64_add(rx_status.dropped_packets,
39815- (atomic64_t *)&priv->stats.rx_dropped);
39816+ atomic64_add_unchecked(rx_status.dropped_packets,
39817+ (atomic64_unchecked_t *)&priv->stats.rx_dropped);
39818 #else
39819- atomic_add(rx_status.dropped_packets,
39820- (atomic_t *)&priv->stats.rx_dropped);
39821+ atomic_add_unchecked(rx_status.dropped_packets,
39822+ (atomic_unchecked_t *)&priv->stats.rx_dropped);
39823 #endif
39824 }
39825
39826diff -urNp linux-2.6.39/drivers/staging/octeon/ethernet-rx.c linux-2.6.39/drivers/staging/octeon/ethernet-rx.c
39827--- linux-2.6.39/drivers/staging/octeon/ethernet-rx.c 2011-05-19 00:06:34.000000000 -0400
39828+++ linux-2.6.39/drivers/staging/octeon/ethernet-rx.c 2011-05-22 19:36:32.000000000 -0400
39829@@ -417,11 +417,11 @@ static int cvm_oct_napi_poll(struct napi
39830 /* Increment RX stats for virtual ports */
39831 if (work->ipprt >= CVMX_PIP_NUM_INPUT_PORTS) {
39832 #ifdef CONFIG_64BIT
39833- atomic64_add(1, (atomic64_t *)&priv->stats.rx_packets);
39834- atomic64_add(skb->len, (atomic64_t *)&priv->stats.rx_bytes);
39835+ atomic64_add_unchecked(1, (atomic64_unchecked_t *)&priv->stats.rx_packets);
39836+ atomic64_add_unchecked(skb->len, (atomic64_unchecked_t *)&priv->stats.rx_bytes);
39837 #else
39838- atomic_add(1, (atomic_t *)&priv->stats.rx_packets);
39839- atomic_add(skb->len, (atomic_t *)&priv->stats.rx_bytes);
39840+ atomic_add_unchecked(1, (atomic_unchecked_t *)&priv->stats.rx_packets);
39841+ atomic_add_unchecked(skb->len, (atomic_unchecked_t *)&priv->stats.rx_bytes);
39842 #endif
39843 }
39844 netif_receive_skb(skb);
39845@@ -433,9 +433,9 @@ static int cvm_oct_napi_poll(struct napi
39846 dev->name);
39847 */
39848 #ifdef CONFIG_64BIT
39849- atomic64_add(1, (atomic64_t *)&priv->stats.rx_dropped);
39850+ atomic64_unchecked_add(1, (atomic64_unchecked_t *)&priv->stats.rx_dropped);
39851 #else
39852- atomic_add(1, (atomic_t *)&priv->stats.rx_dropped);
39853+ atomic_add_unchecked(1, (atomic_unchecked_t *)&priv->stats.rx_dropped);
39854 #endif
39855 dev_kfree_skb_irq(skb);
39856 }
39857diff -urNp linux-2.6.39/drivers/staging/olpc_dcon/olpc_dcon.c linux-2.6.39/drivers/staging/olpc_dcon/olpc_dcon.c
39858--- linux-2.6.39/drivers/staging/olpc_dcon/olpc_dcon.c 2011-05-19 00:06:34.000000000 -0400
39859+++ linux-2.6.39/drivers/staging/olpc_dcon/olpc_dcon.c 2011-05-22 19:36:32.000000000 -0400
39860@@ -43,7 +43,7 @@ module_param(noinit, int, 0444);
39861 static int useaa = 1;
39862 module_param(useaa, int, 0444);
39863
39864-static struct dcon_platform_data *pdata;
39865+static const struct dcon_platform_data *pdata;
39866
39867 /* I2C structures */
39868
39869diff -urNp linux-2.6.39/drivers/staging/olpc_dcon/olpc_dcon.h linux-2.6.39/drivers/staging/olpc_dcon/olpc_dcon.h
39870--- linux-2.6.39/drivers/staging/olpc_dcon/olpc_dcon.h 2011-05-19 00:06:34.000000000 -0400
39871+++ linux-2.6.39/drivers/staging/olpc_dcon/olpc_dcon.h 2011-05-22 19:36:32.000000000 -0400
39872@@ -92,11 +92,11 @@ struct dcon_platform_data {
39873 extern irqreturn_t dcon_interrupt(int irq, void *id);
39874
39875 #ifdef CONFIG_FB_OLPC_DCON_1
39876-extern struct dcon_platform_data dcon_pdata_xo_1;
39877+extern const struct dcon_platform_data dcon_pdata_xo_1;
39878 #endif
39879
39880 #ifdef CONFIG_FB_OLPC_DCON_1_5
39881-extern struct dcon_platform_data dcon_pdata_xo_1_5;
39882+extern const struct dcon_platform_data dcon_pdata_xo_1_5;
39883 #endif
39884
39885 #endif
39886diff -urNp linux-2.6.39/drivers/staging/olpc_dcon/olpc_dcon_xo_1_5.c linux-2.6.39/drivers/staging/olpc_dcon/olpc_dcon_xo_1_5.c
39887--- linux-2.6.39/drivers/staging/olpc_dcon/olpc_dcon_xo_1_5.c 2011-05-19 00:06:34.000000000 -0400
39888+++ linux-2.6.39/drivers/staging/olpc_dcon/olpc_dcon_xo_1_5.c 2011-05-22 19:36:32.000000000 -0400
39889@@ -185,7 +185,7 @@ static u8 dcon_read_status_xo_1_5(void)
39890 return status;
39891 }
39892
39893-struct dcon_platform_data dcon_pdata_xo_1_5 = {
39894+const struct dcon_platform_data dcon_pdata_xo_1_5 = {
39895 .init = dcon_init_xo_1_5,
39896 .bus_stabilize_wiggle = dcon_wiggle_xo_1_5,
39897 .set_dconload = dcon_set_dconload_xo_1_5,
39898diff -urNp linux-2.6.39/drivers/staging/olpc_dcon/olpc_dcon_xo_1.c linux-2.6.39/drivers/staging/olpc_dcon/olpc_dcon_xo_1.c
39899--- linux-2.6.39/drivers/staging/olpc_dcon/olpc_dcon_xo_1.c 2011-05-19 00:06:34.000000000 -0400
39900+++ linux-2.6.39/drivers/staging/olpc_dcon/olpc_dcon_xo_1.c 2011-05-22 19:36:32.000000000 -0400
39901@@ -196,7 +196,7 @@ static u8 dcon_read_status_xo_1(void)
39902 return status;
39903 }
39904
39905-struct dcon_platform_data dcon_pdata_xo_1 = {
39906+const struct dcon_platform_data dcon_pdata_xo_1 = {
39907 .init = dcon_init_xo_1,
39908 .bus_stabilize_wiggle = dcon_wiggle_xo_1,
39909 .set_dconload = dcon_set_dconload_1,
39910diff -urNp linux-2.6.39/drivers/staging/phison/phison.c linux-2.6.39/drivers/staging/phison/phison.c
39911--- linux-2.6.39/drivers/staging/phison/phison.c 2011-05-19 00:06:34.000000000 -0400
39912+++ linux-2.6.39/drivers/staging/phison/phison.c 2011-05-22 19:36:32.000000000 -0400
39913@@ -43,7 +43,7 @@ static struct scsi_host_template phison_
39914 ATA_BMDMA_SHT(DRV_NAME),
39915 };
39916
39917-static struct ata_port_operations phison_ops = {
39918+static const struct ata_port_operations phison_ops = {
39919 .inherits = &ata_bmdma_port_ops,
39920 .prereset = phison_pre_reset,
39921 };
39922diff -urNp linux-2.6.39/drivers/staging/pohmelfs/inode.c linux-2.6.39/drivers/staging/pohmelfs/inode.c
39923--- linux-2.6.39/drivers/staging/pohmelfs/inode.c 2011-05-19 00:06:34.000000000 -0400
39924+++ linux-2.6.39/drivers/staging/pohmelfs/inode.c 2011-05-22 19:36:32.000000000 -0400
39925@@ -1855,7 +1855,7 @@ static int pohmelfs_fill_super(struct su
39926 mutex_init(&psb->mcache_lock);
39927 psb->mcache_root = RB_ROOT;
39928 psb->mcache_timeout = msecs_to_jiffies(5000);
39929- atomic_long_set(&psb->mcache_gen, 0);
39930+ atomic_long_set_unchecked(&psb->mcache_gen, 0);
39931
39932 psb->trans_max_pages = 100;
39933
39934@@ -1870,7 +1870,7 @@ static int pohmelfs_fill_super(struct su
39935 INIT_LIST_HEAD(&psb->crypto_ready_list);
39936 INIT_LIST_HEAD(&psb->crypto_active_list);
39937
39938- atomic_set(&psb->trans_gen, 1);
39939+ atomic_set_unchecked(&psb->trans_gen, 1);
39940 atomic_long_set(&psb->total_inodes, 0);
39941
39942 mutex_init(&psb->state_lock);
39943diff -urNp linux-2.6.39/drivers/staging/pohmelfs/mcache.c linux-2.6.39/drivers/staging/pohmelfs/mcache.c
39944--- linux-2.6.39/drivers/staging/pohmelfs/mcache.c 2011-05-19 00:06:34.000000000 -0400
39945+++ linux-2.6.39/drivers/staging/pohmelfs/mcache.c 2011-05-22 19:36:32.000000000 -0400
39946@@ -121,7 +121,7 @@ struct pohmelfs_mcache *pohmelfs_mcache_
39947 m->data = data;
39948 m->start = start;
39949 m->size = size;
39950- m->gen = atomic_long_inc_return(&psb->mcache_gen);
39951+ m->gen = atomic_long_inc_return_unchecked(&psb->mcache_gen);
39952
39953 mutex_lock(&psb->mcache_lock);
39954 err = pohmelfs_mcache_insert(psb, m);
39955diff -urNp linux-2.6.39/drivers/staging/pohmelfs/netfs.h linux-2.6.39/drivers/staging/pohmelfs/netfs.h
39956--- linux-2.6.39/drivers/staging/pohmelfs/netfs.h 2011-05-19 00:06:34.000000000 -0400
39957+++ linux-2.6.39/drivers/staging/pohmelfs/netfs.h 2011-05-22 19:36:32.000000000 -0400
39958@@ -571,14 +571,14 @@ struct pohmelfs_config;
39959 struct pohmelfs_sb {
39960 struct rb_root mcache_root;
39961 struct mutex mcache_lock;
39962- atomic_long_t mcache_gen;
39963+ atomic_long_unchecked_t mcache_gen;
39964 unsigned long mcache_timeout;
39965
39966 unsigned int idx;
39967
39968 unsigned int trans_retries;
39969
39970- atomic_t trans_gen;
39971+ atomic_unchecked_t trans_gen;
39972
39973 unsigned int crypto_attached_size;
39974 unsigned int crypto_align_size;
39975diff -urNp linux-2.6.39/drivers/staging/pohmelfs/trans.c linux-2.6.39/drivers/staging/pohmelfs/trans.c
39976--- linux-2.6.39/drivers/staging/pohmelfs/trans.c 2011-05-19 00:06:34.000000000 -0400
39977+++ linux-2.6.39/drivers/staging/pohmelfs/trans.c 2011-05-22 19:36:32.000000000 -0400
39978@@ -492,7 +492,7 @@ int netfs_trans_finish(struct netfs_tran
39979 int err;
39980 struct netfs_cmd *cmd = t->iovec.iov_base;
39981
39982- t->gen = atomic_inc_return(&psb->trans_gen);
39983+ t->gen = atomic_inc_return_unchecked(&psb->trans_gen);
39984
39985 cmd->size = t->iovec.iov_len - sizeof(struct netfs_cmd) +
39986 t->attached_size + t->attached_pages * sizeof(struct netfs_cmd);
39987diff -urNp linux-2.6.39/drivers/staging/rtl8192u/ieee80211/proc.c linux-2.6.39/drivers/staging/rtl8192u/ieee80211/proc.c
39988--- linux-2.6.39/drivers/staging/rtl8192u/ieee80211/proc.c 2011-05-19 00:06:34.000000000 -0400
39989+++ linux-2.6.39/drivers/staging/rtl8192u/ieee80211/proc.c 2011-05-22 19:36:32.000000000 -0400
39990@@ -87,7 +87,7 @@ static int c_show(struct seq_file *m, vo
39991 return 0;
39992 }
39993
39994-static struct seq_operations crypto_seq_ops = {
39995+static const struct seq_operations crypto_seq_ops = {
39996 .start = c_start,
39997 .next = c_next,
39998 .stop = c_stop,
39999@@ -99,7 +99,7 @@ static int crypto_info_open(struct inode
40000 return seq_open(file, &crypto_seq_ops);
40001 }
40002
40003-static struct file_operations proc_crypto_ops = {
40004+static const struct file_operations proc_crypto_ops = {
40005 .open = crypto_info_open,
40006 .read = seq_read,
40007 .llseek = seq_lseek,
40008diff -urNp linux-2.6.39/drivers/staging/rtl8712/rtl871x_io.h linux-2.6.39/drivers/staging/rtl8712/rtl871x_io.h
40009--- linux-2.6.39/drivers/staging/rtl8712/rtl871x_io.h 2011-05-19 00:06:34.000000000 -0400
40010+++ linux-2.6.39/drivers/staging/rtl8712/rtl871x_io.h 2011-05-22 19:36:32.000000000 -0400
40011@@ -107,7 +107,7 @@ struct intf_hdl {
40012 void (*intf_hdl_unload)(u8 *priv);
40013 void (*intf_hdl_open)(u8 *priv);
40014 void (*intf_hdl_close)(u8 *priv);
40015- struct _io_ops io_ops;
40016+ const struct _io_ops io_ops;
40017 };
40018
40019 struct reg_protocol_rd {
40020diff -urNp linux-2.6.39/drivers/staging/solo6x10/g723.c linux-2.6.39/drivers/staging/solo6x10/g723.c
40021--- linux-2.6.39/drivers/staging/solo6x10/g723.c 2011-05-19 00:06:34.000000000 -0400
40022+++ linux-2.6.39/drivers/staging/solo6x10/g723.c 2011-05-22 19:36:32.000000000 -0400
40023@@ -237,7 +237,7 @@ static int snd_solo_pcm_copy(struct snd_
40024 return 0;
40025 }
40026
40027-static struct snd_pcm_ops snd_solo_pcm_ops = {
40028+static const struct snd_pcm_ops snd_solo_pcm_ops = {
40029 .open = snd_solo_pcm_open,
40030 .close = snd_solo_pcm_close,
40031 .ioctl = snd_pcm_lib_ioctl,
40032@@ -334,7 +334,7 @@ static int solo_snd_pcm_init(struct solo
40033
40034 int solo_g723_init(struct solo_dev *solo_dev)
40035 {
40036- static struct snd_device_ops ops = { NULL };
40037+ static const struct snd_device_ops ops = { NULL };
40038 struct snd_card *card;
40039 struct snd_kcontrol_new kctl;
40040 char name[32];
40041diff -urNp linux-2.6.39/drivers/staging/spectra/ffsport.c linux-2.6.39/drivers/staging/spectra/ffsport.c
40042--- linux-2.6.39/drivers/staging/spectra/ffsport.c 2011-05-19 00:06:34.000000000 -0400
40043+++ linux-2.6.39/drivers/staging/spectra/ffsport.c 2011-05-22 19:36:32.000000000 -0400
40044@@ -604,7 +604,7 @@ int GLOB_SBD_unlocked_ioctl(struct block
40045 return ret;
40046 }
40047
40048-static struct block_device_operations GLOB_SBD_ops = {
40049+static const struct block_device_operations GLOB_SBD_ops = {
40050 .owner = THIS_MODULE,
40051 .open = GLOB_SBD_open,
40052 .release = GLOB_SBD_release,
40053diff -urNp linux-2.6.39/drivers/staging/tm6000/tm6000-alsa.c linux-2.6.39/drivers/staging/tm6000/tm6000-alsa.c
40054--- linux-2.6.39/drivers/staging/tm6000/tm6000-alsa.c 2011-05-19 00:06:34.000000000 -0400
40055+++ linux-2.6.39/drivers/staging/tm6000/tm6000-alsa.c 2011-05-22 19:36:32.000000000 -0400
40056@@ -380,7 +380,7 @@ static snd_pcm_uframes_t snd_tm6000_poin
40057 /*
40058 * operators
40059 */
40060-static struct snd_pcm_ops snd_tm6000_pcm_ops = {
40061+static const struct snd_pcm_ops snd_tm6000_pcm_ops = {
40062 .open = snd_tm6000_pcm_open,
40063 .close = snd_tm6000_close,
40064 .ioctl = snd_pcm_lib_ioctl,
40065diff -urNp linux-2.6.39/drivers/staging/tty/istallion.c linux-2.6.39/drivers/staging/tty/istallion.c
40066--- linux-2.6.39/drivers/staging/tty/istallion.c 2011-05-19 00:06:34.000000000 -0400
40067+++ linux-2.6.39/drivers/staging/tty/istallion.c 2011-05-22 20:49:07.000000000 -0400
40068@@ -186,7 +186,6 @@ static struct ktermios stli_deftermios
40069 * re-used for each stats call.
40070 */
40071 static comstats_t stli_comstats;
40072-static combrd_t stli_brdstats;
40073 static struct asystats stli_cdkstats;
40074
40075 /*****************************************************************************/
40076@@ -4003,6 +4002,7 @@ out:
40077
40078 static int stli_getbrdstats(combrd_t __user *bp)
40079 {
40080+ combrd_t stli_brdstats;
40081 struct stlibrd *brdp;
40082 unsigned int i;
40083
40084@@ -4226,6 +4226,8 @@ static int stli_getportstruct(struct stl
40085 struct stliport stli_dummyport;
40086 struct stliport *portp;
40087
40088+ pax_track_stack();
40089+
40090 if (copy_from_user(&stli_dummyport, arg, sizeof(struct stliport)))
40091 return -EFAULT;
40092 portp = stli_getport(stli_dummyport.brdnr, stli_dummyport.panelnr,
40093@@ -4248,6 +4250,8 @@ static int stli_getbrdstruct(struct stli
40094 struct stlibrd stli_dummybrd;
40095 struct stlibrd *brdp;
40096
40097+ pax_track_stack();
40098+
40099 if (copy_from_user(&stli_dummybrd, arg, sizeof(struct stlibrd)))
40100 return -EFAULT;
40101 if (stli_dummybrd.brdnr >= STL_MAXBRDS)
40102diff -urNp linux-2.6.39/drivers/staging/tty/stallion.c linux-2.6.39/drivers/staging/tty/stallion.c
40103--- linux-2.6.39/drivers/staging/tty/stallion.c 2011-05-19 00:06:34.000000000 -0400
40104+++ linux-2.6.39/drivers/staging/tty/stallion.c 2011-05-22 19:36:32.000000000 -0400
40105@@ -2406,6 +2406,8 @@ static int stl_getportstruct(struct stlp
40106 struct stlport stl_dummyport;
40107 struct stlport *portp;
40108
40109+ pax_track_stack();
40110+
40111 if (copy_from_user(&stl_dummyport, arg, sizeof(struct stlport)))
40112 return -EFAULT;
40113 portp = stl_getport(stl_dummyport.brdnr, stl_dummyport.panelnr,
40114diff -urNp linux-2.6.39/drivers/staging/usbip/vhci.h linux-2.6.39/drivers/staging/usbip/vhci.h
40115--- linux-2.6.39/drivers/staging/usbip/vhci.h 2011-05-19 00:06:34.000000000 -0400
40116+++ linux-2.6.39/drivers/staging/usbip/vhci.h 2011-05-22 19:36:32.000000000 -0400
40117@@ -92,7 +92,7 @@ struct vhci_hcd {
40118 unsigned resuming:1;
40119 unsigned long re_timeout;
40120
40121- atomic_t seqnum;
40122+ atomic_unchecked_t seqnum;
40123
40124 /*
40125 * NOTE:
40126diff -urNp linux-2.6.39/drivers/staging/usbip/vhci_hcd.c linux-2.6.39/drivers/staging/usbip/vhci_hcd.c
40127--- linux-2.6.39/drivers/staging/usbip/vhci_hcd.c 2011-05-19 00:06:34.000000000 -0400
40128+++ linux-2.6.39/drivers/staging/usbip/vhci_hcd.c 2011-05-22 19:36:32.000000000 -0400
40129@@ -536,7 +536,7 @@ static void vhci_tx_urb(struct urb *urb)
40130 return;
40131 }
40132
40133- priv->seqnum = atomic_inc_return(&the_controller->seqnum);
40134+ priv->seqnum = atomic_inc_return_unchecked(&the_controller->seqnum);
40135 if (priv->seqnum == 0xffff)
40136 usbip_uinfo("seqnum max\n");
40137
40138@@ -795,7 +795,7 @@ static int vhci_urb_dequeue(struct usb_h
40139 return -ENOMEM;
40140 }
40141
40142- unlink->seqnum = atomic_inc_return(&the_controller->seqnum);
40143+ unlink->seqnum = atomic_inc_return_unchecked(&the_controller->seqnum);
40144 if (unlink->seqnum == 0xffff)
40145 usbip_uinfo("seqnum max\n");
40146
40147@@ -992,7 +992,7 @@ static int vhci_start(struct usb_hcd *hc
40148 vdev->rhport = rhport;
40149 }
40150
40151- atomic_set(&vhci->seqnum, 0);
40152+ atomic_set_unchecked(&vhci->seqnum, 0);
40153 spin_lock_init(&vhci->lock);
40154
40155
40156diff -urNp linux-2.6.39/drivers/staging/usbip/vhci_rx.c linux-2.6.39/drivers/staging/usbip/vhci_rx.c
40157--- linux-2.6.39/drivers/staging/usbip/vhci_rx.c 2011-05-19 00:06:34.000000000 -0400
40158+++ linux-2.6.39/drivers/staging/usbip/vhci_rx.c 2011-05-22 19:36:32.000000000 -0400
40159@@ -81,7 +81,7 @@ static void vhci_recv_ret_submit(struct
40160 usbip_uerr("cannot find a urb of seqnum %u\n",
40161 pdu->base.seqnum);
40162 usbip_uinfo("max seqnum %d\n",
40163- atomic_read(&the_controller->seqnum));
40164+ atomic_read_unchecked(&the_controller->seqnum));
40165 usbip_event_add(ud, VDEV_EVENT_ERROR_TCP);
40166 return;
40167 }
40168diff -urNp linux-2.6.39/drivers/staging/vme/devices/vme_user.c linux-2.6.39/drivers/staging/vme/devices/vme_user.c
40169--- linux-2.6.39/drivers/staging/vme/devices/vme_user.c 2011-05-19 00:06:34.000000000 -0400
40170+++ linux-2.6.39/drivers/staging/vme/devices/vme_user.c 2011-05-22 19:36:32.000000000 -0400
40171@@ -138,7 +138,7 @@ static long vme_user_unlocked_ioctl(stru
40172 static int __devinit vme_user_probe(struct device *, int, int);
40173 static int __devexit vme_user_remove(struct device *, int, int);
40174
40175-static struct file_operations vme_user_fops = {
40176+static const struct file_operations vme_user_fops = {
40177 .open = vme_user_open,
40178 .release = vme_user_release,
40179 .read = vme_user_read,
40180diff -urNp linux-2.6.39/drivers/staging/westbridge/astoria/block/cyasblkdev_block.c linux-2.6.39/drivers/staging/westbridge/astoria/block/cyasblkdev_block.c
40181--- linux-2.6.39/drivers/staging/westbridge/astoria/block/cyasblkdev_block.c 2011-05-19 00:06:34.000000000 -0400
40182+++ linux-2.6.39/drivers/staging/westbridge/astoria/block/cyasblkdev_block.c 2011-05-22 19:36:32.000000000 -0400
40183@@ -426,7 +426,7 @@ int cyasblkdev_revalidate_disk(struct ge
40184
40185
40186 /*standard block device driver interface */
40187-static struct block_device_operations cyasblkdev_bdops = {
40188+static const struct block_device_operations cyasblkdev_bdops = {
40189 .open = cyasblkdev_blk_open,
40190 .release = cyasblkdev_blk_release,
40191 .ioctl = cyasblkdev_blk_ioctl,
40192diff -urNp linux-2.6.39/drivers/staging/wlags49_h2/wl_netdev.c linux-2.6.39/drivers/staging/wlags49_h2/wl_netdev.c
40193--- linux-2.6.39/drivers/staging/wlags49_h2/wl_netdev.c 2011-05-19 00:06:34.000000000 -0400
40194+++ linux-2.6.39/drivers/staging/wlags49_h2/wl_netdev.c 2011-05-22 19:36:32.000000000 -0400
40195@@ -474,7 +474,7 @@ static void wl_get_drvinfo(struct net_de
40196 }
40197 } // wl_get_drvinfo
40198
40199-static struct ethtool_ops wl_ethtool_ops = {
40200+static const struct ethtool_ops wl_ethtool_ops = {
40201 .get_drvinfo = wl_get_drvinfo,
40202 .get_link = ethtool_op_get_link,
40203 };
40204diff -urNp linux-2.6.39/drivers/staging/wlan-ng/hfa384x_usb.c linux-2.6.39/drivers/staging/wlan-ng/hfa384x_usb.c
40205--- linux-2.6.39/drivers/staging/wlan-ng/hfa384x_usb.c 2011-05-19 00:06:34.000000000 -0400
40206+++ linux-2.6.39/drivers/staging/wlan-ng/hfa384x_usb.c 2011-05-22 19:36:32.000000000 -0400
40207@@ -671,7 +671,7 @@ struct usbctlx_cmd_completor {
40208 hfa384x_cmdresult_t *result;
40209 };
40210
40211-static inline int usbctlx_cmd_completor_fn(struct usbctlx_completor *head)
40212+static inline int usbctlx_cmd_completor_fn(const struct usbctlx_completor *head)
40213 {
40214 struct usbctlx_cmd_completor *complete;
40215
40216@@ -705,7 +705,7 @@ struct usbctlx_rrid_completor {
40217 unsigned int riddatalen;
40218 };
40219
40220-static int usbctlx_rrid_completor_fn(struct usbctlx_completor *head)
40221+static int usbctlx_rrid_completor_fn(const struct usbctlx_completor *head)
40222 {
40223 struct usbctlx_rrid_completor *complete;
40224 hfa384x_rridresult_t rridresult;
40225@@ -768,7 +768,7 @@ struct usbctlx_rmem_completor {
40226 };
40227 typedef struct usbctlx_rmem_completor usbctlx_rmem_completor_t;
40228
40229-static int usbctlx_rmem_completor_fn(struct usbctlx_completor *head)
40230+static int usbctlx_rmem_completor_fn(const struct usbctlx_completor *head)
40231 {
40232 usbctlx_rmem_completor_t *complete = (usbctlx_rmem_completor_t *) head;
40233
40234diff -urNp linux-2.6.39/drivers/staging/zcache/tmem.c linux-2.6.39/drivers/staging/zcache/tmem.c
40235--- linux-2.6.39/drivers/staging/zcache/tmem.c 2011-05-19 00:06:34.000000000 -0400
40236+++ linux-2.6.39/drivers/staging/zcache/tmem.c 2011-05-22 19:36:32.000000000 -0400
40237@@ -39,7 +39,7 @@
40238 * A tmem host implementation must use this function to register callbacks
40239 * for memory allocation.
40240 */
40241-static struct tmem_hostops tmem_hostops;
40242+static const struct tmem_hostops tmem_hostops;
40243
40244 static void tmem_objnode_tree_init(void);
40245
40246@@ -53,7 +53,7 @@ void tmem_register_hostops(struct tmem_h
40247 * A tmem host implementation must use this function to register
40248 * callbacks for a page-accessible memory (PAM) implementation
40249 */
40250-static struct tmem_pamops tmem_pamops;
40251+static const struct tmem_pamops tmem_pamops;
40252
40253 void tmem_register_pamops(struct tmem_pamops *m)
40254 {
40255diff -urNp linux-2.6.39/drivers/staging/zcache/zcache.c linux-2.6.39/drivers/staging/zcache/zcache.c
40256--- linux-2.6.39/drivers/staging/zcache/zcache.c 2011-05-19 00:06:34.000000000 -0400
40257+++ linux-2.6.39/drivers/staging/zcache/zcache.c 2011-05-22 19:36:32.000000000 -0400
40258@@ -882,7 +882,7 @@ static void zcache_obj_free(struct tmem_
40259 kmem_cache_free(zcache_obj_cache, obj);
40260 }
40261
40262-static struct tmem_hostops zcache_hostops = {
40263+static const struct tmem_hostops zcache_hostops = {
40264 .obj_alloc = zcache_obj_alloc,
40265 .obj_free = zcache_obj_free,
40266 .objnode_alloc = zcache_objnode_alloc,
40267@@ -987,7 +987,7 @@ static void zcache_pampd_free(void *pamp
40268 }
40269 }
40270
40271-static struct tmem_pamops zcache_pamops = {
40272+static const struct tmem_pamops zcache_pamops = {
40273 .create = zcache_pampd_create,
40274 .get_data = zcache_pampd_get_data,
40275 .free = zcache_pampd_free,
40276diff -urNp linux-2.6.39/drivers/target/target_core_alua.c linux-2.6.39/drivers/target/target_core_alua.c
40277--- linux-2.6.39/drivers/target/target_core_alua.c 2011-05-19 00:06:34.000000000 -0400
40278+++ linux-2.6.39/drivers/target/target_core_alua.c 2011-05-22 19:36:32.000000000 -0400
40279@@ -675,6 +675,8 @@ static int core_alua_update_tpg_primary_
40280 char path[ALUA_METADATA_PATH_LEN];
40281 int len;
40282
40283+ pax_track_stack();
40284+
40285 memset(path, 0, ALUA_METADATA_PATH_LEN);
40286
40287 len = snprintf(md_buf, tg_pt_gp->tg_pt_gp_md_buf_len,
40288@@ -938,6 +940,8 @@ static int core_alua_update_tpg_secondar
40289 char path[ALUA_METADATA_PATH_LEN], wwn[ALUA_SECONDARY_METADATA_WWN_LEN];
40290 int len;
40291
40292+ pax_track_stack();
40293+
40294 memset(path, 0, ALUA_METADATA_PATH_LEN);
40295 memset(wwn, 0, ALUA_SECONDARY_METADATA_WWN_LEN);
40296
40297diff -urNp linux-2.6.39/drivers/target/target_core_cdb.c linux-2.6.39/drivers/target/target_core_cdb.c
40298--- linux-2.6.39/drivers/target/target_core_cdb.c 2011-05-19 00:06:34.000000000 -0400
40299+++ linux-2.6.39/drivers/target/target_core_cdb.c 2011-05-22 19:36:32.000000000 -0400
40300@@ -838,6 +838,8 @@ target_emulate_modesense(struct se_cmd *
40301 int length = 0;
40302 unsigned char buf[SE_MODE_PAGE_BUF];
40303
40304+ pax_track_stack();
40305+
40306 memset(buf, 0, SE_MODE_PAGE_BUF);
40307
40308 switch (cdb[2] & 0x3f) {
40309diff -urNp linux-2.6.39/drivers/target/target_core_configfs.c linux-2.6.39/drivers/target/target_core_configfs.c
40310--- linux-2.6.39/drivers/target/target_core_configfs.c 2011-05-19 00:06:34.000000000 -0400
40311+++ linux-2.6.39/drivers/target/target_core_configfs.c 2011-05-22 19:36:32.000000000 -0400
40312@@ -1280,6 +1280,8 @@ static ssize_t target_core_dev_pr_show_a
40313 ssize_t len = 0;
40314 int reg_count = 0, prf_isid;
40315
40316+ pax_track_stack();
40317+
40318 if (!(su_dev->se_dev_ptr))
40319 return -ENODEV;
40320
40321@@ -2682,7 +2684,7 @@ static void target_core_alua_drop_tg_pt_
40322 config_item_put(item);
40323 }
40324
40325-static struct configfs_group_operations target_core_alua_tg_pt_gps_group_ops = {
40326+static const struct configfs_group_operations target_core_alua_tg_pt_gps_group_ops = {
40327 .make_group = &target_core_alua_create_tg_pt_gp,
40328 .drop_item = &target_core_alua_drop_tg_pt_gp,
40329 };
40330@@ -2726,7 +2728,7 @@ static void target_core_stat_rmdir(
40331 return;
40332 }
40333
40334-static struct configfs_group_operations target_core_stat_group_ops = {
40335+static const struct configfs_group_operations target_core_stat_group_ops = {
40336 .make_group = &target_core_stat_mkdir,
40337 .drop_item = &target_core_stat_rmdir,
40338 };
40339@@ -2939,7 +2941,7 @@ static void target_core_drop_subdev(
40340 mutex_unlock(&hba->hba_access_mutex);
40341 }
40342
40343-static struct configfs_group_operations target_core_hba_group_ops = {
40344+static const struct configfs_group_operations target_core_hba_group_ops = {
40345 .make_group = target_core_make_subdev,
40346 .drop_item = target_core_drop_subdev,
40347 };
40348@@ -3117,7 +3119,7 @@ static void target_core_call_delhbafromt
40349 config_item_put(item);
40350 }
40351
40352-static struct configfs_group_operations target_core_group_ops = {
40353+static const struct configfs_group_operations target_core_group_ops = {
40354 .make_group = target_core_call_addhbatotarget,
40355 .drop_item = target_core_call_delhbafromtarget,
40356 };
40357diff -urNp linux-2.6.39/drivers/target/target_core_fabric_configfs.c linux-2.6.39/drivers/target/target_core_fabric_configfs.c
40358--- linux-2.6.39/drivers/target/target_core_fabric_configfs.c 2011-05-19 00:06:34.000000000 -0400
40359+++ linux-2.6.39/drivers/target/target_core_fabric_configfs.c 2011-05-22 19:36:32.000000000 -0400
40360@@ -1174,7 +1174,7 @@ static void target_fabric_drop_wwn(
40361 config_item_put(item);
40362 }
40363
40364-static struct configfs_group_operations target_fabric_wwn_group_ops = {
40365+static const struct configfs_group_operations target_fabric_wwn_group_ops = {
40366 .make_group = target_fabric_make_wwn,
40367 .drop_item = target_fabric_drop_wwn,
40368 };
40369diff -urNp linux-2.6.39/drivers/target/target_core_pr.c linux-2.6.39/drivers/target/target_core_pr.c
40370--- linux-2.6.39/drivers/target/target_core_pr.c 2011-05-19 00:06:34.000000000 -0400
40371+++ linux-2.6.39/drivers/target/target_core_pr.c 2011-05-22 19:36:32.000000000 -0400
40372@@ -918,6 +918,8 @@ static int __core_scsi3_check_aptpl_regi
40373 unsigned char t_port[PR_APTPL_MAX_TPORT_LEN];
40374 u16 tpgt;
40375
40376+ pax_track_stack();
40377+
40378 memset(i_port, 0, PR_APTPL_MAX_IPORT_LEN);
40379 memset(t_port, 0, PR_APTPL_MAX_TPORT_LEN);
40380 /*
40381@@ -1861,6 +1863,8 @@ static int __core_scsi3_update_aptpl_buf
40382 ssize_t len = 0;
40383 int reg_count = 0;
40384
40385+ pax_track_stack();
40386+
40387 memset(buf, 0, pr_aptpl_buf_len);
40388 /*
40389 * Called to clear metadata once APTPL has been deactivated.
40390@@ -1983,6 +1987,8 @@ static int __core_scsi3_write_aptpl_to_f
40391 char path[512];
40392 int ret;
40393
40394+ pax_track_stack();
40395+
40396 memset(iov, 0, sizeof(struct iovec));
40397 memset(path, 0, 512);
40398
40399diff -urNp linux-2.6.39/drivers/target/target_core_tmr.c linux-2.6.39/drivers/target/target_core_tmr.c
40400--- linux-2.6.39/drivers/target/target_core_tmr.c 2011-05-19 00:06:34.000000000 -0400
40401+++ linux-2.6.39/drivers/target/target_core_tmr.c 2011-05-22 19:36:32.000000000 -0400
40402@@ -262,7 +262,7 @@ int core_tmr_lun_reset(
40403 CMD_TFO(cmd)->get_task_tag(cmd), cmd->pr_res_key,
40404 T_TASK(cmd)->t_task_cdbs,
40405 atomic_read(&T_TASK(cmd)->t_task_cdbs_left),
40406- atomic_read(&T_TASK(cmd)->t_task_cdbs_sent),
40407+ atomic_read_unchecked(&T_TASK(cmd)->t_task_cdbs_sent),
40408 atomic_read(&T_TASK(cmd)->t_transport_active),
40409 atomic_read(&T_TASK(cmd)->t_transport_stop),
40410 atomic_read(&T_TASK(cmd)->t_transport_sent));
40411@@ -304,7 +304,7 @@ int core_tmr_lun_reset(
40412 DEBUG_LR("LUN_RESET: got t_transport_active = 1 for"
40413 " task: %p, t_fe_count: %d dev: %p\n", task,
40414 fe_count, dev);
40415- atomic_set(&T_TASK(cmd)->t_transport_aborted, 1);
40416+ atomic_set_unchecked(&T_TASK(cmd)->t_transport_aborted, 1);
40417 spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock,
40418 flags);
40419 core_tmr_handle_tas_abort(tmr_nacl, cmd, tas, fe_count);
40420@@ -314,7 +314,7 @@ int core_tmr_lun_reset(
40421 }
40422 DEBUG_LR("LUN_RESET: Got t_transport_active = 0 for task: %p,"
40423 " t_fe_count: %d dev: %p\n", task, fe_count, dev);
40424- atomic_set(&T_TASK(cmd)->t_transport_aborted, 1);
40425+ atomic_set_unchecked(&T_TASK(cmd)->t_transport_aborted, 1);
40426 spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock, flags);
40427 core_tmr_handle_tas_abort(tmr_nacl, cmd, tas, fe_count);
40428
40429diff -urNp linux-2.6.39/drivers/target/target_core_transport.c linux-2.6.39/drivers/target/target_core_transport.c
40430--- linux-2.6.39/drivers/target/target_core_transport.c 2011-05-19 00:06:34.000000000 -0400
40431+++ linux-2.6.39/drivers/target/target_core_transport.c 2011-05-22 19:36:32.000000000 -0400
40432@@ -1675,7 +1675,7 @@ struct se_device *transport_add_device_t
40433
40434 dev->queue_depth = dev_limits->queue_depth;
40435 atomic_set(&dev->depth_left, dev->queue_depth);
40436- atomic_set(&dev->dev_ordered_id, 0);
40437+ atomic_set_unchecked(&dev->dev_ordered_id, 0);
40438
40439 se_dev_set_default_attribs(dev, dev_limits);
40440
40441@@ -1876,7 +1876,7 @@ static int transport_check_alloc_task_at
40442 * Used to determine when ORDERED commands should go from
40443 * Dormant to Active status.
40444 */
40445- cmd->se_ordered_id = atomic_inc_return(&SE_DEV(cmd)->dev_ordered_id);
40446+ cmd->se_ordered_id = atomic_inc_return_unchecked(&SE_DEV(cmd)->dev_ordered_id);
40447 smp_mb__after_atomic_inc();
40448 DEBUG_STA("Allocated se_ordered_id: %u for Task Attr: 0x%02x on %s\n",
40449 cmd->se_ordered_id, cmd->sam_task_attr,
40450@@ -2156,7 +2156,7 @@ static void transport_generic_request_fa
40451 " t_transport_active: %d t_transport_stop: %d"
40452 " t_transport_sent: %d\n", T_TASK(cmd)->t_task_cdbs,
40453 atomic_read(&T_TASK(cmd)->t_task_cdbs_left),
40454- atomic_read(&T_TASK(cmd)->t_task_cdbs_sent),
40455+ atomic_read_unchecked(&T_TASK(cmd)->t_task_cdbs_sent),
40456 atomic_read(&T_TASK(cmd)->t_task_cdbs_ex_left),
40457 atomic_read(&T_TASK(cmd)->t_transport_active),
40458 atomic_read(&T_TASK(cmd)->t_transport_stop),
40459@@ -2660,9 +2660,9 @@ check_depth:
40460 spin_lock_irqsave(&T_TASK(cmd)->t_state_lock, flags);
40461 atomic_set(&task->task_active, 1);
40462 atomic_set(&task->task_sent, 1);
40463- atomic_inc(&T_TASK(cmd)->t_task_cdbs_sent);
40464+ atomic_inc_unchecked(&T_TASK(cmd)->t_task_cdbs_sent);
40465
40466- if (atomic_read(&T_TASK(cmd)->t_task_cdbs_sent) ==
40467+ if (atomic_read_unchecked(&T_TASK(cmd)->t_task_cdbs_sent) ==
40468 T_TASK(cmd)->t_task_cdbs)
40469 atomic_set(&cmd->transport_sent, 1);
40470
40471@@ -5549,7 +5549,7 @@ static void transport_generic_wait_for_t
40472 atomic_set(&T_TASK(cmd)->transport_lun_stop, 0);
40473 }
40474 if (!atomic_read(&T_TASK(cmd)->t_transport_active) ||
40475- atomic_read(&T_TASK(cmd)->t_transport_aborted))
40476+ atomic_read_unchecked(&T_TASK(cmd)->t_transport_aborted))
40477 goto remove;
40478
40479 atomic_set(&T_TASK(cmd)->t_transport_stop, 1);
40480@@ -5778,7 +5778,7 @@ int transport_check_aborted_status(struc
40481 {
40482 int ret = 0;
40483
40484- if (atomic_read(&T_TASK(cmd)->t_transport_aborted) != 0) {
40485+ if (atomic_read_unchecked(&T_TASK(cmd)->t_transport_aborted) != 0) {
40486 if (!(send_status) ||
40487 (cmd->se_cmd_flags & SCF_SENT_DELAYED_TAS))
40488 return 1;
40489@@ -5806,7 +5806,7 @@ void transport_send_task_abort(struct se
40490 */
40491 if (cmd->data_direction == DMA_TO_DEVICE) {
40492 if (CMD_TFO(cmd)->write_pending_status(cmd) != 0) {
40493- atomic_inc(&T_TASK(cmd)->t_transport_aborted);
40494+ atomic_inc_unchecked(&T_TASK(cmd)->t_transport_aborted);
40495 smp_mb__after_atomic_inc();
40496 cmd->scsi_status = SAM_STAT_TASK_ABORTED;
40497 transport_new_cmd_failure(cmd);
40498@@ -5930,7 +5930,7 @@ static void transport_processing_shutdow
40499 CMD_TFO(cmd)->get_task_tag(cmd),
40500 T_TASK(cmd)->t_task_cdbs,
40501 atomic_read(&T_TASK(cmd)->t_task_cdbs_left),
40502- atomic_read(&T_TASK(cmd)->t_task_cdbs_sent),
40503+ atomic_read_unchecked(&T_TASK(cmd)->t_task_cdbs_sent),
40504 atomic_read(&T_TASK(cmd)->t_transport_active),
40505 atomic_read(&T_TASK(cmd)->t_transport_stop),
40506 atomic_read(&T_TASK(cmd)->t_transport_sent));
40507diff -urNp linux-2.6.39/drivers/telephony/ixj.c linux-2.6.39/drivers/telephony/ixj.c
40508--- linux-2.6.39/drivers/telephony/ixj.c 2011-05-19 00:06:34.000000000 -0400
40509+++ linux-2.6.39/drivers/telephony/ixj.c 2011-05-22 19:36:32.000000000 -0400
40510@@ -4976,6 +4976,8 @@ static int ixj_daa_cid_read(IXJ *j)
40511 bool mContinue;
40512 char *pIn, *pOut;
40513
40514+ pax_track_stack();
40515+
40516 if (!SCI_Prepare(j))
40517 return 0;
40518
40519diff -urNp linux-2.6.39/drivers/tty/hvc/hvc_console.h linux-2.6.39/drivers/tty/hvc/hvc_console.h
40520--- linux-2.6.39/drivers/tty/hvc/hvc_console.h 2011-05-19 00:06:34.000000000 -0400
40521+++ linux-2.6.39/drivers/tty/hvc/hvc_console.h 2011-05-22 19:36:32.000000000 -0400
40522@@ -82,6 +82,7 @@ extern int hvc_instantiate(uint32_t vter
40523 /* register a vterm for hvc tty operation (module_init or hotplug add) */
40524 extern struct hvc_struct * hvc_alloc(uint32_t vtermno, int data,
40525 const struct hv_ops *ops, int outbuf_size);
40526+
40527 /* remove a vterm from hvc tty operation (module_exit or hotplug remove) */
40528 extern int hvc_remove(struct hvc_struct *hp);
40529
40530diff -urNp linux-2.6.39/drivers/tty/hvc/hvc_iucv.c linux-2.6.39/drivers/tty/hvc/hvc_iucv.c
40531--- linux-2.6.39/drivers/tty/hvc/hvc_iucv.c 2011-05-19 00:06:34.000000000 -0400
40532+++ linux-2.6.39/drivers/tty/hvc/hvc_iucv.c 2011-05-22 19:36:32.000000000 -0400
40533@@ -1203,7 +1203,7 @@ static int param_get_vmidfilter(char *bu
40534
40535 #define param_check_vmidfilter(name, p) __param_check(name, p, void)
40536
40537-static struct kernel_param_ops param_ops_vmidfilter = {
40538+static const struct kernel_param_ops param_ops_vmidfilter = {
40539 .set = param_set_vmidfilter,
40540 .get = param_get_vmidfilter,
40541 };
40542diff -urNp linux-2.6.39/drivers/tty/hvc/hvcs.c linux-2.6.39/drivers/tty/hvc/hvcs.c
40543--- linux-2.6.39/drivers/tty/hvc/hvcs.c 2011-05-19 00:06:34.000000000 -0400
40544+++ linux-2.6.39/drivers/tty/hvc/hvcs.c 2011-05-22 19:36:32.000000000 -0400
40545@@ -83,6 +83,7 @@
40546 #include <asm/hvcserver.h>
40547 #include <asm/uaccess.h>
40548 #include <asm/vio.h>
40549+#include <asm/local.h>
40550
40551 /*
40552 * 1.3.0 -> 1.3.1 In hvcs_open memset(..,0x00,..) instead of memset(..,0x3F,00).
40553@@ -270,7 +271,7 @@ struct hvcs_struct {
40554 unsigned int index;
40555
40556 struct tty_struct *tty;
40557- int open_count;
40558+ local_t open_count;
40559
40560 /*
40561 * Used to tell the driver kernel_thread what operations need to take
40562@@ -422,7 +423,7 @@ static ssize_t hvcs_vterm_state_store(st
40563
40564 spin_lock_irqsave(&hvcsd->lock, flags);
40565
40566- if (hvcsd->open_count > 0) {
40567+ if (local_read(&hvcsd->open_count) > 0) {
40568 spin_unlock_irqrestore(&hvcsd->lock, flags);
40569 printk(KERN_INFO "HVCS: vterm state unchanged. "
40570 "The hvcs device node is still in use.\n");
40571@@ -1145,7 +1146,7 @@ static int hvcs_open(struct tty_struct *
40572 if ((retval = hvcs_partner_connect(hvcsd)))
40573 goto error_release;
40574
40575- hvcsd->open_count = 1;
40576+ local_set(&hvcsd->open_count, 1);
40577 hvcsd->tty = tty;
40578 tty->driver_data = hvcsd;
40579
40580@@ -1179,7 +1180,7 @@ fast_open:
40581
40582 spin_lock_irqsave(&hvcsd->lock, flags);
40583 kref_get(&hvcsd->kref);
40584- hvcsd->open_count++;
40585+ local_inc(&hvcsd->open_count);
40586 hvcsd->todo_mask |= HVCS_SCHED_READ;
40587 spin_unlock_irqrestore(&hvcsd->lock, flags);
40588
40589@@ -1223,7 +1224,7 @@ static void hvcs_close(struct tty_struct
40590 hvcsd = tty->driver_data;
40591
40592 spin_lock_irqsave(&hvcsd->lock, flags);
40593- if (--hvcsd->open_count == 0) {
40594+ if (local_dec_and_test(&hvcsd->open_count)) {
40595
40596 vio_disable_interrupts(hvcsd->vdev);
40597
40598@@ -1249,10 +1250,10 @@ static void hvcs_close(struct tty_struct
40599 free_irq(irq, hvcsd);
40600 kref_put(&hvcsd->kref, destroy_hvcs_struct);
40601 return;
40602- } else if (hvcsd->open_count < 0) {
40603+ } else if (local_read(&hvcsd->open_count) < 0) {
40604 printk(KERN_ERR "HVCS: vty-server@%X open_count: %d"
40605 " is missmanaged.\n",
40606- hvcsd->vdev->unit_address, hvcsd->open_count);
40607+ hvcsd->vdev->unit_address, local_read(&hvcsd->open_count));
40608 }
40609
40610 spin_unlock_irqrestore(&hvcsd->lock, flags);
40611@@ -1268,7 +1269,7 @@ static void hvcs_hangup(struct tty_struc
40612
40613 spin_lock_irqsave(&hvcsd->lock, flags);
40614 /* Preserve this so that we know how many kref refs to put */
40615- temp_open_count = hvcsd->open_count;
40616+ temp_open_count = local_read(&hvcsd->open_count);
40617
40618 /*
40619 * Don't kref put inside the spinlock because the destruction
40620@@ -1283,7 +1284,7 @@ static void hvcs_hangup(struct tty_struc
40621 hvcsd->tty->driver_data = NULL;
40622 hvcsd->tty = NULL;
40623
40624- hvcsd->open_count = 0;
40625+ local_set(&hvcsd->open_count, 0);
40626
40627 /* This will drop any buffered data on the floor which is OK in a hangup
40628 * scenario. */
40629@@ -1354,7 +1355,7 @@ static int hvcs_write(struct tty_struct
40630 * the middle of a write operation? This is a crummy place to do this
40631 * but we want to keep it all in the spinlock.
40632 */
40633- if (hvcsd->open_count <= 0) {
40634+ if (local_read(&hvcsd->open_count) <= 0) {
40635 spin_unlock_irqrestore(&hvcsd->lock, flags);
40636 return -ENODEV;
40637 }
40638@@ -1428,7 +1429,7 @@ static int hvcs_write_room(struct tty_st
40639 {
40640 struct hvcs_struct *hvcsd = tty->driver_data;
40641
40642- if (!hvcsd || hvcsd->open_count <= 0)
40643+ if (!hvcsd || local_read(&hvcsd->open_count) <= 0)
40644 return 0;
40645
40646 return HVCS_BUFF_LEN - hvcsd->chars_in_buffer;
40647diff -urNp linux-2.6.39/drivers/tty/hvc/hvc_xen.c linux-2.6.39/drivers/tty/hvc/hvc_xen.c
40648--- linux-2.6.39/drivers/tty/hvc/hvc_xen.c 2011-05-19 00:06:34.000000000 -0400
40649+++ linux-2.6.39/drivers/tty/hvc/hvc_xen.c 2011-05-22 19:36:32.000000000 -0400
40650@@ -123,7 +123,7 @@ static int domU_read_console(uint32_t vt
40651 return recv;
40652 }
40653
40654-static struct hv_ops domU_hvc_ops = {
40655+static const struct hv_ops domU_hvc_ops = {
40656 .get_chars = domU_read_console,
40657 .put_chars = domU_write_console,
40658 .notifier_add = notifier_add_irq,
40659@@ -149,7 +149,7 @@ static int dom0_write_console(uint32_t v
40660 return len;
40661 }
40662
40663-static struct hv_ops dom0_hvc_ops = {
40664+static const struct hv_ops dom0_hvc_ops = {
40665 .get_chars = dom0_read_console,
40666 .put_chars = dom0_write_console,
40667 .notifier_add = notifier_add_irq,
40668@@ -160,7 +160,7 @@ static struct hv_ops dom0_hvc_ops = {
40669 static int __init xen_hvc_init(void)
40670 {
40671 struct hvc_struct *hp;
40672- struct hv_ops *ops;
40673+ const struct hv_ops *ops;
40674
40675 if (!xen_pv_domain())
40676 return -ENODEV;
40677@@ -205,7 +205,7 @@ static void __exit xen_hvc_fini(void)
40678
40679 static int xen_cons_init(void)
40680 {
40681- struct hv_ops *ops;
40682+ const struct hv_ops *ops;
40683
40684 if (!xen_pv_domain())
40685 return 0;
40686diff -urNp linux-2.6.39/drivers/tty/ipwireless/tty.c linux-2.6.39/drivers/tty/ipwireless/tty.c
40687--- linux-2.6.39/drivers/tty/ipwireless/tty.c 2011-05-19 00:06:34.000000000 -0400
40688+++ linux-2.6.39/drivers/tty/ipwireless/tty.c 2011-05-22 19:36:32.000000000 -0400
40689@@ -29,6 +29,7 @@
40690 #include <linux/tty_driver.h>
40691 #include <linux/tty_flip.h>
40692 #include <linux/uaccess.h>
40693+#include <asm/local.h>
40694
40695 #include "tty.h"
40696 #include "network.h"
40697@@ -51,7 +52,7 @@ struct ipw_tty {
40698 int tty_type;
40699 struct ipw_network *network;
40700 struct tty_struct *linux_tty;
40701- int open_count;
40702+ local_t open_count;
40703 unsigned int control_lines;
40704 struct mutex ipw_tty_mutex;
40705 int tx_bytes_queued;
40706@@ -127,10 +128,10 @@ static int ipw_open(struct tty_struct *l
40707 mutex_unlock(&tty->ipw_tty_mutex);
40708 return -ENODEV;
40709 }
40710- if (tty->open_count == 0)
40711+ if (local_read(&tty->open_count) == 0)
40712 tty->tx_bytes_queued = 0;
40713
40714- tty->open_count++;
40715+ local_inc(&tty->open_count);
40716
40717 tty->linux_tty = linux_tty;
40718 linux_tty->driver_data = tty;
40719@@ -146,9 +147,7 @@ static int ipw_open(struct tty_struct *l
40720
40721 static void do_ipw_close(struct ipw_tty *tty)
40722 {
40723- tty->open_count--;
40724-
40725- if (tty->open_count == 0) {
40726+ if (local_dec_return(&tty->open_count) == 0) {
40727 struct tty_struct *linux_tty = tty->linux_tty;
40728
40729 if (linux_tty != NULL) {
40730@@ -169,7 +168,7 @@ static void ipw_hangup(struct tty_struct
40731 return;
40732
40733 mutex_lock(&tty->ipw_tty_mutex);
40734- if (tty->open_count == 0) {
40735+ if (local_read(&tty->open_count) == 0) {
40736 mutex_unlock(&tty->ipw_tty_mutex);
40737 return;
40738 }
40739@@ -198,7 +197,7 @@ void ipwireless_tty_received(struct ipw_
40740 return;
40741 }
40742
40743- if (!tty->open_count) {
40744+ if (!local_read(&tty->open_count)) {
40745 mutex_unlock(&tty->ipw_tty_mutex);
40746 return;
40747 }
40748@@ -240,7 +239,7 @@ static int ipw_write(struct tty_struct *
40749 return -ENODEV;
40750
40751 mutex_lock(&tty->ipw_tty_mutex);
40752- if (!tty->open_count) {
40753+ if (!local_read(&tty->open_count)) {
40754 mutex_unlock(&tty->ipw_tty_mutex);
40755 return -EINVAL;
40756 }
40757@@ -280,7 +279,7 @@ static int ipw_write_room(struct tty_str
40758 if (!tty)
40759 return -ENODEV;
40760
40761- if (!tty->open_count)
40762+ if (!local_read(&tty->open_count))
40763 return -EINVAL;
40764
40765 room = IPWIRELESS_TX_QUEUE_SIZE - tty->tx_bytes_queued;
40766@@ -322,7 +321,7 @@ static int ipw_chars_in_buffer(struct tt
40767 if (!tty)
40768 return 0;
40769
40770- if (!tty->open_count)
40771+ if (!local_read(&tty->open_count))
40772 return 0;
40773
40774 return tty->tx_bytes_queued;
40775@@ -403,7 +402,7 @@ static int ipw_tiocmget(struct tty_struc
40776 if (!tty)
40777 return -ENODEV;
40778
40779- if (!tty->open_count)
40780+ if (!local_read(&tty->open_count))
40781 return -EINVAL;
40782
40783 return get_control_lines(tty);
40784@@ -419,7 +418,7 @@ ipw_tiocmset(struct tty_struct *linux_tt
40785 if (!tty)
40786 return -ENODEV;
40787
40788- if (!tty->open_count)
40789+ if (!local_read(&tty->open_count))
40790 return -EINVAL;
40791
40792 return set_control_lines(tty, set, clear);
40793@@ -433,7 +432,7 @@ static int ipw_ioctl(struct tty_struct *
40794 if (!tty)
40795 return -ENODEV;
40796
40797- if (!tty->open_count)
40798+ if (!local_read(&tty->open_count))
40799 return -EINVAL;
40800
40801 /* FIXME: Exactly how is the tty object locked here .. */
40802@@ -582,7 +581,7 @@ void ipwireless_tty_free(struct ipw_tty
40803 against a parallel ioctl etc */
40804 mutex_lock(&ttyj->ipw_tty_mutex);
40805 }
40806- while (ttyj->open_count)
40807+ while (local_read(&ttyj->open_count))
40808 do_ipw_close(ttyj);
40809 ipwireless_disassociate_network_ttys(network,
40810 ttyj->channel_idx);
40811diff -urNp linux-2.6.39/drivers/tty/mxser.c linux-2.6.39/drivers/tty/mxser.c
40812--- linux-2.6.39/drivers/tty/mxser.c 2011-05-19 00:06:34.000000000 -0400
40813+++ linux-2.6.39/drivers/tty/mxser.c 2011-05-22 19:36:32.000000000 -0400
40814@@ -2340,7 +2340,7 @@ static const struct tty_operations mxser
40815 .get_icount = mxser_get_icount,
40816 };
40817
40818-struct tty_port_operations mxser_port_ops = {
40819+const struct tty_port_operations mxser_port_ops = {
40820 .carrier_raised = mxser_carrier_raised,
40821 .dtr_rts = mxser_dtr_rts,
40822 .activate = mxser_activate,
40823diff -urNp linux-2.6.39/drivers/tty/n_gsm.c linux-2.6.39/drivers/tty/n_gsm.c
40824--- linux-2.6.39/drivers/tty/n_gsm.c 2011-05-19 00:06:34.000000000 -0400
40825+++ linux-2.6.39/drivers/tty/n_gsm.c 2011-05-22 19:36:32.000000000 -0400
40826@@ -1588,7 +1588,7 @@ static struct gsm_dlci *gsm_dlci_alloc(s
40827 return NULL;
40828 spin_lock_init(&dlci->lock);
40829 dlci->fifo = &dlci->_fifo;
40830- if (kfifo_alloc(&dlci->_fifo, 4096, GFP_KERNEL) < 0) {
40831+ if (kfifo_alloc(&dlci->_fifo, 4096, GFP_KERNEL)) {
40832 kfree(dlci);
40833 return NULL;
40834 }
40835diff -urNp linux-2.6.39/drivers/tty/n_tty.c linux-2.6.39/drivers/tty/n_tty.c
40836--- linux-2.6.39/drivers/tty/n_tty.c 2011-05-19 00:06:34.000000000 -0400
40837+++ linux-2.6.39/drivers/tty/n_tty.c 2011-05-22 19:36:32.000000000 -0400
40838@@ -2122,6 +2122,7 @@ void n_tty_inherit_ops(struct tty_ldisc_
40839 {
40840 *ops = tty_ldisc_N_TTY;
40841 ops->owner = NULL;
40842- ops->refcount = ops->flags = 0;
40843+ atomic_set(&ops->refcount, 0);
40844+ ops->flags = 0;
40845 }
40846 EXPORT_SYMBOL_GPL(n_tty_inherit_ops);
40847diff -urNp linux-2.6.39/drivers/tty/pty.c linux-2.6.39/drivers/tty/pty.c
40848--- linux-2.6.39/drivers/tty/pty.c 2011-05-19 00:06:34.000000000 -0400
40849+++ linux-2.6.39/drivers/tty/pty.c 2011-05-22 19:36:32.000000000 -0400
40850@@ -699,7 +699,18 @@ out:
40851 return retval;
40852 }
40853
40854-static struct file_operations ptmx_fops;
40855+static const struct file_operations ptmx_fops = {
40856+ .llseek = no_llseek,
40857+ .read = tty_read,
40858+ .write = tty_write,
40859+ .poll = tty_poll,
40860+ .unlocked_ioctl = tty_ioctl,
40861+ .compat_ioctl = tty_compat_ioctl,
40862+ .open = ptmx_open,
40863+ .release = tty_release,
40864+ .fasync = tty_fasync,
40865+};
40866+
40867
40868 static void __init unix98_pty_init(void)
40869 {
40870@@ -752,10 +763,6 @@ static void __init unix98_pty_init(void)
40871
40872 register_sysctl_table(pty_root_table);
40873
40874- /* Now create the /dev/ptmx special device */
40875- tty_default_fops(&ptmx_fops);
40876- ptmx_fops.open = ptmx_open;
40877-
40878 cdev_init(&ptmx_cdev, &ptmx_fops);
40879 if (cdev_add(&ptmx_cdev, MKDEV(TTYAUX_MAJOR, 2), 1) ||
40880 register_chrdev_region(MKDEV(TTYAUX_MAJOR, 2), 1, "/dev/ptmx") < 0)
40881diff -urNp linux-2.6.39/drivers/tty/rocket.c linux-2.6.39/drivers/tty/rocket.c
40882--- linux-2.6.39/drivers/tty/rocket.c 2011-05-19 00:06:34.000000000 -0400
40883+++ linux-2.6.39/drivers/tty/rocket.c 2011-05-22 19:36:32.000000000 -0400
40884@@ -1277,6 +1277,8 @@ static int get_ports(struct r_port *info
40885 struct rocket_ports tmp;
40886 int board;
40887
40888+ pax_track_stack();
40889+
40890 if (!retports)
40891 return -EFAULT;
40892 memset(&tmp, 0, sizeof (tmp));
40893diff -urNp linux-2.6.39/drivers/tty/serial/21285.c linux-2.6.39/drivers/tty/serial/21285.c
40894--- linux-2.6.39/drivers/tty/serial/21285.c 2011-05-19 00:06:34.000000000 -0400
40895+++ linux-2.6.39/drivers/tty/serial/21285.c 2011-05-22 19:36:32.000000000 -0400
40896@@ -340,7 +340,7 @@ static int serial21285_verify_port(struc
40897 return ret;
40898 }
40899
40900-static struct uart_ops serial21285_ops = {
40901+static const struct uart_ops serial21285_ops = {
40902 .tx_empty = serial21285_tx_empty,
40903 .get_mctrl = serial21285_get_mctrl,
40904 .set_mctrl = serial21285_set_mctrl,
40905diff -urNp linux-2.6.39/drivers/tty/serial/8250.c linux-2.6.39/drivers/tty/serial/8250.c
40906--- linux-2.6.39/drivers/tty/serial/8250.c 2011-05-19 00:06:34.000000000 -0400
40907+++ linux-2.6.39/drivers/tty/serial/8250.c 2011-05-22 19:36:32.000000000 -0400
40908@@ -2708,7 +2708,7 @@ serial8250_type(struct uart_port *port)
40909 return uart_config[type].name;
40910 }
40911
40912-static struct uart_ops serial8250_pops = {
40913+static const struct uart_ops serial8250_pops = {
40914 .tx_empty = serial8250_tx_empty,
40915 .set_mctrl = serial8250_set_mctrl,
40916 .get_mctrl = serial8250_get_mctrl,
40917diff -urNp linux-2.6.39/drivers/tty/serial/altera_jtaguart.c linux-2.6.39/drivers/tty/serial/altera_jtaguart.c
40918--- linux-2.6.39/drivers/tty/serial/altera_jtaguart.c 2011-05-19 00:06:34.000000000 -0400
40919+++ linux-2.6.39/drivers/tty/serial/altera_jtaguart.c 2011-05-22 19:36:32.000000000 -0400
40920@@ -281,7 +281,7 @@ static int altera_jtaguart_verify_port(s
40921 /*
40922 * Define the basic serial functions we support.
40923 */
40924-static struct uart_ops altera_jtaguart_ops = {
40925+static const struct uart_ops altera_jtaguart_ops = {
40926 .tx_empty = altera_jtaguart_tx_empty,
40927 .get_mctrl = altera_jtaguart_get_mctrl,
40928 .set_mctrl = altera_jtaguart_set_mctrl,
40929diff -urNp linux-2.6.39/drivers/tty/serial/altera_uart.c linux-2.6.39/drivers/tty/serial/altera_uart.c
40930--- linux-2.6.39/drivers/tty/serial/altera_uart.c 2011-05-19 00:06:34.000000000 -0400
40931+++ linux-2.6.39/drivers/tty/serial/altera_uart.c 2011-05-22 19:36:32.000000000 -0400
40932@@ -380,7 +380,7 @@ static int altera_uart_verify_port(struc
40933 /*
40934 * Define the basic serial functions we support.
40935 */
40936-static struct uart_ops altera_uart_ops = {
40937+static const struct uart_ops altera_uart_ops = {
40938 .tx_empty = altera_uart_tx_empty,
40939 .get_mctrl = altera_uart_get_mctrl,
40940 .set_mctrl = altera_uart_set_mctrl,
40941diff -urNp linux-2.6.39/drivers/tty/serial/amba-pl010.c linux-2.6.39/drivers/tty/serial/amba-pl010.c
40942--- linux-2.6.39/drivers/tty/serial/amba-pl010.c 2011-05-19 00:06:34.000000000 -0400
40943+++ linux-2.6.39/drivers/tty/serial/amba-pl010.c 2011-05-22 19:36:32.000000000 -0400
40944@@ -529,7 +529,7 @@ static int pl010_verify_port(struct uart
40945 return ret;
40946 }
40947
40948-static struct uart_ops amba_pl010_pops = {
40949+static const struct uart_ops amba_pl010_pops = {
40950 .tx_empty = pl010_tx_empty,
40951 .set_mctrl = pl010_set_mctrl,
40952 .get_mctrl = pl010_get_mctrl,
40953diff -urNp linux-2.6.39/drivers/tty/serial/amba-pl011.c linux-2.6.39/drivers/tty/serial/amba-pl011.c
40954--- linux-2.6.39/drivers/tty/serial/amba-pl011.c 2011-05-19 00:06:34.000000000 -0400
40955+++ linux-2.6.39/drivers/tty/serial/amba-pl011.c 2011-05-22 19:36:32.000000000 -0400
40956@@ -1581,7 +1581,7 @@ static int pl010_verify_port(struct uart
40957 return ret;
40958 }
40959
40960-static struct uart_ops amba_pl011_pops = {
40961+static const struct uart_ops amba_pl011_pops = {
40962 .tx_empty = pl01x_tx_empty,
40963 .set_mctrl = pl011_set_mctrl,
40964 .get_mctrl = pl01x_get_mctrl,
40965diff -urNp linux-2.6.39/drivers/tty/serial/apbuart.c linux-2.6.39/drivers/tty/serial/apbuart.c
40966--- linux-2.6.39/drivers/tty/serial/apbuart.c 2011-05-19 00:06:34.000000000 -0400
40967+++ linux-2.6.39/drivers/tty/serial/apbuart.c 2011-05-22 19:36:32.000000000 -0400
40968@@ -328,7 +328,7 @@ static int apbuart_verify_port(struct ua
40969 return ret;
40970 }
40971
40972-static struct uart_ops grlib_apbuart_ops = {
40973+static const struct uart_ops grlib_apbuart_ops = {
40974 .tx_empty = apbuart_tx_empty,
40975 .set_mctrl = apbuart_set_mctrl,
40976 .get_mctrl = apbuart_get_mctrl,
40977diff -urNp linux-2.6.39/drivers/tty/serial/atmel_serial.c linux-2.6.39/drivers/tty/serial/atmel_serial.c
40978--- linux-2.6.39/drivers/tty/serial/atmel_serial.c 2011-05-19 00:06:34.000000000 -0400
40979+++ linux-2.6.39/drivers/tty/serial/atmel_serial.c 2011-05-22 19:36:32.000000000 -0400
40980@@ -1382,7 +1382,7 @@ atmel_ioctl(struct uart_port *port, unsi
40981
40982
40983
40984-static struct uart_ops atmel_pops = {
40985+static const struct uart_ops atmel_pops = {
40986 .tx_empty = atmel_tx_empty,
40987 .set_mctrl = atmel_set_mctrl,
40988 .get_mctrl = atmel_get_mctrl,
40989diff -urNp linux-2.6.39/drivers/tty/serial/bcm63xx_uart.c linux-2.6.39/drivers/tty/serial/bcm63xx_uart.c
40990--- linux-2.6.39/drivers/tty/serial/bcm63xx_uart.c 2011-05-19 00:06:34.000000000 -0400
40991+++ linux-2.6.39/drivers/tty/serial/bcm63xx_uart.c 2011-05-22 19:36:32.000000000 -0400
40992@@ -636,7 +636,7 @@ static int bcm_uart_verify_port(struct u
40993 }
40994
40995 /* serial core callbacks */
40996-static struct uart_ops bcm_uart_ops = {
40997+static const struct uart_ops bcm_uart_ops = {
40998 .tx_empty = bcm_uart_tx_empty,
40999 .get_mctrl = bcm_uart_get_mctrl,
41000 .set_mctrl = bcm_uart_set_mctrl,
41001diff -urNp linux-2.6.39/drivers/tty/serial/bfin_5xx.c linux-2.6.39/drivers/tty/serial/bfin_5xx.c
41002--- linux-2.6.39/drivers/tty/serial/bfin_5xx.c 2011-05-19 00:06:34.000000000 -0400
41003+++ linux-2.6.39/drivers/tty/serial/bfin_5xx.c 2011-05-22 19:36:32.000000000 -0400
41004@@ -1036,7 +1036,7 @@ static int bfin_kgdboc_port_startup(stru
41005 }
41006 #endif
41007
41008-static struct uart_ops bfin_serial_pops = {
41009+static const struct uart_ops bfin_serial_pops = {
41010 .tx_empty = bfin_serial_tx_empty,
41011 .set_mctrl = bfin_serial_set_mctrl,
41012 .get_mctrl = bfin_serial_get_mctrl,
41013diff -urNp linux-2.6.39/drivers/tty/serial/bfin_sport_uart.c linux-2.6.39/drivers/tty/serial/bfin_sport_uart.c
41014--- linux-2.6.39/drivers/tty/serial/bfin_sport_uart.c 2011-05-19 00:06:34.000000000 -0400
41015+++ linux-2.6.39/drivers/tty/serial/bfin_sport_uart.c 2011-05-22 19:36:32.000000000 -0400
41016@@ -571,7 +571,7 @@ static void sport_set_termios(struct uar
41017 spin_unlock_irqrestore(&up->port.lock, flags);
41018 }
41019
41020-struct uart_ops sport_uart_ops = {
41021+const struct uart_ops sport_uart_ops = {
41022 .tx_empty = sport_tx_empty,
41023 .set_mctrl = sport_set_mctrl,
41024 .get_mctrl = sport_get_mctrl,
41025diff -urNp linux-2.6.39/drivers/tty/serial/clps711x.c linux-2.6.39/drivers/tty/serial/clps711x.c
41026--- linux-2.6.39/drivers/tty/serial/clps711x.c 2011-05-19 00:06:34.000000000 -0400
41027+++ linux-2.6.39/drivers/tty/serial/clps711x.c 2011-05-22 19:36:32.000000000 -0400
41028@@ -380,7 +380,7 @@ static int clps711xuart_request_port(str
41029 return 0;
41030 }
41031
41032-static struct uart_ops clps711x_pops = {
41033+static const struct uart_ops clps711x_pops = {
41034 .tx_empty = clps711xuart_tx_empty,
41035 .set_mctrl = clps711xuart_set_mctrl_null,
41036 .get_mctrl = clps711xuart_get_mctrl,
41037diff -urNp linux-2.6.39/drivers/tty/serial/cpm_uart/cpm_uart_core.c linux-2.6.39/drivers/tty/serial/cpm_uart/cpm_uart_core.c
41038--- linux-2.6.39/drivers/tty/serial/cpm_uart/cpm_uart_core.c 2011-05-19 00:06:34.000000000 -0400
41039+++ linux-2.6.39/drivers/tty/serial/cpm_uart/cpm_uart_core.c 2011-05-22 19:36:32.000000000 -0400
41040@@ -1099,7 +1099,7 @@ static void cpm_put_poll_char(struct uar
41041 }
41042 #endif /* CONFIG_CONSOLE_POLL */
41043
41044-static struct uart_ops cpm_uart_pops = {
41045+static const struct uart_ops cpm_uart_pops = {
41046 .tx_empty = cpm_uart_tx_empty,
41047 .set_mctrl = cpm_uart_set_mctrl,
41048 .get_mctrl = cpm_uart_get_mctrl,
41049diff -urNp linux-2.6.39/drivers/tty/serial/dz.c linux-2.6.39/drivers/tty/serial/dz.c
41050--- linux-2.6.39/drivers/tty/serial/dz.c 2011-05-19 00:06:34.000000000 -0400
41051+++ linux-2.6.39/drivers/tty/serial/dz.c 2011-05-22 19:36:32.000000000 -0400
41052@@ -746,7 +746,7 @@ static int dz_verify_port(struct uart_po
41053 return ret;
41054 }
41055
41056-static struct uart_ops dz_ops = {
41057+static const struct uart_ops dz_ops = {
41058 .tx_empty = dz_tx_empty,
41059 .get_mctrl = dz_get_mctrl,
41060 .set_mctrl = dz_set_mctrl,
41061diff -urNp linux-2.6.39/drivers/tty/serial/imx.c linux-2.6.39/drivers/tty/serial/imx.c
41062--- linux-2.6.39/drivers/tty/serial/imx.c 2011-05-19 00:06:34.000000000 -0400
41063+++ linux-2.6.39/drivers/tty/serial/imx.c 2011-05-22 19:36:32.000000000 -0400
41064@@ -1018,7 +1018,7 @@ imx_verify_port(struct uart_port *port,
41065 return ret;
41066 }
41067
41068-static struct uart_ops imx_pops = {
41069+static const struct uart_ops imx_pops = {
41070 .tx_empty = imx_tx_empty,
41071 .set_mctrl = imx_set_mctrl,
41072 .get_mctrl = imx_get_mctrl,
41073diff -urNp linux-2.6.39/drivers/tty/serial/ioc3_serial.c linux-2.6.39/drivers/tty/serial/ioc3_serial.c
41074--- linux-2.6.39/drivers/tty/serial/ioc3_serial.c 2011-05-19 00:06:34.000000000 -0400
41075+++ linux-2.6.39/drivers/tty/serial/ioc3_serial.c 2011-05-22 19:36:32.000000000 -0400
41076@@ -1874,7 +1874,7 @@ static int ic3_request_port(struct uart_
41077 }
41078
41079 /* Associate the uart functions above - given to serial core */
41080-static struct uart_ops ioc3_ops = {
41081+static const struct uart_ops ioc3_ops = {
41082 .tx_empty = ic3_tx_empty,
41083 .set_mctrl = ic3_set_mctrl,
41084 .get_mctrl = ic3_get_mctrl,
41085diff -urNp linux-2.6.39/drivers/tty/serial/ioc4_serial.c linux-2.6.39/drivers/tty/serial/ioc4_serial.c
41086--- linux-2.6.39/drivers/tty/serial/ioc4_serial.c 2011-05-19 00:06:34.000000000 -0400
41087+++ linux-2.6.39/drivers/tty/serial/ioc4_serial.c 2011-05-22 19:36:32.000000000 -0400
41088@@ -2593,7 +2593,7 @@ static int ic4_request_port(struct uart_
41089
41090 /* Associate the uart functions above - given to serial core */
41091
41092-static struct uart_ops ioc4_ops = {
41093+static const struct uart_ops ioc4_ops = {
41094 .tx_empty = ic4_tx_empty,
41095 .set_mctrl = ic4_set_mctrl,
41096 .get_mctrl = ic4_get_mctrl,
41097diff -urNp linux-2.6.39/drivers/tty/serial/ip22zilog.c linux-2.6.39/drivers/tty/serial/ip22zilog.c
41098--- linux-2.6.39/drivers/tty/serial/ip22zilog.c 2011-05-19 00:06:34.000000000 -0400
41099+++ linux-2.6.39/drivers/tty/serial/ip22zilog.c 2011-05-22 19:36:32.000000000 -0400
41100@@ -928,7 +928,7 @@ static int ip22zilog_verify_port(struct
41101 return -EINVAL;
41102 }
41103
41104-static struct uart_ops ip22zilog_pops = {
41105+static const struct uart_ops ip22zilog_pops = {
41106 .tx_empty = ip22zilog_tx_empty,
41107 .set_mctrl = ip22zilog_set_mctrl,
41108 .get_mctrl = ip22zilog_get_mctrl,
41109diff -urNp linux-2.6.39/drivers/tty/serial/kgdboc.c linux-2.6.39/drivers/tty/serial/kgdboc.c
41110--- linux-2.6.39/drivers/tty/serial/kgdboc.c 2011-05-19 00:06:34.000000000 -0400
41111+++ linux-2.6.39/drivers/tty/serial/kgdboc.c 2011-05-22 19:36:32.000000000 -0400
41112@@ -22,7 +22,7 @@
41113
41114 #define MAX_CONFIG_LEN 40
41115
41116-static struct kgdb_io kgdboc_io_ops;
41117+static struct kgdb_io kgdboc_io_ops; /* cannot be const, see configure_kgdboc() */
41118
41119 /* -1 = init not run yet, 0 = unconfigured, 1 = configured. */
41120 static int configured = -1;
41121@@ -293,7 +293,7 @@ static void kgdboc_post_exp_handler(void
41122 kgdboc_restore_input();
41123 }
41124
41125-static struct kgdb_io kgdboc_io_ops = {
41126+static struct kgdb_io kgdboc_io_ops = { /* cannot be const, see configure_kgdboc() */
41127 .name = "kgdboc",
41128 .read_char = kgdboc_get_char,
41129 .write_char = kgdboc_put_char,
41130diff -urNp linux-2.6.39/drivers/tty/serial/m32r_sio.c linux-2.6.39/drivers/tty/serial/m32r_sio.c
41131--- linux-2.6.39/drivers/tty/serial/m32r_sio.c 2011-05-19 00:06:34.000000000 -0400
41132+++ linux-2.6.39/drivers/tty/serial/m32r_sio.c 2011-05-22 19:36:32.000000000 -0400
41133@@ -939,7 +939,7 @@ m32r_sio_type(struct uart_port *port)
41134 return uart_config[type].name;
41135 }
41136
41137-static struct uart_ops m32r_sio_pops = {
41138+static const struct uart_ops m32r_sio_pops = {
41139 .tx_empty = m32r_sio_tx_empty,
41140 .set_mctrl = m32r_sio_set_mctrl,
41141 .get_mctrl = m32r_sio_get_mctrl,
41142diff -urNp linux-2.6.39/drivers/tty/serial/max3100.c linux-2.6.39/drivers/tty/serial/max3100.c
41143--- linux-2.6.39/drivers/tty/serial/max3100.c 2011-05-19 00:06:34.000000000 -0400
41144+++ linux-2.6.39/drivers/tty/serial/max3100.c 2011-05-22 19:36:32.000000000 -0400
41145@@ -710,7 +710,7 @@ static void max3100_break_ctl(struct uar
41146 dev_dbg(&s->spi->dev, "%s\n", __func__);
41147 }
41148
41149-static struct uart_ops max3100_ops = {
41150+static const struct uart_ops max3100_ops = {
41151 .tx_empty = max3100_tx_empty,
41152 .set_mctrl = max3100_set_mctrl,
41153 .get_mctrl = max3100_get_mctrl,
41154diff -urNp linux-2.6.39/drivers/tty/serial/max3107.c linux-2.6.39/drivers/tty/serial/max3107.c
41155--- linux-2.6.39/drivers/tty/serial/max3107.c 2011-05-19 00:06:34.000000000 -0400
41156+++ linux-2.6.39/drivers/tty/serial/max3107.c 2011-05-22 19:36:32.000000000 -0400
41157@@ -910,7 +910,7 @@ static void max3107_break_ctl(struct uar
41158
41159
41160 /* Port functions */
41161-static struct uart_ops max3107_ops = {
41162+static const struct uart_ops max3107_ops = {
41163 .tx_empty = max3107_tx_empty,
41164 .set_mctrl = max3107_set_mctrl,
41165 .get_mctrl = max3107_get_mctrl,
41166diff -urNp linux-2.6.39/drivers/tty/serial/mfd.c linux-2.6.39/drivers/tty/serial/mfd.c
41167--- linux-2.6.39/drivers/tty/serial/mfd.c 2011-05-19 00:06:34.000000000 -0400
41168+++ linux-2.6.39/drivers/tty/serial/mfd.c 2011-05-22 19:36:32.000000000 -0400
41169@@ -1178,7 +1178,7 @@ static struct console serial_hsu_console
41170 };
41171 #endif
41172
41173-struct uart_ops serial_hsu_pops = {
41174+const struct uart_ops serial_hsu_pops = {
41175 .tx_empty = serial_hsu_tx_empty,
41176 .set_mctrl = serial_hsu_set_mctrl,
41177 .get_mctrl = serial_hsu_get_mctrl,
41178diff -urNp linux-2.6.39/drivers/tty/serial/mpc52xx_uart.c linux-2.6.39/drivers/tty/serial/mpc52xx_uart.c
41179--- linux-2.6.39/drivers/tty/serial/mpc52xx_uart.c 2011-05-19 00:06:34.000000000 -0400
41180+++ linux-2.6.39/drivers/tty/serial/mpc52xx_uart.c 2011-05-22 19:36:32.000000000 -0400
41181@@ -283,7 +283,7 @@ static irqreturn_t mpc52xx_psc_handle_ir
41182 return mpc5xxx_uart_process_int(port);
41183 }
41184
41185-static struct psc_ops mpc52xx_psc_ops = {
41186+static const struct psc_ops mpc52xx_psc_ops = {
41187 .fifo_init = mpc52xx_psc_fifo_init,
41188 .raw_rx_rdy = mpc52xx_psc_raw_rx_rdy,
41189 .raw_tx_rdy = mpc52xx_psc_raw_tx_rdy,
41190@@ -304,7 +304,7 @@ static struct psc_ops mpc52xx_psc_ops =
41191 .handle_irq = mpc52xx_psc_handle_irq,
41192 };
41193
41194-static struct psc_ops mpc5200b_psc_ops = {
41195+static const struct psc_ops mpc5200b_psc_ops = {
41196 .fifo_init = mpc52xx_psc_fifo_init,
41197 .raw_rx_rdy = mpc52xx_psc_raw_rx_rdy,
41198 .raw_tx_rdy = mpc52xx_psc_raw_tx_rdy,
41199@@ -571,7 +571,7 @@ static void mpc512x_psc_get_irq(struct u
41200 port->irq = psc_fifoc_irq;
41201 }
41202
41203-static struct psc_ops mpc512x_psc_ops = {
41204+static const struct psc_ops mpc512x_psc_ops = {
41205 .fifo_init = mpc512x_psc_fifo_init,
41206 .raw_rx_rdy = mpc512x_psc_raw_rx_rdy,
41207 .raw_tx_rdy = mpc512x_psc_raw_tx_rdy,
41208@@ -596,7 +596,7 @@ static struct psc_ops mpc512x_psc_ops =
41209 };
41210 #endif
41211
41212-static struct psc_ops *psc_ops;
41213+static const struct psc_ops *psc_ops;
41214
41215 /* ======================================================================== */
41216 /* UART operations */
41217@@ -905,7 +905,7 @@ mpc52xx_uart_verify_port(struct uart_por
41218 }
41219
41220
41221-static struct uart_ops mpc52xx_uart_ops = {
41222+static const struct uart_ops mpc52xx_uart_ops = {
41223 .tx_empty = mpc52xx_uart_tx_empty,
41224 .set_mctrl = mpc52xx_uart_set_mctrl,
41225 .get_mctrl = mpc52xx_uart_get_mctrl,
41226diff -urNp linux-2.6.39/drivers/tty/serial/mpsc.c linux-2.6.39/drivers/tty/serial/mpsc.c
41227--- linux-2.6.39/drivers/tty/serial/mpsc.c 2011-05-19 00:06:34.000000000 -0400
41228+++ linux-2.6.39/drivers/tty/serial/mpsc.c 2011-05-22 19:36:32.000000000 -0400
41229@@ -1663,7 +1663,7 @@ static void mpsc_put_poll_char(struct ua
41230 }
41231 #endif
41232
41233-static struct uart_ops mpsc_pops = {
41234+static const struct uart_ops mpsc_pops = {
41235 .tx_empty = mpsc_tx_empty,
41236 .set_mctrl = mpsc_set_mctrl,
41237 .get_mctrl = mpsc_get_mctrl,
41238diff -urNp linux-2.6.39/drivers/tty/serial/mrst_max3110.c linux-2.6.39/drivers/tty/serial/mrst_max3110.c
41239--- linux-2.6.39/drivers/tty/serial/mrst_max3110.c 2011-05-19 00:06:34.000000000 -0400
41240+++ linux-2.6.39/drivers/tty/serial/mrst_max3110.c 2011-05-22 19:36:32.000000000 -0400
41241@@ -393,6 +393,8 @@ static void max3110_con_receive(struct u
41242 int loop = 1, num, total = 0;
41243 u8 recv_buf[512], *pbuf;
41244
41245+ pax_track_stack();
41246+
41247 pbuf = recv_buf;
41248 do {
41249 num = max3110_read_multi(max, pbuf);
41250@@ -726,7 +728,7 @@ static void serial_m3110_enable_ms(struc
41251 {
41252 }
41253
41254-struct uart_ops serial_m3110_ops = {
41255+const struct uart_ops serial_m3110_ops = {
41256 .tx_empty = serial_m3110_tx_empty,
41257 .set_mctrl = serial_m3110_set_mctrl,
41258 .get_mctrl = serial_m3110_get_mctrl,
41259diff -urNp linux-2.6.39/drivers/tty/serial/msm_serial.c linux-2.6.39/drivers/tty/serial/msm_serial.c
41260--- linux-2.6.39/drivers/tty/serial/msm_serial.c 2011-05-19 00:06:34.000000000 -0400
41261+++ linux-2.6.39/drivers/tty/serial/msm_serial.c 2011-05-22 19:36:32.000000000 -0400
41262@@ -702,7 +702,7 @@ static void msm_power(struct uart_port *
41263 }
41264 }
41265
41266-static struct uart_ops msm_uart_pops = {
41267+static const struct uart_ops msm_uart_pops = {
41268 .tx_empty = msm_tx_empty,
41269 .set_mctrl = msm_set_mctrl,
41270 .get_mctrl = msm_get_mctrl,
41271diff -urNp linux-2.6.39/drivers/tty/serial/msm_serial_hs.c linux-2.6.39/drivers/tty/serial/msm_serial_hs.c
41272--- linux-2.6.39/drivers/tty/serial/msm_serial_hs.c 2011-05-19 00:06:34.000000000 -0400
41273+++ linux-2.6.39/drivers/tty/serial/msm_serial_hs.c 2011-05-22 19:36:32.000000000 -0400
41274@@ -360,7 +360,7 @@ struct msm_hs_port {
41275 static struct msm_hs_port q_uart_port[UARTDM_NR];
41276 static struct platform_driver msm_serial_hs_platform_driver;
41277 static struct uart_driver msm_hs_driver;
41278-static struct uart_ops msm_hs_ops;
41279+static const struct uart_ops msm_hs_ops;
41280 static struct workqueue_struct *msm_hs_workqueue;
41281
41282 #define UARTDM_TO_MSM(uart_port) \
41283@@ -1856,7 +1856,7 @@ static struct uart_driver msm_hs_driver
41284 .cons = 0,
41285 };
41286
41287-static struct uart_ops msm_hs_ops = {
41288+static const struct uart_ops msm_hs_ops = {
41289 .tx_empty = msm_hs_tx_empty,
41290 .set_mctrl = msm_hs_set_mctrl_locked,
41291 .get_mctrl = msm_hs_get_mctrl_locked,
41292diff -urNp linux-2.6.39/drivers/tty/serial/mux.c linux-2.6.39/drivers/tty/serial/mux.c
41293--- linux-2.6.39/drivers/tty/serial/mux.c 2011-05-19 00:06:34.000000000 -0400
41294+++ linux-2.6.39/drivers/tty/serial/mux.c 2011-05-22 19:36:32.000000000 -0400
41295@@ -442,7 +442,7 @@ static struct console mux_console = {
41296 #define MUX_CONSOLE NULL
41297 #endif
41298
41299-static struct uart_ops mux_pops = {
41300+static const struct uart_ops mux_pops = {
41301 .tx_empty = mux_tx_empty,
41302 .set_mctrl = mux_set_mctrl,
41303 .get_mctrl = mux_get_mctrl,
41304diff -urNp linux-2.6.39/drivers/tty/serial/mxs-auart.c linux-2.6.39/drivers/tty/serial/mxs-auart.c
41305--- linux-2.6.39/drivers/tty/serial/mxs-auart.c 2011-05-19 00:06:34.000000000 -0400
41306+++ linux-2.6.39/drivers/tty/serial/mxs-auart.c 2011-05-22 19:36:32.000000000 -0400
41307@@ -499,7 +499,7 @@ static void mxs_auart_enable_ms(struct u
41308 /* just empty */
41309 }
41310
41311-static struct uart_ops mxs_auart_ops = {
41312+static const struct uart_ops mxs_auart_ops = {
41313 .tx_empty = mxs_auart_tx_empty,
41314 .start_tx = mxs_auart_start_tx,
41315 .stop_tx = mxs_auart_stop_tx,
41316diff -urNp linux-2.6.39/drivers/tty/serial/netx-serial.c linux-2.6.39/drivers/tty/serial/netx-serial.c
41317--- linux-2.6.39/drivers/tty/serial/netx-serial.c 2011-05-19 00:06:34.000000000 -0400
41318+++ linux-2.6.39/drivers/tty/serial/netx-serial.c 2011-05-22 19:36:32.000000000 -0400
41319@@ -464,7 +464,7 @@ netx_verify_port(struct uart_port *port,
41320 return ret;
41321 }
41322
41323-static struct uart_ops netx_pops = {
41324+static const struct uart_ops netx_pops = {
41325 .tx_empty = netx_tx_empty,
41326 .set_mctrl = netx_set_mctrl,
41327 .get_mctrl = netx_get_mctrl,
41328diff -urNp linux-2.6.39/drivers/tty/serial/nwpserial.c linux-2.6.39/drivers/tty/serial/nwpserial.c
41329--- linux-2.6.39/drivers/tty/serial/nwpserial.c 2011-05-19 00:06:34.000000000 -0400
41330+++ linux-2.6.39/drivers/tty/serial/nwpserial.c 2011-05-22 19:36:32.000000000 -0400
41331@@ -303,7 +303,7 @@ static unsigned int nwpserial_tx_empty(s
41332 return ret & UART_LSR_TEMT ? TIOCSER_TEMT : 0;
41333 }
41334
41335-static struct uart_ops nwpserial_pops = {
41336+static const struct uart_ops nwpserial_pops = {
41337 .tx_empty = nwpserial_tx_empty,
41338 .set_mctrl = nwpserial_set_mctrl,
41339 .get_mctrl = nwpserial_get_mctrl,
41340diff -urNp linux-2.6.39/drivers/tty/serial/omap-serial.c linux-2.6.39/drivers/tty/serial/omap-serial.c
41341--- linux-2.6.39/drivers/tty/serial/omap-serial.c 2011-05-19 00:06:34.000000000 -0400
41342+++ linux-2.6.39/drivers/tty/serial/omap-serial.c 2011-05-22 19:36:32.000000000 -0400
41343@@ -1029,7 +1029,7 @@ static inline void serial_omap_add_conso
41344
41345 #endif
41346
41347-static struct uart_ops serial_omap_pops = {
41348+static const struct uart_ops serial_omap_pops = {
41349 .tx_empty = serial_omap_tx_empty,
41350 .set_mctrl = serial_omap_set_mctrl,
41351 .get_mctrl = serial_omap_get_mctrl,
41352diff -urNp linux-2.6.39/drivers/tty/serial/pch_uart.c linux-2.6.39/drivers/tty/serial/pch_uart.c
41353--- linux-2.6.39/drivers/tty/serial/pch_uart.c 2011-05-19 00:06:34.000000000 -0400
41354+++ linux-2.6.39/drivers/tty/serial/pch_uart.c 2011-05-22 19:36:32.000000000 -0400
41355@@ -1351,7 +1351,7 @@ static int pch_uart_verify_port(struct u
41356 return 0;
41357 }
41358
41359-static struct uart_ops pch_uart_ops = {
41360+static const struct uart_ops pch_uart_ops = {
41361 .tx_empty = pch_uart_tx_empty,
41362 .set_mctrl = pch_uart_set_mctrl,
41363 .get_mctrl = pch_uart_get_mctrl,
41364diff -urNp linux-2.6.39/drivers/tty/serial/pmac_zilog.c linux-2.6.39/drivers/tty/serial/pmac_zilog.c
41365--- linux-2.6.39/drivers/tty/serial/pmac_zilog.c 2011-05-19 00:06:34.000000000 -0400
41366+++ linux-2.6.39/drivers/tty/serial/pmac_zilog.c 2011-05-22 19:36:32.000000000 -0400
41367@@ -1427,7 +1427,7 @@ static void pmz_poll_put_char(struct uar
41368
41369 #endif /* CONFIG_CONSOLE_POLL */
41370
41371-static struct uart_ops pmz_pops = {
41372+static const struct uart_ops pmz_pops = {
41373 .tx_empty = pmz_tx_empty,
41374 .set_mctrl = pmz_set_mctrl,
41375 .get_mctrl = pmz_get_mctrl,
41376diff -urNp linux-2.6.39/drivers/tty/serial/pnx8xxx_uart.c linux-2.6.39/drivers/tty/serial/pnx8xxx_uart.c
41377--- linux-2.6.39/drivers/tty/serial/pnx8xxx_uart.c 2011-05-19 00:06:34.000000000 -0400
41378+++ linux-2.6.39/drivers/tty/serial/pnx8xxx_uart.c 2011-05-22 19:36:32.000000000 -0400
41379@@ -614,7 +614,7 @@ pnx8xxx_verify_port(struct uart_port *po
41380 return ret;
41381 }
41382
41383-static struct uart_ops pnx8xxx_pops = {
41384+static const struct uart_ops pnx8xxx_pops = {
41385 .tx_empty = pnx8xxx_tx_empty,
41386 .set_mctrl = pnx8xxx_set_mctrl,
41387 .get_mctrl = pnx8xxx_get_mctrl,
41388diff -urNp linux-2.6.39/drivers/tty/serial/pxa.c linux-2.6.39/drivers/tty/serial/pxa.c
41389--- linux-2.6.39/drivers/tty/serial/pxa.c 2011-05-19 00:06:34.000000000 -0400
41390+++ linux-2.6.39/drivers/tty/serial/pxa.c 2011-05-22 19:36:32.000000000 -0400
41391@@ -706,7 +706,7 @@ static struct console serial_pxa_console
41392 #define PXA_CONSOLE NULL
41393 #endif
41394
41395-struct uart_ops serial_pxa_pops = {
41396+const struct uart_ops serial_pxa_pops = {
41397 .tx_empty = serial_pxa_tx_empty,
41398 .set_mctrl = serial_pxa_set_mctrl,
41399 .get_mctrl = serial_pxa_get_mctrl,
41400diff -urNp linux-2.6.39/drivers/tty/serial/sa1100.c linux-2.6.39/drivers/tty/serial/sa1100.c
41401--- linux-2.6.39/drivers/tty/serial/sa1100.c 2011-05-19 00:06:34.000000000 -0400
41402+++ linux-2.6.39/drivers/tty/serial/sa1100.c 2011-05-22 19:36:32.000000000 -0400
41403@@ -577,7 +577,7 @@ sa1100_verify_port(struct uart_port *por
41404 return ret;
41405 }
41406
41407-static struct uart_ops sa1100_pops = {
41408+static const struct uart_ops sa1100_pops = {
41409 .tx_empty = sa1100_tx_empty,
41410 .set_mctrl = sa1100_set_mctrl,
41411 .get_mctrl = sa1100_get_mctrl,
41412diff -urNp linux-2.6.39/drivers/tty/serial/samsung.c linux-2.6.39/drivers/tty/serial/samsung.c
41413--- linux-2.6.39/drivers/tty/serial/samsung.c 2011-05-19 00:06:34.000000000 -0400
41414+++ linux-2.6.39/drivers/tty/serial/samsung.c 2011-05-22 19:36:32.000000000 -0400
41415@@ -860,7 +860,7 @@ static struct console s3c24xx_serial_con
41416 #define S3C24XX_SERIAL_CONSOLE NULL
41417 #endif
41418
41419-static struct uart_ops s3c24xx_serial_ops = {
41420+static const struct uart_ops s3c24xx_serial_ops = {
41421 .pm = s3c24xx_serial_pm,
41422 .tx_empty = s3c24xx_serial_tx_empty,
41423 .get_mctrl = s3c24xx_serial_get_mctrl,
41424diff -urNp linux-2.6.39/drivers/tty/serial/sc26xx.c linux-2.6.39/drivers/tty/serial/sc26xx.c
41425--- linux-2.6.39/drivers/tty/serial/sc26xx.c 2011-05-19 00:06:34.000000000 -0400
41426+++ linux-2.6.39/drivers/tty/serial/sc26xx.c 2011-05-22 19:36:32.000000000 -0400
41427@@ -515,7 +515,7 @@ static int sc26xx_verify_port(struct uar
41428 return -EINVAL;
41429 }
41430
41431-static struct uart_ops sc26xx_ops = {
41432+static const struct uart_ops sc26xx_ops = {
41433 .tx_empty = sc26xx_tx_empty,
41434 .set_mctrl = sc26xx_set_mctrl,
41435 .get_mctrl = sc26xx_get_mctrl,
41436diff -urNp linux-2.6.39/drivers/tty/serial/serial_ks8695.c linux-2.6.39/drivers/tty/serial/serial_ks8695.c
41437--- linux-2.6.39/drivers/tty/serial/serial_ks8695.c 2011-05-19 00:06:34.000000000 -0400
41438+++ linux-2.6.39/drivers/tty/serial/serial_ks8695.c 2011-05-22 19:36:32.000000000 -0400
41439@@ -528,7 +528,7 @@ static int ks8695uart_verify_port(struct
41440 return ret;
41441 }
41442
41443-static struct uart_ops ks8695uart_pops = {
41444+static const struct uart_ops ks8695uart_pops = {
41445 .tx_empty = ks8695uart_tx_empty,
41446 .set_mctrl = ks8695uart_set_mctrl,
41447 .get_mctrl = ks8695uart_get_mctrl,
41448diff -urNp linux-2.6.39/drivers/tty/serial/serial_txx9.c linux-2.6.39/drivers/tty/serial/serial_txx9.c
41449--- linux-2.6.39/drivers/tty/serial/serial_txx9.c 2011-05-19 00:06:34.000000000 -0400
41450+++ linux-2.6.39/drivers/tty/serial/serial_txx9.c 2011-05-22 19:36:32.000000000 -0400
41451@@ -857,7 +857,7 @@ serial_txx9_type(struct uart_port *port)
41452 return "txx9";
41453 }
41454
41455-static struct uart_ops serial_txx9_pops = {
41456+static const struct uart_ops serial_txx9_pops = {
41457 .tx_empty = serial_txx9_tx_empty,
41458 .set_mctrl = serial_txx9_set_mctrl,
41459 .get_mctrl = serial_txx9_get_mctrl,
41460diff -urNp linux-2.6.39/drivers/tty/serial/sn_console.c linux-2.6.39/drivers/tty/serial/sn_console.c
41461--- linux-2.6.39/drivers/tty/serial/sn_console.c 2011-05-19 00:06:34.000000000 -0400
41462+++ linux-2.6.39/drivers/tty/serial/sn_console.c 2011-05-22 19:36:32.000000000 -0400
41463@@ -388,7 +388,7 @@ static void snp_config_port(struct uart_
41464
41465 /* Associate the uart functions above - given to serial core */
41466
41467-static struct uart_ops sn_console_ops = {
41468+static const struct uart_ops sn_console_ops = {
41469 .tx_empty = snp_tx_empty,
41470 .set_mctrl = snp_set_mctrl,
41471 .get_mctrl = snp_get_mctrl,
41472diff -urNp linux-2.6.39/drivers/tty/serial/sunhv.c linux-2.6.39/drivers/tty/serial/sunhv.c
41473--- linux-2.6.39/drivers/tty/serial/sunhv.c 2011-05-19 00:06:34.000000000 -0400
41474+++ linux-2.6.39/drivers/tty/serial/sunhv.c 2011-05-22 19:36:32.000000000 -0400
41475@@ -168,12 +168,12 @@ struct sunhv_ops {
41476 int (*receive_chars)(struct uart_port *port, struct tty_struct *tty);
41477 };
41478
41479-static struct sunhv_ops bychar_ops = {
41480+static const struct sunhv_ops bychar_ops = {
41481 .transmit_chars = transmit_chars_putchar,
41482 .receive_chars = receive_chars_getchar,
41483 };
41484
41485-static struct sunhv_ops bywrite_ops = {
41486+static const struct sunhv_ops bywrite_ops = {
41487 .transmit_chars = transmit_chars_write,
41488 .receive_chars = receive_chars_read,
41489 };
41490@@ -370,7 +370,7 @@ static int sunhv_verify_port(struct uart
41491 return -EINVAL;
41492 }
41493
41494-static struct uart_ops sunhv_pops = {
41495+static const struct uart_ops sunhv_pops = {
41496 .tx_empty = sunhv_tx_empty,
41497 .set_mctrl = sunhv_set_mctrl,
41498 .get_mctrl = sunhv_get_mctrl,
41499diff -urNp linux-2.6.39/drivers/tty/serial/sunsab.c linux-2.6.39/drivers/tty/serial/sunsab.c
41500--- linux-2.6.39/drivers/tty/serial/sunsab.c 2011-05-19 00:06:34.000000000 -0400
41501+++ linux-2.6.39/drivers/tty/serial/sunsab.c 2011-05-22 19:36:32.000000000 -0400
41502@@ -804,7 +804,7 @@ static int sunsab_verify_port(struct uar
41503 return -EINVAL;
41504 }
41505
41506-static struct uart_ops sunsab_pops = {
41507+static const struct uart_ops sunsab_pops = {
41508 .tx_empty = sunsab_tx_empty,
41509 .set_mctrl = sunsab_set_mctrl,
41510 .get_mctrl = sunsab_get_mctrl,
41511diff -urNp linux-2.6.39/drivers/tty/serial/sunsu.c linux-2.6.39/drivers/tty/serial/sunsu.c
41512--- linux-2.6.39/drivers/tty/serial/sunsu.c 2011-05-19 00:06:34.000000000 -0400
41513+++ linux-2.6.39/drivers/tty/serial/sunsu.c 2011-05-22 19:36:32.000000000 -0400
41514@@ -946,7 +946,7 @@ sunsu_type(struct uart_port *port)
41515 return uart_config[type].name;
41516 }
41517
41518-static struct uart_ops sunsu_pops = {
41519+static const struct uart_ops sunsu_pops = {
41520 .tx_empty = sunsu_tx_empty,
41521 .set_mctrl = sunsu_set_mctrl,
41522 .get_mctrl = sunsu_get_mctrl,
41523diff -urNp linux-2.6.39/drivers/tty/serial/sunzilog.c linux-2.6.39/drivers/tty/serial/sunzilog.c
41524--- linux-2.6.39/drivers/tty/serial/sunzilog.c 2011-05-19 00:06:34.000000000 -0400
41525+++ linux-2.6.39/drivers/tty/serial/sunzilog.c 2011-05-22 19:36:32.000000000 -0400
41526@@ -1042,7 +1042,7 @@ static void sunzilog_put_poll_char(struc
41527 }
41528 #endif /* CONFIG_CONSOLE_POLL */
41529
41530-static struct uart_ops sunzilog_pops = {
41531+static const struct uart_ops sunzilog_pops = {
41532 .tx_empty = sunzilog_tx_empty,
41533 .set_mctrl = sunzilog_set_mctrl,
41534 .get_mctrl = sunzilog_get_mctrl,
41535diff -urNp linux-2.6.39/drivers/tty/serial/timbuart.c linux-2.6.39/drivers/tty/serial/timbuart.c
41536--- linux-2.6.39/drivers/tty/serial/timbuart.c 2011-05-19 00:06:34.000000000 -0400
41537+++ linux-2.6.39/drivers/tty/serial/timbuart.c 2011-05-22 19:36:32.000000000 -0400
41538@@ -394,7 +394,7 @@ static int timbuart_verify_port(struct u
41539 return -EINVAL;
41540 }
41541
41542-static struct uart_ops timbuart_ops = {
41543+static const struct uart_ops timbuart_ops = {
41544 .tx_empty = timbuart_tx_empty,
41545 .set_mctrl = timbuart_set_mctrl,
41546 .get_mctrl = timbuart_get_mctrl,
41547diff -urNp linux-2.6.39/drivers/tty/serial/uartlite.c linux-2.6.39/drivers/tty/serial/uartlite.c
41548--- linux-2.6.39/drivers/tty/serial/uartlite.c 2011-05-19 00:06:34.000000000 -0400
41549+++ linux-2.6.39/drivers/tty/serial/uartlite.c 2011-05-22 19:36:32.000000000 -0400
41550@@ -331,7 +331,7 @@ static void ulite_put_poll_char(struct u
41551 }
41552 #endif
41553
41554-static struct uart_ops ulite_ops = {
41555+static const struct uart_ops ulite_ops = {
41556 .tx_empty = ulite_tx_empty,
41557 .set_mctrl = ulite_set_mctrl,
41558 .get_mctrl = ulite_get_mctrl,
41559diff -urNp linux-2.6.39/drivers/tty/serial/ucc_uart.c linux-2.6.39/drivers/tty/serial/ucc_uart.c
41560--- linux-2.6.39/drivers/tty/serial/ucc_uart.c 2011-05-19 00:06:34.000000000 -0400
41561+++ linux-2.6.39/drivers/tty/serial/ucc_uart.c 2011-05-22 19:36:32.000000000 -0400
41562@@ -1088,7 +1088,7 @@ static int qe_uart_verify_port(struct ua
41563 *
41564 * Details on these functions can be found in Documentation/serial/driver
41565 */
41566-static struct uart_ops qe_uart_pops = {
41567+static const struct uart_ops qe_uart_pops = {
41568 .tx_empty = qe_uart_tx_empty,
41569 .set_mctrl = qe_uart_set_mctrl,
41570 .get_mctrl = qe_uart_get_mctrl,
41571diff -urNp linux-2.6.39/drivers/tty/serial/vr41xx_siu.c linux-2.6.39/drivers/tty/serial/vr41xx_siu.c
41572--- linux-2.6.39/drivers/tty/serial/vr41xx_siu.c 2011-05-19 00:06:34.000000000 -0400
41573+++ linux-2.6.39/drivers/tty/serial/vr41xx_siu.c 2011-05-22 19:36:32.000000000 -0400
41574@@ -683,7 +683,7 @@ static int siu_verify_port(struct uart_p
41575 return 0;
41576 }
41577
41578-static struct uart_ops siu_uart_ops = {
41579+static const struct uart_ops siu_uart_ops = {
41580 .tx_empty = siu_tx_empty,
41581 .set_mctrl = siu_set_mctrl,
41582 .get_mctrl = siu_get_mctrl,
41583diff -urNp linux-2.6.39/drivers/tty/serial/vt8500_serial.c linux-2.6.39/drivers/tty/serial/vt8500_serial.c
41584--- linux-2.6.39/drivers/tty/serial/vt8500_serial.c 2011-05-19 00:06:34.000000000 -0400
41585+++ linux-2.6.39/drivers/tty/serial/vt8500_serial.c 2011-05-22 19:36:32.000000000 -0400
41586@@ -519,7 +519,7 @@ static struct console vt8500_console = {
41587 #define VT8500_CONSOLE NULL
41588 #endif
41589
41590-static struct uart_ops vt8500_uart_pops = {
41591+static const struct uart_ops vt8500_uart_pops = {
41592 .tx_empty = vt8500_tx_empty,
41593 .set_mctrl = vt8500_set_mctrl,
41594 .get_mctrl = vt8500_get_mctrl,
41595diff -urNp linux-2.6.39/drivers/tty/serial/zs.c linux-2.6.39/drivers/tty/serial/zs.c
41596--- linux-2.6.39/drivers/tty/serial/zs.c 2011-05-19 00:06:34.000000000 -0400
41597+++ linux-2.6.39/drivers/tty/serial/zs.c 2011-05-22 19:36:32.000000000 -0400
41598@@ -1044,7 +1044,7 @@ static int zs_verify_port(struct uart_po
41599 }
41600
41601
41602-static struct uart_ops zs_ops = {
41603+static const struct uart_ops zs_ops = {
41604 .tx_empty = zs_tx_empty,
41605 .set_mctrl = zs_set_mctrl,
41606 .get_mctrl = zs_get_mctrl,
41607diff -urNp linux-2.6.39/drivers/tty/tty_io.c linux-2.6.39/drivers/tty/tty_io.c
41608--- linux-2.6.39/drivers/tty/tty_io.c 2011-05-19 00:06:34.000000000 -0400
41609+++ linux-2.6.39/drivers/tty/tty_io.c 2011-05-22 19:36:32.000000000 -0400
41610@@ -139,21 +139,11 @@ EXPORT_SYMBOL(tty_mutex);
41611 /* Spinlock to protect the tty->tty_files list */
41612 DEFINE_SPINLOCK(tty_files_lock);
41613
41614-static ssize_t tty_read(struct file *, char __user *, size_t, loff_t *);
41615-static ssize_t tty_write(struct file *, const char __user *, size_t, loff_t *);
41616 ssize_t redirected_tty_write(struct file *, const char __user *,
41617 size_t, loff_t *);
41618-static unsigned int tty_poll(struct file *, poll_table *);
41619 static int tty_open(struct inode *, struct file *);
41620 long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
41621-#ifdef CONFIG_COMPAT
41622-static long tty_compat_ioctl(struct file *file, unsigned int cmd,
41623- unsigned long arg);
41624-#else
41625-#define tty_compat_ioctl NULL
41626-#endif
41627 static int __tty_fasync(int fd, struct file *filp, int on);
41628-static int tty_fasync(int fd, struct file *filp, int on);
41629 static void release_tty(struct tty_struct *tty, int idx);
41630 static void __proc_set_tty(struct task_struct *tsk, struct tty_struct *tty);
41631 static void proc_set_tty(struct task_struct *tsk, struct tty_struct *tty);
41632@@ -937,7 +927,7 @@ EXPORT_SYMBOL(start_tty);
41633 * read calls may be outstanding in parallel.
41634 */
41635
41636-static ssize_t tty_read(struct file *file, char __user *buf, size_t count,
41637+ssize_t tty_read(struct file *file, char __user *buf, size_t count,
41638 loff_t *ppos)
41639 {
41640 int i;
41641@@ -963,6 +953,8 @@ static ssize_t tty_read(struct file *fil
41642 return i;
41643 }
41644
41645+EXPORT_SYMBOL(tty_read);
41646+
41647 void tty_write_unlock(struct tty_struct *tty)
41648 {
41649 mutex_unlock(&tty->atomic_write_lock);
41650@@ -1112,7 +1104,7 @@ void tty_write_message(struct tty_struct
41651 * write method will not be invoked in parallel for each device.
41652 */
41653
41654-static ssize_t tty_write(struct file *file, const char __user *buf,
41655+ssize_t tty_write(struct file *file, const char __user *buf,
41656 size_t count, loff_t *ppos)
41657 {
41658 struct inode *inode = file->f_path.dentry->d_inode;
41659@@ -1138,6 +1130,8 @@ static ssize_t tty_write(struct file *fi
41660 return ret;
41661 }
41662
41663+EXPORT_SYMBOL(tty_write);
41664+
41665 ssize_t redirected_tty_write(struct file *file, const char __user *buf,
41666 size_t count, loff_t *ppos)
41667 {
41668@@ -1777,6 +1771,8 @@ int tty_release(struct inode *inode, str
41669 return 0;
41670 }
41671
41672+EXPORT_SYMBOL(tty_release);
41673+
41674 /**
41675 * tty_open - open a tty device
41676 * @inode: inode of device file
41677@@ -1968,7 +1964,7 @@ got_driver:
41678 * may be re-entered freely by other callers.
41679 */
41680
41681-static unsigned int tty_poll(struct file *filp, poll_table *wait)
41682+unsigned int tty_poll(struct file *filp, poll_table *wait)
41683 {
41684 struct tty_struct *tty = file_tty(filp);
41685 struct tty_ldisc *ld;
41686@@ -1984,6 +1980,8 @@ static unsigned int tty_poll(struct file
41687 return ret;
41688 }
41689
41690+EXPORT_SYMBOL(tty_poll);
41691+
41692 static int __tty_fasync(int fd, struct file *filp, int on)
41693 {
41694 struct tty_struct *tty = file_tty(filp);
41695@@ -2025,7 +2023,7 @@ out:
41696 return retval;
41697 }
41698
41699-static int tty_fasync(int fd, struct file *filp, int on)
41700+int tty_fasync(int fd, struct file *filp, int on)
41701 {
41702 int retval;
41703 tty_lock();
41704@@ -2034,6 +2032,8 @@ static int tty_fasync(int fd, struct fil
41705 return retval;
41706 }
41707
41708+EXPORT_SYMBOL(tty_fasync);
41709+
41710 /**
41711 * tiocsti - fake input character
41712 * @tty: tty to fake input into
41713@@ -2695,8 +2695,10 @@ long tty_ioctl(struct file *file, unsign
41714 return retval;
41715 }
41716
41717+EXPORT_SYMBOL(tty_ioctl);
41718+
41719 #ifdef CONFIG_COMPAT
41720-static long tty_compat_ioctl(struct file *file, unsigned int cmd,
41721+long tty_compat_ioctl(struct file *file, unsigned int cmd,
41722 unsigned long arg)
41723 {
41724 struct inode *inode = file->f_dentry->d_inode;
41725@@ -2720,6 +2722,9 @@ static long tty_compat_ioctl(struct file
41726
41727 return retval;
41728 }
41729+
41730+EXPORT_SYMBOL(tty_compat_ioctl);
41731+
41732 #endif
41733
41734 /*
41735@@ -3198,11 +3203,6 @@ struct tty_struct *get_current_tty(void)
41736 }
41737 EXPORT_SYMBOL_GPL(get_current_tty);
41738
41739-void tty_default_fops(struct file_operations *fops)
41740-{
41741- *fops = tty_fops;
41742-}
41743-
41744 /*
41745 * Initialize the console device. This is called *early*, so
41746 * we can't necessarily depend on lots of kernel help here.
41747diff -urNp linux-2.6.39/drivers/tty/tty_ldisc.c linux-2.6.39/drivers/tty/tty_ldisc.c
41748--- linux-2.6.39/drivers/tty/tty_ldisc.c 2011-05-19 00:06:34.000000000 -0400
41749+++ linux-2.6.39/drivers/tty/tty_ldisc.c 2011-05-22 19:36:32.000000000 -0400
41750@@ -74,7 +74,7 @@ static void put_ldisc(struct tty_ldisc *
41751 if (atomic_dec_and_lock(&ld->users, &tty_ldisc_lock)) {
41752 struct tty_ldisc_ops *ldo = ld->ops;
41753
41754- ldo->refcount--;
41755+ atomic_dec(&ldo->refcount);
41756 module_put(ldo->owner);
41757 spin_unlock_irqrestore(&tty_ldisc_lock, flags);
41758
41759@@ -109,7 +109,7 @@ int tty_register_ldisc(int disc, struct
41760 spin_lock_irqsave(&tty_ldisc_lock, flags);
41761 tty_ldiscs[disc] = new_ldisc;
41762 new_ldisc->num = disc;
41763- new_ldisc->refcount = 0;
41764+ atomic_set(&new_ldisc->refcount, 0);
41765 spin_unlock_irqrestore(&tty_ldisc_lock, flags);
41766
41767 return ret;
41768@@ -137,7 +137,7 @@ int tty_unregister_ldisc(int disc)
41769 return -EINVAL;
41770
41771 spin_lock_irqsave(&tty_ldisc_lock, flags);
41772- if (tty_ldiscs[disc]->refcount)
41773+ if (atomic_read(&tty_ldiscs[disc]->refcount))
41774 ret = -EBUSY;
41775 else
41776 tty_ldiscs[disc] = NULL;
41777@@ -158,7 +158,7 @@ static struct tty_ldisc_ops *get_ldops(i
41778 if (ldops) {
41779 ret = ERR_PTR(-EAGAIN);
41780 if (try_module_get(ldops->owner)) {
41781- ldops->refcount++;
41782+ atomic_inc(&ldops->refcount);
41783 ret = ldops;
41784 }
41785 }
41786@@ -171,7 +171,7 @@ static void put_ldops(struct tty_ldisc_o
41787 unsigned long flags;
41788
41789 spin_lock_irqsave(&tty_ldisc_lock, flags);
41790- ldops->refcount--;
41791+ atomic_dec(&ldops->refcount);
41792 module_put(ldops->owner);
41793 spin_unlock_irqrestore(&tty_ldisc_lock, flags);
41794 }
41795diff -urNp linux-2.6.39/drivers/tty/vt/keyboard.c linux-2.6.39/drivers/tty/vt/keyboard.c
41796--- linux-2.6.39/drivers/tty/vt/keyboard.c 2011-05-19 00:06:34.000000000 -0400
41797+++ linux-2.6.39/drivers/tty/vt/keyboard.c 2011-05-22 20:32:43.000000000 -0400
41798@@ -658,6 +658,16 @@ static void k_spec(struct vc_data *vc, u
41799 kbd->kbdmode == VC_OFF) &&
41800 value != KVAL(K_SAK))
41801 return; /* SAK is allowed even in raw mode */
41802+
41803+#if defined(CONFIG_GRKERNSEC_PROC) || defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
41804+ {
41805+ void *func = fn_handler[value];
41806+ if (func == fn_show_state || func == fn_show_ptregs ||
41807+ func == fn_show_mem)
41808+ return;
41809+ }
41810+#endif
41811+
41812 fn_handler[value](vc);
41813 }
41814
41815diff -urNp linux-2.6.39/drivers/tty/vt/vt.c linux-2.6.39/drivers/tty/vt/vt.c
41816--- linux-2.6.39/drivers/tty/vt/vt.c 2011-05-19 00:06:34.000000000 -0400
41817+++ linux-2.6.39/drivers/tty/vt/vt.c 2011-05-22 19:36:32.000000000 -0400
41818@@ -261,7 +261,7 @@ EXPORT_SYMBOL_GPL(unregister_vt_notifier
41819
41820 static void notify_write(struct vc_data *vc, unsigned int unicode)
41821 {
41822- struct vt_notifier_param param = { .vc = vc, unicode = unicode };
41823+ struct vt_notifier_param param = { .vc = vc, .c = unicode };
41824 atomic_notifier_call_chain(&vt_notifier_list, VT_WRITE, &param);
41825 }
41826
41827diff -urNp linux-2.6.39/drivers/tty/vt/vt_ioctl.c linux-2.6.39/drivers/tty/vt/vt_ioctl.c
41828--- linux-2.6.39/drivers/tty/vt/vt_ioctl.c 2011-05-19 00:06:34.000000000 -0400
41829+++ linux-2.6.39/drivers/tty/vt/vt_ioctl.c 2011-05-22 19:41:37.000000000 -0400
41830@@ -209,9 +209,6 @@ do_kdsk_ioctl(int cmd, struct kbentry __
41831 if (copy_from_user(&tmp, user_kbe, sizeof(struct kbentry)))
41832 return -EFAULT;
41833
41834- if (!capable(CAP_SYS_TTY_CONFIG))
41835- perm = 0;
41836-
41837 switch (cmd) {
41838 case KDGKBENT:
41839 key_map = key_maps[s];
41840@@ -223,6 +220,9 @@ do_kdsk_ioctl(int cmd, struct kbentry __
41841 val = (i ? K_HOLE : K_NOSUCHMAP);
41842 return put_user(val, &user_kbe->kb_value);
41843 case KDSKBENT:
41844+ if (!capable(CAP_SYS_TTY_CONFIG))
41845+ perm = 0;
41846+
41847 if (!perm)
41848 return -EPERM;
41849 if (!i && v == K_NOSUCHMAP) {
41850@@ -324,9 +324,6 @@ do_kdgkb_ioctl(int cmd, struct kbsentry
41851 int i, j, k;
41852 int ret;
41853
41854- if (!capable(CAP_SYS_TTY_CONFIG))
41855- perm = 0;
41856-
41857 kbs = kmalloc(sizeof(*kbs), GFP_KERNEL);
41858 if (!kbs) {
41859 ret = -ENOMEM;
41860@@ -360,6 +357,9 @@ do_kdgkb_ioctl(int cmd, struct kbsentry
41861 kfree(kbs);
41862 return ((p && *p) ? -EOVERFLOW : 0);
41863 case KDSKBSENT:
41864+ if (!capable(CAP_SYS_TTY_CONFIG))
41865+ perm = 0;
41866+
41867 if (!perm) {
41868 ret = -EPERM;
41869 goto reterr;
41870diff -urNp linux-2.6.39/drivers/uio/uio.c linux-2.6.39/drivers/uio/uio.c
41871--- linux-2.6.39/drivers/uio/uio.c 2011-05-19 00:06:34.000000000 -0400
41872+++ linux-2.6.39/drivers/uio/uio.c 2011-05-22 19:36:32.000000000 -0400
41873@@ -25,6 +25,7 @@
41874 #include <linux/kobject.h>
41875 #include <linux/cdev.h>
41876 #include <linux/uio_driver.h>
41877+#include <asm/local.h>
41878
41879 #define UIO_MAX_DEVICES (1U << MINORBITS)
41880
41881@@ -32,10 +33,10 @@ struct uio_device {
41882 struct module *owner;
41883 struct device *dev;
41884 int minor;
41885- atomic_t event;
41886+ atomic_unchecked_t event;
41887 struct fasync_struct *async_queue;
41888 wait_queue_head_t wait;
41889- int vma_count;
41890+ local_t vma_count;
41891 struct uio_info *info;
41892 struct kobject *map_dir;
41893 struct kobject *portio_dir;
41894@@ -242,7 +243,7 @@ static ssize_t show_event(struct device
41895 struct device_attribute *attr, char *buf)
41896 {
41897 struct uio_device *idev = dev_get_drvdata(dev);
41898- return sprintf(buf, "%u\n", (unsigned int)atomic_read(&idev->event));
41899+ return sprintf(buf, "%u\n", (unsigned int)atomic_read_unchecked(&idev->event));
41900 }
41901
41902 static struct device_attribute uio_class_attributes[] = {
41903@@ -402,7 +403,7 @@ void uio_event_notify(struct uio_info *i
41904 {
41905 struct uio_device *idev = info->uio_dev;
41906
41907- atomic_inc(&idev->event);
41908+ atomic_inc_unchecked(&idev->event);
41909 wake_up_interruptible(&idev->wait);
41910 kill_fasync(&idev->async_queue, SIGIO, POLL_IN);
41911 }
41912@@ -455,7 +456,7 @@ static int uio_open(struct inode *inode,
41913 }
41914
41915 listener->dev = idev;
41916- listener->event_count = atomic_read(&idev->event);
41917+ listener->event_count = atomic_read_unchecked(&idev->event);
41918 filep->private_data = listener;
41919
41920 if (idev->info->open) {
41921@@ -506,7 +507,7 @@ static unsigned int uio_poll(struct file
41922 return -EIO;
41923
41924 poll_wait(filep, &idev->wait, wait);
41925- if (listener->event_count != atomic_read(&idev->event))
41926+ if (listener->event_count != atomic_read_unchecked(&idev->event))
41927 return POLLIN | POLLRDNORM;
41928 return 0;
41929 }
41930@@ -531,7 +532,7 @@ static ssize_t uio_read(struct file *fil
41931 do {
41932 set_current_state(TASK_INTERRUPTIBLE);
41933
41934- event_count = atomic_read(&idev->event);
41935+ event_count = atomic_read_unchecked(&idev->event);
41936 if (event_count != listener->event_count) {
41937 if (copy_to_user(buf, &event_count, count))
41938 retval = -EFAULT;
41939@@ -602,13 +603,13 @@ static int uio_find_mem_index(struct vm_
41940 static void uio_vma_open(struct vm_area_struct *vma)
41941 {
41942 struct uio_device *idev = vma->vm_private_data;
41943- idev->vma_count++;
41944+ local_inc(&idev->vma_count);
41945 }
41946
41947 static void uio_vma_close(struct vm_area_struct *vma)
41948 {
41949 struct uio_device *idev = vma->vm_private_data;
41950- idev->vma_count--;
41951+ local_dec(&idev->vma_count);
41952 }
41953
41954 static int uio_vma_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
41955@@ -819,7 +820,7 @@ int __uio_register_device(struct module
41956 idev->owner = owner;
41957 idev->info = info;
41958 init_waitqueue_head(&idev->wait);
41959- atomic_set(&idev->event, 0);
41960+ atomic_set_unchecked(&idev->event, 0);
41961
41962 ret = uio_get_minor(idev);
41963 if (ret)
41964diff -urNp linux-2.6.39/drivers/usb/atm/cxacru.c linux-2.6.39/drivers/usb/atm/cxacru.c
41965--- linux-2.6.39/drivers/usb/atm/cxacru.c 2011-05-19 00:06:34.000000000 -0400
41966+++ linux-2.6.39/drivers/usb/atm/cxacru.c 2011-05-22 19:36:32.000000000 -0400
41967@@ -473,7 +473,7 @@ static ssize_t cxacru_sysfs_store_adsl_c
41968 ret = sscanf(buf + pos, "%x=%x%n", &index, &value, &tmp);
41969 if (ret < 2)
41970 return -EINVAL;
41971- if (index < 0 || index > 0x7f)
41972+ if (index > 0x7f)
41973 return -EINVAL;
41974 pos += tmp;
41975
41976diff -urNp linux-2.6.39/drivers/usb/atm/usbatm.c linux-2.6.39/drivers/usb/atm/usbatm.c
41977--- linux-2.6.39/drivers/usb/atm/usbatm.c 2011-05-19 00:06:34.000000000 -0400
41978+++ linux-2.6.39/drivers/usb/atm/usbatm.c 2011-05-22 19:36:32.000000000 -0400
41979@@ -332,7 +332,7 @@ static void usbatm_extract_one_cell(stru
41980 if (printk_ratelimit())
41981 atm_warn(instance, "%s: OAM not supported (vpi %d, vci %d)!\n",
41982 __func__, vpi, vci);
41983- atomic_inc(&vcc->stats->rx_err);
41984+ atomic_inc_unchecked(&vcc->stats->rx_err);
41985 return;
41986 }
41987
41988@@ -360,7 +360,7 @@ static void usbatm_extract_one_cell(stru
41989 if (length > ATM_MAX_AAL5_PDU) {
41990 atm_rldbg(instance, "%s: bogus length %u (vcc: 0x%p)!\n",
41991 __func__, length, vcc);
41992- atomic_inc(&vcc->stats->rx_err);
41993+ atomic_inc_unchecked(&vcc->stats->rx_err);
41994 goto out;
41995 }
41996
41997@@ -369,14 +369,14 @@ static void usbatm_extract_one_cell(stru
41998 if (sarb->len < pdu_length) {
41999 atm_rldbg(instance, "%s: bogus pdu_length %u (sarb->len: %u, vcc: 0x%p)!\n",
42000 __func__, pdu_length, sarb->len, vcc);
42001- atomic_inc(&vcc->stats->rx_err);
42002+ atomic_inc_unchecked(&vcc->stats->rx_err);
42003 goto out;
42004 }
42005
42006 if (crc32_be(~0, skb_tail_pointer(sarb) - pdu_length, pdu_length) != 0xc704dd7b) {
42007 atm_rldbg(instance, "%s: packet failed crc check (vcc: 0x%p)!\n",
42008 __func__, vcc);
42009- atomic_inc(&vcc->stats->rx_err);
42010+ atomic_inc_unchecked(&vcc->stats->rx_err);
42011 goto out;
42012 }
42013
42014@@ -386,7 +386,7 @@ static void usbatm_extract_one_cell(stru
42015 if (printk_ratelimit())
42016 atm_err(instance, "%s: no memory for skb (length: %u)!\n",
42017 __func__, length);
42018- atomic_inc(&vcc->stats->rx_drop);
42019+ atomic_inc_unchecked(&vcc->stats->rx_drop);
42020 goto out;
42021 }
42022
42023@@ -411,7 +411,7 @@ static void usbatm_extract_one_cell(stru
42024
42025 vcc->push(vcc, skb);
42026
42027- atomic_inc(&vcc->stats->rx);
42028+ atomic_inc_unchecked(&vcc->stats->rx);
42029 out:
42030 skb_trim(sarb, 0);
42031 }
42032@@ -614,7 +614,7 @@ static void usbatm_tx_process(unsigned l
42033 struct atm_vcc *vcc = UDSL_SKB(skb)->atm.vcc;
42034
42035 usbatm_pop(vcc, skb);
42036- atomic_inc(&vcc->stats->tx);
42037+ atomic_inc_unchecked(&vcc->stats->tx);
42038
42039 skb = skb_dequeue(&instance->sndqueue);
42040 }
42041@@ -773,11 +773,11 @@ static int usbatm_atm_proc_read(struct a
42042 if (!left--)
42043 return sprintf(page,
42044 "AAL5: tx %d ( %d err ), rx %d ( %d err, %d drop )\n",
42045- atomic_read(&atm_dev->stats.aal5.tx),
42046- atomic_read(&atm_dev->stats.aal5.tx_err),
42047- atomic_read(&atm_dev->stats.aal5.rx),
42048- atomic_read(&atm_dev->stats.aal5.rx_err),
42049- atomic_read(&atm_dev->stats.aal5.rx_drop));
42050+ atomic_read_unchecked(&atm_dev->stats.aal5.tx),
42051+ atomic_read_unchecked(&atm_dev->stats.aal5.tx_err),
42052+ atomic_read_unchecked(&atm_dev->stats.aal5.rx),
42053+ atomic_read_unchecked(&atm_dev->stats.aal5.rx_err),
42054+ atomic_read_unchecked(&atm_dev->stats.aal5.rx_drop));
42055
42056 if (!left--) {
42057 if (instance->disconnected)
42058diff -urNp linux-2.6.39/drivers/usb/core/devices.c linux-2.6.39/drivers/usb/core/devices.c
42059--- linux-2.6.39/drivers/usb/core/devices.c 2011-05-19 00:06:34.000000000 -0400
42060+++ linux-2.6.39/drivers/usb/core/devices.c 2011-05-22 19:36:32.000000000 -0400
42061@@ -126,7 +126,7 @@ static const char *format_endpt =
42062 * time it gets called.
42063 */
42064 static struct device_connect_event {
42065- atomic_t count;
42066+ atomic_unchecked_t count;
42067 wait_queue_head_t wait;
42068 } device_event = {
42069 .count = ATOMIC_INIT(1),
42070@@ -164,7 +164,7 @@ static const struct class_info clas_info
42071
42072 void usbfs_conn_disc_event(void)
42073 {
42074- atomic_add(2, &device_event.count);
42075+ atomic_add_unchecked(2, &device_event.count);
42076 wake_up(&device_event.wait);
42077 }
42078
42079@@ -648,7 +648,7 @@ static unsigned int usb_device_poll(stru
42080
42081 poll_wait(file, &device_event.wait, wait);
42082
42083- event_count = atomic_read(&device_event.count);
42084+ event_count = atomic_read_unchecked(&device_event.count);
42085 if (file->f_version != event_count) {
42086 file->f_version = event_count;
42087 return POLLIN | POLLRDNORM;
42088diff -urNp linux-2.6.39/drivers/usb/core/hcd.c linux-2.6.39/drivers/usb/core/hcd.c
42089--- linux-2.6.39/drivers/usb/core/hcd.c 2011-05-19 00:06:34.000000000 -0400
42090+++ linux-2.6.39/drivers/usb/core/hcd.c 2011-05-22 19:36:32.000000000 -0400
42091@@ -2577,7 +2577,7 @@ EXPORT_SYMBOL_GPL(usb_hcd_platform_shutd
42092
42093 #if defined(CONFIG_USB_MON) || defined(CONFIG_USB_MON_MODULE)
42094
42095-struct usb_mon_operations *mon_ops;
42096+const struct usb_mon_operations *mon_ops;
42097
42098 /*
42099 * The registration is unlocked.
42100@@ -2587,7 +2587,7 @@ struct usb_mon_operations *mon_ops;
42101 * symbols from usbcore, usbcore gets referenced and cannot be unloaded first.
42102 */
42103
42104-int usb_mon_register (struct usb_mon_operations *ops)
42105+int usb_mon_register (const struct usb_mon_operations *ops)
42106 {
42107
42108 if (mon_ops)
42109diff -urNp linux-2.6.39/drivers/usb/core/message.c linux-2.6.39/drivers/usb/core/message.c
42110--- linux-2.6.39/drivers/usb/core/message.c 2011-05-19 00:06:34.000000000 -0400
42111+++ linux-2.6.39/drivers/usb/core/message.c 2011-05-22 19:36:32.000000000 -0400
42112@@ -869,8 +869,8 @@ char *usb_cache_string(struct usb_device
42113 buf = kmalloc(MAX_USB_STRING_SIZE, GFP_NOIO);
42114 if (buf) {
42115 len = usb_string(udev, index, buf, MAX_USB_STRING_SIZE);
42116- if (len > 0) {
42117- smallbuf = kmalloc(++len, GFP_NOIO);
42118+ if (len++ > 0) {
42119+ smallbuf = kmalloc(len, GFP_NOIO);
42120 if (!smallbuf)
42121 return buf;
42122 memcpy(smallbuf, buf, len);
42123diff -urNp linux-2.6.39/drivers/usb/early/ehci-dbgp.c linux-2.6.39/drivers/usb/early/ehci-dbgp.c
42124--- linux-2.6.39/drivers/usb/early/ehci-dbgp.c 2011-05-19 00:06:34.000000000 -0400
42125+++ linux-2.6.39/drivers/usb/early/ehci-dbgp.c 2011-05-22 19:36:32.000000000 -0400
42126@@ -96,7 +96,7 @@ static inline u32 dbgp_len_update(u32 x,
42127 }
42128
42129 #ifdef CONFIG_KGDB
42130-static struct kgdb_io kgdbdbgp_io_ops;
42131+static struct kgdb_io kgdbdbgp_io_ops; /* cannot be const, see kgdbdbgp_parse_config */
42132 #define dbgp_kgdb_mode (dbg_io_ops == &kgdbdbgp_io_ops)
42133 #else
42134 #define dbgp_kgdb_mode (0)
42135@@ -1026,7 +1026,7 @@ static void kgdbdbgp_write_char(u8 chr)
42136 early_dbgp_write(NULL, &chr, 1);
42137 }
42138
42139-static struct kgdb_io kgdbdbgp_io_ops = {
42140+static struct kgdb_io kgdbdbgp_io_ops = { /* cannot be const, see kgdbdbgp_parse_config() */
42141 .name = "kgdbdbgp",
42142 .read_char = kgdbdbgp_read_char,
42143 .write_char = kgdbdbgp_write_char,
42144diff -urNp linux-2.6.39/drivers/usb/gadget/fsl_qe_udc.c linux-2.6.39/drivers/usb/gadget/fsl_qe_udc.c
42145--- linux-2.6.39/drivers/usb/gadget/fsl_qe_udc.c 2011-05-19 00:06:34.000000000 -0400
42146+++ linux-2.6.39/drivers/usb/gadget/fsl_qe_udc.c 2011-05-22 19:36:32.000000000 -0400
42147@@ -1859,7 +1859,7 @@ out:
42148 return status;
42149 }
42150
42151-static struct usb_ep_ops qe_ep_ops = {
42152+static const struct usb_ep_ops qe_ep_ops = {
42153 .enable = qe_ep_enable,
42154 .disable = qe_ep_disable,
42155
42156@@ -1928,7 +1928,7 @@ static int qe_pullup(struct usb_gadget *
42157 }
42158
42159 /* defined in usb_gadget.h */
42160-static struct usb_gadget_ops qe_gadget_ops = {
42161+static const struct usb_gadget_ops qe_gadget_ops = {
42162 .get_frame = qe_get_frame,
42163 .wakeup = qe_wakeup,
42164 /* .set_selfpowered = qe_set_selfpowered,*/ /* always selfpowered */
42165diff -urNp linux-2.6.39/drivers/usb/gadget/fsl_udc_core.c linux-2.6.39/drivers/usb/gadget/fsl_udc_core.c
42166--- linux-2.6.39/drivers/usb/gadget/fsl_udc_core.c 2011-05-19 00:06:34.000000000 -0400
42167+++ linux-2.6.39/drivers/usb/gadget/fsl_udc_core.c 2011-05-22 19:36:32.000000000 -0400
42168@@ -1003,7 +1003,7 @@ static void fsl_ep_fifo_flush(struct usb
42169 } while (fsl_readl(&dr_regs->endptstatus) & bits);
42170 }
42171
42172-static struct usb_ep_ops fsl_ep_ops = {
42173+static const struct usb_ep_ops fsl_ep_ops = {
42174 .enable = fsl_ep_enable,
42175 .disable = fsl_ep_disable,
42176
42177@@ -1114,7 +1114,7 @@ static int fsl_pullup(struct usb_gadget
42178 }
42179
42180 /* defined in gadget.h */
42181-static struct usb_gadget_ops fsl_gadget_ops = {
42182+static const struct usb_gadget_ops fsl_gadget_ops = {
42183 .get_frame = fsl_get_frame,
42184 .wakeup = fsl_wakeup,
42185 /* .set_selfpowered = fsl_set_selfpowered, */ /* Always selfpowered */
42186diff -urNp linux-2.6.39/drivers/usb/gadget/fusb300_udc.c linux-2.6.39/drivers/usb/gadget/fusb300_udc.c
42187--- linux-2.6.39/drivers/usb/gadget/fusb300_udc.c 2011-05-19 00:06:34.000000000 -0400
42188+++ linux-2.6.39/drivers/usb/gadget/fusb300_udc.c 2011-05-22 19:36:32.000000000 -0400
42189@@ -527,7 +527,7 @@ static void fusb300_fifo_flush(struct us
42190 {
42191 }
42192
42193-static struct usb_ep_ops fusb300_ep_ops = {
42194+static const struct usb_ep_ops fusb300_ep_ops = {
42195 .enable = fusb300_enable,
42196 .disable = fusb300_disable,
42197
42198@@ -1570,7 +1570,7 @@ static int fusb300_udc_pullup(struct usb
42199 return 0;
42200 }
42201
42202-static struct usb_gadget_ops fusb300_gadget_ops = {
42203+static const struct usb_gadget_ops fusb300_gadget_ops = {
42204 .pullup = fusb300_udc_pullup,
42205 };
42206
42207diff -urNp linux-2.6.39/drivers/usb/gadget/goku_udc.c linux-2.6.39/drivers/usb/gadget/goku_udc.c
42208--- linux-2.6.39/drivers/usb/gadget/goku_udc.c 2011-05-19 00:06:34.000000000 -0400
42209+++ linux-2.6.39/drivers/usb/gadget/goku_udc.c 2011-05-22 19:36:32.000000000 -0400
42210@@ -973,7 +973,7 @@ static void goku_fifo_flush(struct usb_e
42211 command(regs, COMMAND_FIFO_CLEAR, ep->num);
42212 }
42213
42214-static struct usb_ep_ops goku_ep_ops = {
42215+static const struct usb_ep_ops goku_ep_ops = {
42216 .enable = goku_ep_enable,
42217 .disable = goku_ep_disable,
42218
42219diff -urNp linux-2.6.39/drivers/usb/gadget/imx_udc.c linux-2.6.39/drivers/usb/gadget/imx_udc.c
42220--- linux-2.6.39/drivers/usb/gadget/imx_udc.c 2011-05-19 00:06:34.000000000 -0400
42221+++ linux-2.6.39/drivers/usb/gadget/imx_udc.c 2011-05-22 19:36:32.000000000 -0400
42222@@ -937,7 +937,7 @@ static void imx_ep_fifo_flush(struct usb
42223 local_irq_restore(flags);
42224 }
42225
42226-static struct usb_ep_ops imx_ep_ops = {
42227+static const struct usb_ep_ops imx_ep_ops = {
42228 .enable = imx_ep_enable,
42229 .disable = imx_ep_disable,
42230
42231diff -urNp linux-2.6.39/drivers/usb/gadget/m66592-udc.c linux-2.6.39/drivers/usb/gadget/m66592-udc.c
42232--- linux-2.6.39/drivers/usb/gadget/m66592-udc.c 2011-05-19 00:06:34.000000000 -0400
42233+++ linux-2.6.39/drivers/usb/gadget/m66592-udc.c 2011-05-22 19:36:32.000000000 -0400
42234@@ -1437,7 +1437,7 @@ static void m66592_fifo_flush(struct usb
42235 spin_unlock_irqrestore(&ep->m66592->lock, flags);
42236 }
42237
42238-static struct usb_ep_ops m66592_ep_ops = {
42239+static const struct usb_ep_ops m66592_ep_ops = {
42240 .enable = m66592_enable,
42241 .disable = m66592_disable,
42242
42243@@ -1542,7 +1542,7 @@ static int m66592_get_frame(struct usb_g
42244 return m66592_read(m66592, M66592_FRMNUM) & 0x03FF;
42245 }
42246
42247-static struct usb_gadget_ops m66592_gadget_ops = {
42248+static const struct usb_gadget_ops m66592_gadget_ops = {
42249 .get_frame = m66592_get_frame,
42250 };
42251
42252diff -urNp linux-2.6.39/drivers/usb/gadget/mv_udc_core.c linux-2.6.39/drivers/usb/gadget/mv_udc_core.c
42253--- linux-2.6.39/drivers/usb/gadget/mv_udc_core.c 2011-05-19 00:06:34.000000000 -0400
42254+++ linux-2.6.39/drivers/usb/gadget/mv_udc_core.c 2011-05-22 19:36:32.000000000 -0400
42255@@ -972,7 +972,7 @@ static int mv_ep_set_wedge(struct usb_ep
42256 return mv_ep_set_halt_wedge(_ep, 1, 1);
42257 }
42258
42259-static struct usb_ep_ops mv_ep_ops = {
42260+static const struct usb_ep_ops mv_ep_ops = {
42261 .enable = mv_ep_enable,
42262 .disable = mv_ep_disable,
42263
42264diff -urNp linux-2.6.39/drivers/usb/gadget/omap_udc.c linux-2.6.39/drivers/usb/gadget/omap_udc.c
42265--- linux-2.6.39/drivers/usb/gadget/omap_udc.c 2011-05-19 00:06:34.000000000 -0400
42266+++ linux-2.6.39/drivers/usb/gadget/omap_udc.c 2011-05-22 19:36:32.000000000 -0400
42267@@ -1177,7 +1177,7 @@ done:
42268 return status;
42269 }
42270
42271-static struct usb_ep_ops omap_ep_ops = {
42272+static const struct usb_ep_ops omap_ep_ops = {
42273 .enable = omap_ep_enable,
42274 .disable = omap_ep_disable,
42275
42276@@ -1374,7 +1374,7 @@ static int omap_pullup(struct usb_gadget
42277 return 0;
42278 }
42279
42280-static struct usb_gadget_ops omap_gadget_ops = {
42281+static const struct usb_gadget_ops omap_gadget_ops = {
42282 .get_frame = omap_get_frame,
42283 .wakeup = omap_wakeup,
42284 .set_selfpowered = omap_set_selfpowered,
42285diff -urNp linux-2.6.39/drivers/usb/gadget/pxa25x_udc.c linux-2.6.39/drivers/usb/gadget/pxa25x_udc.c
42286--- linux-2.6.39/drivers/usb/gadget/pxa25x_udc.c 2011-05-19 00:06:34.000000000 -0400
42287+++ linux-2.6.39/drivers/usb/gadget/pxa25x_udc.c 2011-05-22 19:36:32.000000000 -0400
42288@@ -896,7 +896,7 @@ static void pxa25x_ep_fifo_flush(struct
42289 }
42290
42291
42292-static struct usb_ep_ops pxa25x_ep_ops = {
42293+static const struct usb_ep_ops pxa25x_ep_ops = {
42294 .enable = pxa25x_ep_enable,
42295 .disable = pxa25x_ep_disable,
42296
42297diff -urNp linux-2.6.39/drivers/usb/gadget/pxa27x_udc.c linux-2.6.39/drivers/usb/gadget/pxa27x_udc.c
42298--- linux-2.6.39/drivers/usb/gadget/pxa27x_udc.c 2011-05-19 00:06:34.000000000 -0400
42299+++ linux-2.6.39/drivers/usb/gadget/pxa27x_udc.c 2011-05-22 19:36:32.000000000 -0400
42300@@ -1491,7 +1491,7 @@ static int pxa_ep_disable(struct usb_ep
42301 return 0;
42302 }
42303
42304-static struct usb_ep_ops pxa_ep_ops = {
42305+static const struct usb_ep_ops pxa_ep_ops = {
42306 .enable = pxa_ep_enable,
42307 .disable = pxa_ep_disable,
42308
42309diff -urNp linux-2.6.39/drivers/usb/gadget/r8a66597-udc.c linux-2.6.39/drivers/usb/gadget/r8a66597-udc.c
42310--- linux-2.6.39/drivers/usb/gadget/r8a66597-udc.c 2011-05-19 00:06:34.000000000 -0400
42311+++ linux-2.6.39/drivers/usb/gadget/r8a66597-udc.c 2011-05-22 19:36:32.000000000 -0400
42312@@ -1392,7 +1392,7 @@ static void r8a66597_fifo_flush(struct u
42313 spin_unlock_irqrestore(&ep->r8a66597->lock, flags);
42314 }
42315
42316-static struct usb_ep_ops r8a66597_ep_ops = {
42317+static const struct usb_ep_ops r8a66597_ep_ops = {
42318 .enable = r8a66597_enable,
42319 .disable = r8a66597_disable,
42320
42321@@ -1497,7 +1497,7 @@ static int r8a66597_get_frame(struct usb
42322 return r8a66597_read(r8a66597, FRMNUM) & 0x03FF;
42323 }
42324
42325-static struct usb_gadget_ops r8a66597_gadget_ops = {
42326+static const struct usb_gadget_ops r8a66597_gadget_ops = {
42327 .get_frame = r8a66597_get_frame,
42328 };
42329
42330diff -urNp linux-2.6.39/drivers/usb/gadget/s3c-hsotg.c linux-2.6.39/drivers/usb/gadget/s3c-hsotg.c
42331--- linux-2.6.39/drivers/usb/gadget/s3c-hsotg.c 2011-05-19 00:06:34.000000000 -0400
42332+++ linux-2.6.39/drivers/usb/gadget/s3c-hsotg.c 2011-05-22 19:36:32.000000000 -0400
42333@@ -2461,7 +2461,7 @@ static int s3c_hsotg_ep_sethalt(struct u
42334 return 0;
42335 }
42336
42337-static struct usb_ep_ops s3c_hsotg_ep_ops = {
42338+static const struct usb_ep_ops s3c_hsotg_ep_ops = {
42339 .enable = s3c_hsotg_ep_enable,
42340 .disable = s3c_hsotg_ep_disable,
42341 .alloc_request = s3c_hsotg_ep_alloc_request,
42342@@ -2725,7 +2725,7 @@ static int s3c_hsotg_gadget_getframe(str
42343 return s3c_hsotg_read_frameno(to_hsotg(gadget));
42344 }
42345
42346-static struct usb_gadget_ops s3c_hsotg_gadget_ops = {
42347+static const struct usb_gadget_ops s3c_hsotg_gadget_ops = {
42348 .get_frame = s3c_hsotg_gadget_getframe,
42349 };
42350
42351diff -urNp linux-2.6.39/drivers/usb/gadget/uvc_queue.c linux-2.6.39/drivers/usb/gadget/uvc_queue.c
42352--- linux-2.6.39/drivers/usb/gadget/uvc_queue.c 2011-05-19 00:06:34.000000000 -0400
42353+++ linux-2.6.39/drivers/usb/gadget/uvc_queue.c 2011-05-22 19:36:32.000000000 -0400
42354@@ -400,7 +400,7 @@ static void uvc_vm_close(struct vm_area_
42355 buffer->vma_use_count--;
42356 }
42357
42358-static struct vm_operations_struct uvc_vm_ops = {
42359+static const struct vm_operations_struct uvc_vm_ops = {
42360 .open = uvc_vm_open,
42361 .close = uvc_vm_close,
42362 };
42363diff -urNp linux-2.6.39/drivers/usb/host/ehci-fsl.c linux-2.6.39/drivers/usb/host/ehci-fsl.c
42364--- linux-2.6.39/drivers/usb/host/ehci-fsl.c 2011-05-19 00:06:34.000000000 -0400
42365+++ linux-2.6.39/drivers/usb/host/ehci-fsl.c 2011-05-22 19:36:32.000000000 -0400
42366@@ -380,7 +380,7 @@ static int ehci_fsl_drv_restore(struct d
42367 return 0;
42368 }
42369
42370-static struct dev_pm_ops ehci_fsl_pm_ops = {
42371+static const struct dev_pm_ops ehci_fsl_pm_ops = {
42372 .suspend = ehci_fsl_drv_suspend,
42373 .resume = ehci_fsl_drv_resume,
42374 .restore = ehci_fsl_drv_restore,
42375diff -urNp linux-2.6.39/drivers/usb/host/xhci-mem.c linux-2.6.39/drivers/usb/host/xhci-mem.c
42376--- linux-2.6.39/drivers/usb/host/xhci-mem.c 2011-05-19 00:06:34.000000000 -0400
42377+++ linux-2.6.39/drivers/usb/host/xhci-mem.c 2011-05-22 19:36:32.000000000 -0400
42378@@ -1671,6 +1671,8 @@ static int xhci_check_trb_in_td_math(str
42379 unsigned int num_tests;
42380 int i, ret;
42381
42382+ pax_track_stack();
42383+
42384 num_tests = ARRAY_SIZE(simple_test_vector);
42385 for (i = 0; i < num_tests; i++) {
42386 ret = xhci_test_trb_in_td(xhci,
42387diff -urNp linux-2.6.39/drivers/usb/mon/mon_main.c linux-2.6.39/drivers/usb/mon/mon_main.c
42388--- linux-2.6.39/drivers/usb/mon/mon_main.c 2011-05-19 00:06:34.000000000 -0400
42389+++ linux-2.6.39/drivers/usb/mon/mon_main.c 2011-05-22 19:36:32.000000000 -0400
42390@@ -238,7 +238,7 @@ static struct notifier_block mon_nb = {
42391 /*
42392 * Ops
42393 */
42394-static struct usb_mon_operations mon_ops_0 = {
42395+static const struct usb_mon_operations mon_ops_0 = {
42396 .urb_submit = mon_submit,
42397 .urb_submit_error = mon_submit_error,
42398 .urb_complete = mon_complete,
42399diff -urNp linux-2.6.39/drivers/usb/musb/cppi_dma.h linux-2.6.39/drivers/usb/musb/cppi_dma.h
42400--- linux-2.6.39/drivers/usb/musb/cppi_dma.h 2011-05-19 00:06:34.000000000 -0400
42401+++ linux-2.6.39/drivers/usb/musb/cppi_dma.h 2011-05-22 19:36:32.000000000 -0400
42402@@ -113,7 +113,7 @@ struct cppi_channel {
42403
42404 /* CPPI DMA controller object */
42405 struct cppi {
42406- struct dma_controller controller;
42407+ const struct dma_controller controller;
42408 struct musb *musb;
42409 void __iomem *mregs; /* Mentor regs */
42410 void __iomem *tibase; /* TI/CPPI regs */
42411diff -urNp linux-2.6.39/drivers/usb/otg/msm_otg.c linux-2.6.39/drivers/usb/otg/msm_otg.c
42412--- linux-2.6.39/drivers/usb/otg/msm_otg.c 2011-05-19 00:06:34.000000000 -0400
42413+++ linux-2.6.39/drivers/usb/otg/msm_otg.c 2011-05-22 19:36:32.000000000 -0400
42414@@ -95,7 +95,7 @@ static int ulpi_write(struct otg_transce
42415 return 0;
42416 }
42417
42418-static struct otg_io_access_ops msm_otg_io_ops = {
42419+static const struct otg_io_access_ops msm_otg_io_ops = {
42420 .read = ulpi_read,
42421 .write = ulpi_write,
42422 };
42423diff -urNp linux-2.6.39/drivers/usb/otg/ulpi_viewport.c linux-2.6.39/drivers/usb/otg/ulpi_viewport.c
42424--- linux-2.6.39/drivers/usb/otg/ulpi_viewport.c 2011-05-19 00:06:34.000000000 -0400
42425+++ linux-2.6.39/drivers/usb/otg/ulpi_viewport.c 2011-05-22 19:36:32.000000000 -0400
42426@@ -74,7 +74,7 @@ static int ulpi_viewport_write(struct ot
42427 return ulpi_viewport_wait(view, ULPI_VIEW_RUN);
42428 }
42429
42430-struct otg_io_access_ops ulpi_viewport_access_ops = {
42431+const struct otg_io_access_ops ulpi_viewport_access_ops = {
42432 .read = ulpi_viewport_read,
42433 .write = ulpi_viewport_write,
42434 };
42435diff -urNp linux-2.6.39/drivers/usb/serial/ftdi_sio.c linux-2.6.39/drivers/usb/serial/ftdi_sio.c
42436--- linux-2.6.39/drivers/usb/serial/ftdi_sio.c 2011-05-19 00:06:34.000000000 -0400
42437+++ linux-2.6.39/drivers/usb/serial/ftdi_sio.c 2011-05-22 19:36:32.000000000 -0400
42438@@ -104,27 +104,27 @@ static int ftdi_stmclite_probe(struct
42439 static void ftdi_USB_UIRT_setup(struct ftdi_private *priv);
42440 static void ftdi_HE_TIRA1_setup(struct ftdi_private *priv);
42441
42442-static struct ftdi_sio_quirk ftdi_jtag_quirk = {
42443+static const struct ftdi_sio_quirk ftdi_jtag_quirk = {
42444 .probe = ftdi_jtag_probe,
42445 };
42446
42447-static struct ftdi_sio_quirk ftdi_mtxorb_hack_quirk = {
42448+static const struct ftdi_sio_quirk ftdi_mtxorb_hack_quirk = {
42449 .probe = ftdi_mtxorb_hack_setup,
42450 };
42451
42452-static struct ftdi_sio_quirk ftdi_NDI_device_quirk = {
42453+static const struct ftdi_sio_quirk ftdi_NDI_device_quirk = {
42454 .probe = ftdi_NDI_device_setup,
42455 };
42456
42457-static struct ftdi_sio_quirk ftdi_USB_UIRT_quirk = {
42458+static const struct ftdi_sio_quirk ftdi_USB_UIRT_quirk = {
42459 .port_probe = ftdi_USB_UIRT_setup,
42460 };
42461
42462-static struct ftdi_sio_quirk ftdi_HE_TIRA1_quirk = {
42463+static const struct ftdi_sio_quirk ftdi_HE_TIRA1_quirk = {
42464 .port_probe = ftdi_HE_TIRA1_setup,
42465 };
42466
42467-static struct ftdi_sio_quirk ftdi_stmclite_quirk = {
42468+static const struct ftdi_sio_quirk ftdi_stmclite_quirk = {
42469 .probe = ftdi_stmclite_probe,
42470 };
42471
42472diff -urNp linux-2.6.39/drivers/usb/wusbcore/wa-hc.h linux-2.6.39/drivers/usb/wusbcore/wa-hc.h
42473--- linux-2.6.39/drivers/usb/wusbcore/wa-hc.h 2011-05-19 00:06:34.000000000 -0400
42474+++ linux-2.6.39/drivers/usb/wusbcore/wa-hc.h 2011-05-22 19:36:32.000000000 -0400
42475@@ -192,7 +192,7 @@ struct wahc {
42476 struct list_head xfer_delayed_list;
42477 spinlock_t xfer_list_lock;
42478 struct work_struct xfer_work;
42479- atomic_t xfer_id_count;
42480+ atomic_unchecked_t xfer_id_count;
42481 };
42482
42483
42484@@ -246,7 +246,7 @@ static inline void wa_init(struct wahc *
42485 INIT_LIST_HEAD(&wa->xfer_delayed_list);
42486 spin_lock_init(&wa->xfer_list_lock);
42487 INIT_WORK(&wa->xfer_work, wa_urb_enqueue_run);
42488- atomic_set(&wa->xfer_id_count, 1);
42489+ atomic_set_unchecked(&wa->xfer_id_count, 1);
42490 }
42491
42492 /**
42493diff -urNp linux-2.6.39/drivers/usb/wusbcore/wa-xfer.c linux-2.6.39/drivers/usb/wusbcore/wa-xfer.c
42494--- linux-2.6.39/drivers/usb/wusbcore/wa-xfer.c 2011-05-19 00:06:34.000000000 -0400
42495+++ linux-2.6.39/drivers/usb/wusbcore/wa-xfer.c 2011-05-22 19:36:32.000000000 -0400
42496@@ -294,7 +294,7 @@ out:
42497 */
42498 static void wa_xfer_id_init(struct wa_xfer *xfer)
42499 {
42500- xfer->id = atomic_add_return(1, &xfer->wa->xfer_id_count);
42501+ xfer->id = atomic_add_return_unchecked(1, &xfer->wa->xfer_id_count);
42502 }
42503
42504 /*
42505diff -urNp linux-2.6.39/drivers/vhost/vhost.c linux-2.6.39/drivers/vhost/vhost.c
42506--- linux-2.6.39/drivers/vhost/vhost.c 2011-05-19 00:06:34.000000000 -0400
42507+++ linux-2.6.39/drivers/vhost/vhost.c 2011-05-22 19:36:32.000000000 -0400
42508@@ -580,7 +580,7 @@ static int init_used(struct vhost_virtqu
42509 return get_user(vq->last_used_idx, &used->idx);
42510 }
42511
42512-static long vhost_set_vring(struct vhost_dev *d, int ioctl, void __user *argp)
42513+static long vhost_set_vring(struct vhost_dev *d, unsigned int ioctl, void __user *argp)
42514 {
42515 struct file *eventfp, *filep = NULL,
42516 *pollstart = NULL, *pollstop = NULL;
42517diff -urNp linux-2.6.39/drivers/video/backlight/corgi_lcd.c linux-2.6.39/drivers/video/backlight/corgi_lcd.c
42518--- linux-2.6.39/drivers/video/backlight/corgi_lcd.c 2011-05-19 00:06:34.000000000 -0400
42519+++ linux-2.6.39/drivers/video/backlight/corgi_lcd.c 2011-05-22 19:36:32.000000000 -0400
42520@@ -383,7 +383,7 @@ static int corgi_lcd_get_power(struct lc
42521 return lcd->power;
42522 }
42523
42524-static struct lcd_ops corgi_lcd_ops = {
42525+static const struct lcd_ops corgi_lcd_ops = {
42526 .get_power = corgi_lcd_get_power,
42527 .set_power = corgi_lcd_set_power,
42528 .set_mode = corgi_lcd_set_mode,
42529diff -urNp linux-2.6.39/drivers/video/backlight/cr_bllcd.c linux-2.6.39/drivers/video/backlight/cr_bllcd.c
42530--- linux-2.6.39/drivers/video/backlight/cr_bllcd.c 2011-05-19 00:06:34.000000000 -0400
42531+++ linux-2.6.39/drivers/video/backlight/cr_bllcd.c 2011-05-22 19:36:32.000000000 -0400
42532@@ -165,7 +165,7 @@ static int cr_lcd_set_power(struct lcd_d
42533 return 0;
42534 }
42535
42536-static struct lcd_ops cr_lcd_ops = {
42537+static const struct lcd_ops cr_lcd_ops = {
42538 .set_power = cr_lcd_set_power,
42539 };
42540
42541diff -urNp linux-2.6.39/drivers/video/backlight/ili9320.c linux-2.6.39/drivers/video/backlight/ili9320.c
42542--- linux-2.6.39/drivers/video/backlight/ili9320.c 2011-05-19 00:06:34.000000000 -0400
42543+++ linux-2.6.39/drivers/video/backlight/ili9320.c 2011-05-22 19:36:32.000000000 -0400
42544@@ -166,7 +166,7 @@ static int ili9320_get_power(struct lcd_
42545 return lcd->power;
42546 }
42547
42548-static struct lcd_ops ili9320_ops = {
42549+static const struct lcd_ops ili9320_ops = {
42550 .get_power = ili9320_get_power,
42551 .set_power = ili9320_set_power,
42552 };
42553diff -urNp linux-2.6.39/drivers/video/backlight/jornada720_lcd.c linux-2.6.39/drivers/video/backlight/jornada720_lcd.c
42554--- linux-2.6.39/drivers/video/backlight/jornada720_lcd.c 2011-05-19 00:06:34.000000000 -0400
42555+++ linux-2.6.39/drivers/video/backlight/jornada720_lcd.c 2011-05-22 19:36:32.000000000 -0400
42556@@ -87,7 +87,7 @@ static int jornada_lcd_set_power(struct
42557 return 0;
42558 }
42559
42560-static struct lcd_ops jornada_lcd_props = {
42561+static const struct lcd_ops jornada_lcd_props = {
42562 .get_contrast = jornada_lcd_get_contrast,
42563 .set_contrast = jornada_lcd_set_contrast,
42564 .get_power = jornada_lcd_get_power,
42565diff -urNp linux-2.6.39/drivers/video/backlight/l4f00242t03.c linux-2.6.39/drivers/video/backlight/l4f00242t03.c
42566--- linux-2.6.39/drivers/video/backlight/l4f00242t03.c 2011-05-19 00:06:34.000000000 -0400
42567+++ linux-2.6.39/drivers/video/backlight/l4f00242t03.c 2011-05-22 19:36:32.000000000 -0400
42568@@ -149,7 +149,7 @@ static int l4f00242t03_lcd_power_set(str
42569 return 0;
42570 }
42571
42572-static struct lcd_ops l4f_ops = {
42573+static const struct lcd_ops l4f_ops = {
42574 .set_power = l4f00242t03_lcd_power_set,
42575 .get_power = l4f00242t03_lcd_power_get,
42576 };
42577diff -urNp linux-2.6.39/drivers/video/backlight/lcd.c linux-2.6.39/drivers/video/backlight/lcd.c
42578--- linux-2.6.39/drivers/video/backlight/lcd.c 2011-05-19 00:06:34.000000000 -0400
42579+++ linux-2.6.39/drivers/video/backlight/lcd.c 2011-05-22 19:36:32.000000000 -0400
42580@@ -192,7 +192,7 @@ static struct device_attribute lcd_devic
42581 * or a pointer to the newly allocated device.
42582 */
42583 struct lcd_device *lcd_device_register(const char *name, struct device *parent,
42584- void *devdata, struct lcd_ops *ops)
42585+ void *devdata, const struct lcd_ops *ops)
42586 {
42587 struct lcd_device *new_ld;
42588 int rc;
42589diff -urNp linux-2.6.39/drivers/video/backlight/ld9040.c linux-2.6.39/drivers/video/backlight/ld9040.c
42590--- linux-2.6.39/drivers/video/backlight/ld9040.c 2011-05-19 00:06:34.000000000 -0400
42591+++ linux-2.6.39/drivers/video/backlight/ld9040.c 2011-05-22 19:36:32.000000000 -0400
42592@@ -651,7 +651,7 @@ static int ld9040_set_brightness(struct
42593 return ret;
42594 }
42595
42596-static struct lcd_ops ld9040_lcd_ops = {
42597+static const struct lcd_ops ld9040_lcd_ops = {
42598 .set_power = ld9040_set_power,
42599 .get_power = ld9040_get_power,
42600 };
42601diff -urNp linux-2.6.39/drivers/video/backlight/lms283gf05.c linux-2.6.39/drivers/video/backlight/lms283gf05.c
42602--- linux-2.6.39/drivers/video/backlight/lms283gf05.c 2011-05-19 00:06:34.000000000 -0400
42603+++ linux-2.6.39/drivers/video/backlight/lms283gf05.c 2011-05-22 19:36:32.000000000 -0400
42604@@ -144,7 +144,7 @@ static int lms283gf05_power_set(struct l
42605 return 0;
42606 }
42607
42608-static struct lcd_ops lms_ops = {
42609+static const struct lcd_ops lms_ops = {
42610 .set_power = lms283gf05_power_set,
42611 .get_power = NULL,
42612 };
42613diff -urNp linux-2.6.39/drivers/video/backlight/ltv350qv.c linux-2.6.39/drivers/video/backlight/ltv350qv.c
42614--- linux-2.6.39/drivers/video/backlight/ltv350qv.c 2011-05-19 00:06:34.000000000 -0400
42615+++ linux-2.6.39/drivers/video/backlight/ltv350qv.c 2011-05-22 19:36:32.000000000 -0400
42616@@ -221,7 +221,7 @@ static int ltv350qv_get_power(struct lcd
42617 return lcd->power;
42618 }
42619
42620-static struct lcd_ops ltv_ops = {
42621+static const struct lcd_ops ltv_ops = {
42622 .get_power = ltv350qv_get_power,
42623 .set_power = ltv350qv_set_power,
42624 };
42625diff -urNp linux-2.6.39/drivers/video/backlight/platform_lcd.c linux-2.6.39/drivers/video/backlight/platform_lcd.c
42626--- linux-2.6.39/drivers/video/backlight/platform_lcd.c 2011-05-19 00:06:34.000000000 -0400
42627+++ linux-2.6.39/drivers/video/backlight/platform_lcd.c 2011-05-22 19:36:32.000000000 -0400
42628@@ -66,7 +66,7 @@ static int platform_lcd_match(struct lcd
42629 return plcd->us->parent == info->device;
42630 }
42631
42632-static struct lcd_ops platform_lcd_ops = {
42633+static const struct lcd_ops platform_lcd_ops = {
42634 .get_power = platform_lcd_get_power,
42635 .set_power = platform_lcd_set_power,
42636 .check_fb = platform_lcd_match,
42637diff -urNp linux-2.6.39/drivers/video/backlight/s6e63m0.c linux-2.6.39/drivers/video/backlight/s6e63m0.c
42638--- linux-2.6.39/drivers/video/backlight/s6e63m0.c 2011-05-19 00:06:34.000000000 -0400
42639+++ linux-2.6.39/drivers/video/backlight/s6e63m0.c 2011-05-22 19:36:32.000000000 -0400
42640@@ -644,7 +644,7 @@ static int s6e63m0_set_brightness(struct
42641 return ret;
42642 }
42643
42644-static struct lcd_ops s6e63m0_lcd_ops = {
42645+static const struct lcd_ops s6e63m0_lcd_ops = {
42646 .set_power = s6e63m0_set_power,
42647 .get_power = s6e63m0_get_power,
42648 };
42649diff -urNp linux-2.6.39/drivers/video/backlight/tdo24m.c linux-2.6.39/drivers/video/backlight/tdo24m.c
42650--- linux-2.6.39/drivers/video/backlight/tdo24m.c 2011-05-19 00:06:34.000000000 -0400
42651+++ linux-2.6.39/drivers/video/backlight/tdo24m.c 2011-05-22 19:36:32.000000000 -0400
42652@@ -322,7 +322,7 @@ static int tdo24m_set_mode(struct lcd_de
42653 return lcd->adj_mode(lcd, mode);
42654 }
42655
42656-static struct lcd_ops tdo24m_ops = {
42657+static const struct lcd_ops tdo24m_ops = {
42658 .get_power = tdo24m_get_power,
42659 .set_power = tdo24m_set_power,
42660 .set_mode = tdo24m_set_mode,
42661diff -urNp linux-2.6.39/drivers/video/backlight/tosa_lcd.c linux-2.6.39/drivers/video/backlight/tosa_lcd.c
42662--- linux-2.6.39/drivers/video/backlight/tosa_lcd.c 2011-05-19 00:06:34.000000000 -0400
42663+++ linux-2.6.39/drivers/video/backlight/tosa_lcd.c 2011-05-22 19:36:32.000000000 -0400
42664@@ -163,7 +163,7 @@ static int tosa_lcd_set_mode(struct lcd_
42665 return 0;
42666 }
42667
42668-static struct lcd_ops tosa_lcd_ops = {
42669+static const struct lcd_ops tosa_lcd_ops = {
42670 .set_power = tosa_lcd_set_power,
42671 .get_power = tosa_lcd_get_power,
42672 .set_mode = tosa_lcd_set_mode,
42673diff -urNp linux-2.6.39/drivers/video/bf537-lq035.c linux-2.6.39/drivers/video/bf537-lq035.c
42674--- linux-2.6.39/drivers/video/bf537-lq035.c 2011-05-19 00:06:34.000000000 -0400
42675+++ linux-2.6.39/drivers/video/bf537-lq035.c 2011-05-22 19:36:32.000000000 -0400
42676@@ -682,7 +682,7 @@ static int bfin_lcd_check_fb(struct lcd_
42677 return 0;
42678 }
42679
42680-static struct lcd_ops bfin_lcd_ops = {
42681+static const struct lcd_ops bfin_lcd_ops = {
42682 .get_power = bfin_lcd_get_power,
42683 .set_power = bfin_lcd_set_power,
42684 .get_contrast = bfin_lcd_get_contrast,
42685diff -urNp linux-2.6.39/drivers/video/bf54x-lq043fb.c linux-2.6.39/drivers/video/bf54x-lq043fb.c
42686--- linux-2.6.39/drivers/video/bf54x-lq043fb.c 2011-05-19 00:06:34.000000000 -0400
42687+++ linux-2.6.39/drivers/video/bf54x-lq043fb.c 2011-05-22 19:36:32.000000000 -0400
42688@@ -467,7 +467,7 @@ static int bfin_lcd_check_fb(struct lcd_
42689 return 0;
42690 }
42691
42692-static struct lcd_ops bfin_lcd_ops = {
42693+static const struct lcd_ops bfin_lcd_ops = {
42694 .get_power = bfin_lcd_get_power,
42695 .set_power = bfin_lcd_set_power,
42696 .get_contrast = bfin_lcd_get_contrast,
42697diff -urNp linux-2.6.39/drivers/video/bfin-t350mcqb-fb.c linux-2.6.39/drivers/video/bfin-t350mcqb-fb.c
42698--- linux-2.6.39/drivers/video/bfin-t350mcqb-fb.c 2011-05-19 00:06:34.000000000 -0400
42699+++ linux-2.6.39/drivers/video/bfin-t350mcqb-fb.c 2011-05-22 19:36:32.000000000 -0400
42700@@ -387,7 +387,7 @@ static int bfin_lcd_check_fb(struct lcd_
42701 return 0;
42702 }
42703
42704-static struct lcd_ops bfin_lcd_ops = {
42705+static const struct lcd_ops bfin_lcd_ops = {
42706 .get_power = bfin_lcd_get_power,
42707 .set_power = bfin_lcd_set_power,
42708 .get_contrast = bfin_lcd_get_contrast,
42709diff -urNp linux-2.6.39/drivers/video/fbcmap.c linux-2.6.39/drivers/video/fbcmap.c
42710--- linux-2.6.39/drivers/video/fbcmap.c 2011-05-19 00:06:34.000000000 -0400
42711+++ linux-2.6.39/drivers/video/fbcmap.c 2011-05-22 19:36:32.000000000 -0400
42712@@ -285,8 +285,7 @@ int fb_set_user_cmap(struct fb_cmap_user
42713 rc = -ENODEV;
42714 goto out;
42715 }
42716- if (cmap->start < 0 || (!info->fbops->fb_setcolreg &&
42717- !info->fbops->fb_setcmap)) {
42718+ if (!info->fbops->fb_setcolreg && !info->fbops->fb_setcmap) {
42719 rc = -EINVAL;
42720 goto out1;
42721 }
42722diff -urNp linux-2.6.39/drivers/video/fbmem.c linux-2.6.39/drivers/video/fbmem.c
42723--- linux-2.6.39/drivers/video/fbmem.c 2011-05-19 00:06:34.000000000 -0400
42724+++ linux-2.6.39/drivers/video/fbmem.c 2011-05-22 19:36:32.000000000 -0400
42725@@ -428,7 +428,7 @@ static void fb_do_show_logo(struct fb_in
42726 image->dx += image->width + 8;
42727 }
42728 } else if (rotate == FB_ROTATE_UD) {
42729- for (x = 0; x < num && image->dx >= 0; x++) {
42730+ for (x = 0; x < num && (__s32)image->dx >= 0; x++) {
42731 info->fbops->fb_imageblit(info, image);
42732 image->dx -= image->width + 8;
42733 }
42734@@ -440,7 +440,7 @@ static void fb_do_show_logo(struct fb_in
42735 image->dy += image->height + 8;
42736 }
42737 } else if (rotate == FB_ROTATE_CCW) {
42738- for (x = 0; x < num && image->dy >= 0; x++) {
42739+ for (x = 0; x < num && (__s32)image->dy >= 0; x++) {
42740 info->fbops->fb_imageblit(info, image);
42741 image->dy -= image->height + 8;
42742 }
42743@@ -939,6 +939,8 @@ fb_set_var(struct fb_info *info, struct
42744 int flags = info->flags;
42745 int ret = 0;
42746
42747+ pax_track_stack();
42748+
42749 if (var->activate & FB_ACTIVATE_INV_MODE) {
42750 struct fb_videomode mode1, mode2;
42751
42752@@ -1064,6 +1066,8 @@ static long do_fb_ioctl(struct fb_info *
42753 void __user *argp = (void __user *)arg;
42754 long ret = 0;
42755
42756+ pax_track_stack();
42757+
42758 switch (cmd) {
42759 case FBIOGET_VSCREENINFO:
42760 if (!lock_fb_info(info))
42761@@ -1143,7 +1147,7 @@ static long do_fb_ioctl(struct fb_info *
42762 return -EFAULT;
42763 if (con2fb.console < 1 || con2fb.console > MAX_NR_CONSOLES)
42764 return -EINVAL;
42765- if (con2fb.framebuffer < 0 || con2fb.framebuffer >= FB_MAX)
42766+ if (con2fb.framebuffer >= FB_MAX)
42767 return -EINVAL;
42768 if (!registered_fb[con2fb.framebuffer])
42769 request_module("fb%d", con2fb.framebuffer);
42770diff -urNp linux-2.6.39/drivers/video/geode/display_gx1.c linux-2.6.39/drivers/video/geode/display_gx1.c
42771--- linux-2.6.39/drivers/video/geode/display_gx1.c 2011-05-19 00:06:34.000000000 -0400
42772+++ linux-2.6.39/drivers/video/geode/display_gx1.c 2011-05-22 19:36:32.000000000 -0400
42773@@ -208,7 +208,7 @@ static void gx1_set_hw_palette_reg(struc
42774 writel(val, par->dc_regs + DC_PAL_DATA);
42775 }
42776
42777-struct geode_dc_ops gx1_dc_ops = {
42778+const struct geode_dc_ops gx1_dc_ops = {
42779 .set_mode = gx1_set_mode,
42780 .set_palette_reg = gx1_set_hw_palette_reg,
42781 };
42782diff -urNp linux-2.6.39/drivers/video/geode/display_gx1.h linux-2.6.39/drivers/video/geode/display_gx1.h
42783--- linux-2.6.39/drivers/video/geode/display_gx1.h 2011-05-19 00:06:34.000000000 -0400
42784+++ linux-2.6.39/drivers/video/geode/display_gx1.h 2011-05-22 19:36:32.000000000 -0400
42785@@ -18,7 +18,7 @@
42786 unsigned gx1_gx_base(void);
42787 int gx1_frame_buffer_size(void);
42788
42789-extern struct geode_dc_ops gx1_dc_ops;
42790+extern const struct geode_dc_ops gx1_dc_ops;
42791
42792 /* GX1 configuration I/O registers */
42793
42794diff -urNp linux-2.6.39/drivers/video/geode/geodefb.h linux-2.6.39/drivers/video/geode/geodefb.h
42795--- linux-2.6.39/drivers/video/geode/geodefb.h 2011-05-19 00:06:34.000000000 -0400
42796+++ linux-2.6.39/drivers/video/geode/geodefb.h 2011-05-22 19:36:32.000000000 -0400
42797@@ -31,8 +31,8 @@ struct geodefb_par {
42798 int panel_y;
42799 void __iomem *dc_regs;
42800 void __iomem *vid_regs;
42801- struct geode_dc_ops *dc_ops;
42802- struct geode_vid_ops *vid_ops;
42803+ const struct geode_dc_ops *dc_ops;
42804+ const struct geode_vid_ops *vid_ops;
42805 };
42806
42807 #endif /* !__GEODEFB_H__ */
42808diff -urNp linux-2.6.39/drivers/video/geode/video_cs5530.c linux-2.6.39/drivers/video/geode/video_cs5530.c
42809--- linux-2.6.39/drivers/video/geode/video_cs5530.c 2011-05-19 00:06:34.000000000 -0400
42810+++ linux-2.6.39/drivers/video/geode/video_cs5530.c 2011-05-22 19:36:32.000000000 -0400
42811@@ -186,7 +186,7 @@ static int cs5530_blank_display(struct f
42812 return 0;
42813 }
42814
42815-struct geode_vid_ops cs5530_vid_ops = {
42816+const struct geode_vid_ops cs5530_vid_ops = {
42817 .set_dclk = cs5530_set_dclk_frequency,
42818 .configure_display = cs5530_configure_display,
42819 .blank_display = cs5530_blank_display,
42820diff -urNp linux-2.6.39/drivers/video/geode/video_cs5530.h linux-2.6.39/drivers/video/geode/video_cs5530.h
42821--- linux-2.6.39/drivers/video/geode/video_cs5530.h 2011-05-19 00:06:34.000000000 -0400
42822+++ linux-2.6.39/drivers/video/geode/video_cs5530.h 2011-05-22 19:36:32.000000000 -0400
42823@@ -15,7 +15,7 @@
42824 #ifndef __VIDEO_CS5530_H__
42825 #define __VIDEO_CS5530_H__
42826
42827-extern struct geode_vid_ops cs5530_vid_ops;
42828+extern const struct geode_vid_ops cs5530_vid_ops;
42829
42830 /* CS5530 Video device registers */
42831
42832diff -urNp linux-2.6.39/drivers/video/i810/i810_accel.c linux-2.6.39/drivers/video/i810/i810_accel.c
42833--- linux-2.6.39/drivers/video/i810/i810_accel.c 2011-05-19 00:06:34.000000000 -0400
42834+++ linux-2.6.39/drivers/video/i810/i810_accel.c 2011-05-22 19:36:32.000000000 -0400
42835@@ -73,6 +73,7 @@ static inline int wait_for_space(struct
42836 }
42837 }
42838 printk("ringbuffer lockup!!!\n");
42839+ printk("head:%u tail:%u iring.size:%u space:%u\n", head, tail, par->iring.size, space);
42840 i810_report_error(mmio);
42841 par->dev_flags |= LOCKUP;
42842 info->pixmap.scan_align = 1;
42843diff -urNp linux-2.6.39/drivers/video/matrox/matroxfb_base.c linux-2.6.39/drivers/video/matrox/matroxfb_base.c
42844--- linux-2.6.39/drivers/video/matrox/matroxfb_base.c 2011-05-19 00:06:34.000000000 -0400
42845+++ linux-2.6.39/drivers/video/matrox/matroxfb_base.c 2011-05-22 19:36:32.000000000 -0400
42846@@ -1232,7 +1232,7 @@ static struct fb_ops matroxfb_ops = {
42847 #define RSText 0x7
42848 #define RSText8 0x8
42849 /* 9-F */
42850-static struct { struct fb_bitfield red, green, blue, transp; int bits_per_pixel; } colors[] = {
42851+static const struct { struct fb_bitfield red, green, blue, transp; int bits_per_pixel; } colors[] = {
42852 { { 0, 8, 0}, { 0, 8, 0}, { 0, 8, 0}, { 0, 0, 0}, 8 },
42853 { { 10, 5, 0}, { 5, 5, 0}, { 0, 5, 0}, { 15, 1, 0}, 16 },
42854 { { 11, 5, 0}, { 5, 6, 0}, { 0, 5, 0}, { 0, 0, 0}, 16 },
42855diff -urNp linux-2.6.39/drivers/video/omap/lcd_ams_delta.c linux-2.6.39/drivers/video/omap/lcd_ams_delta.c
42856--- linux-2.6.39/drivers/video/omap/lcd_ams_delta.c 2011-05-19 00:06:34.000000000 -0400
42857+++ linux-2.6.39/drivers/video/omap/lcd_ams_delta.c 2011-05-22 19:36:32.000000000 -0400
42858@@ -87,7 +87,7 @@ static int ams_delta_lcd_get_contrast(st
42859 return ams_delta_lcd & AMS_DELTA_MAX_CONTRAST;
42860 }
42861
42862-static struct lcd_ops ams_delta_lcd_ops = {
42863+static const struct lcd_ops ams_delta_lcd_ops = {
42864 .get_power = ams_delta_lcd_get_power,
42865 .set_power = ams_delta_lcd_set_power,
42866 .get_contrast = ams_delta_lcd_get_contrast,
42867diff -urNp linux-2.6.39/drivers/video/pxa3xx-gcu.c linux-2.6.39/drivers/video/pxa3xx-gcu.c
42868--- linux-2.6.39/drivers/video/pxa3xx-gcu.c 2011-05-19 00:06:34.000000000 -0400
42869+++ linux-2.6.39/drivers/video/pxa3xx-gcu.c 2011-05-22 19:36:32.000000000 -0400
42870@@ -103,7 +103,7 @@ struct pxa3xx_gcu_priv {
42871 dma_addr_t shared_phys;
42872 struct resource *resource_mem;
42873 struct miscdevice misc_dev;
42874- struct file_operations misc_fops;
42875+ const struct file_operations misc_fops;
42876 wait_queue_head_t wait_idle;
42877 wait_queue_head_t wait_free;
42878 spinlock_t spinlock;
42879diff -urNp linux-2.6.39/drivers/video/sh_mobile_lcdcfb.c linux-2.6.39/drivers/video/sh_mobile_lcdcfb.c
42880--- linux-2.6.39/drivers/video/sh_mobile_lcdcfb.c 2011-05-19 00:06:34.000000000 -0400
42881+++ linux-2.6.39/drivers/video/sh_mobile_lcdcfb.c 2011-05-22 19:36:32.000000000 -0400
42882@@ -245,7 +245,7 @@ static unsigned long lcdc_sys_read_data(
42883 return lcdc_read(ch->lcdc, _LDDRDR) & 0x3ffff;
42884 }
42885
42886-struct sh_mobile_lcdc_sys_bus_ops sh_mobile_lcdc_sys_bus_ops = {
42887+const struct sh_mobile_lcdc_sys_bus_ops sh_mobile_lcdc_sys_bus_ops = {
42888 lcdc_sys_write_index,
42889 lcdc_sys_write_data,
42890 lcdc_sys_read_data,
42891diff -urNp linux-2.6.39/drivers/video/udlfb.c linux-2.6.39/drivers/video/udlfb.c
42892--- linux-2.6.39/drivers/video/udlfb.c 2011-05-19 00:06:34.000000000 -0400
42893+++ linux-2.6.39/drivers/video/udlfb.c 2011-05-22 19:36:32.000000000 -0400
42894@@ -584,11 +584,11 @@ int dlfb_handle_damage(struct dlfb_data
42895 dlfb_urb_completion(urb);
42896
42897 error:
42898- atomic_add(bytes_sent, &dev->bytes_sent);
42899- atomic_add(bytes_identical, &dev->bytes_identical);
42900- atomic_add(width*height*2, &dev->bytes_rendered);
42901+ atomic_add_unchecked(bytes_sent, &dev->bytes_sent);
42902+ atomic_add_unchecked(bytes_identical, &dev->bytes_identical);
42903+ atomic_add_unchecked(width*height*2, &dev->bytes_rendered);
42904 end_cycles = get_cycles();
42905- atomic_add(((unsigned int) ((end_cycles - start_cycles)
42906+ atomic_add_unchecked(((unsigned int) ((end_cycles - start_cycles)
42907 >> 10)), /* Kcycles */
42908 &dev->cpu_kcycles_used);
42909
42910@@ -709,11 +709,11 @@ static void dlfb_dpy_deferred_io(struct
42911 dlfb_urb_completion(urb);
42912
42913 error:
42914- atomic_add(bytes_sent, &dev->bytes_sent);
42915- atomic_add(bytes_identical, &dev->bytes_identical);
42916- atomic_add(bytes_rendered, &dev->bytes_rendered);
42917+ atomic_add_unchecked(bytes_sent, &dev->bytes_sent);
42918+ atomic_add_unchecked(bytes_identical, &dev->bytes_identical);
42919+ atomic_add_unchecked(bytes_rendered, &dev->bytes_rendered);
42920 end_cycles = get_cycles();
42921- atomic_add(((unsigned int) ((end_cycles - start_cycles)
42922+ atomic_add_unchecked(((unsigned int) ((end_cycles - start_cycles)
42923 >> 10)), /* Kcycles */
42924 &dev->cpu_kcycles_used);
42925 }
42926@@ -1301,7 +1301,7 @@ static ssize_t metrics_bytes_rendered_sh
42927 struct fb_info *fb_info = dev_get_drvdata(fbdev);
42928 struct dlfb_data *dev = fb_info->par;
42929 return snprintf(buf, PAGE_SIZE, "%u\n",
42930- atomic_read(&dev->bytes_rendered));
42931+ atomic_read_unchecked(&dev->bytes_rendered));
42932 }
42933
42934 static ssize_t metrics_bytes_identical_show(struct device *fbdev,
42935@@ -1309,7 +1309,7 @@ static ssize_t metrics_bytes_identical_s
42936 struct fb_info *fb_info = dev_get_drvdata(fbdev);
42937 struct dlfb_data *dev = fb_info->par;
42938 return snprintf(buf, PAGE_SIZE, "%u\n",
42939- atomic_read(&dev->bytes_identical));
42940+ atomic_read_unchecked(&dev->bytes_identical));
42941 }
42942
42943 static ssize_t metrics_bytes_sent_show(struct device *fbdev,
42944@@ -1317,7 +1317,7 @@ static ssize_t metrics_bytes_sent_show(s
42945 struct fb_info *fb_info = dev_get_drvdata(fbdev);
42946 struct dlfb_data *dev = fb_info->par;
42947 return snprintf(buf, PAGE_SIZE, "%u\n",
42948- atomic_read(&dev->bytes_sent));
42949+ atomic_read_unchecked(&dev->bytes_sent));
42950 }
42951
42952 static ssize_t metrics_cpu_kcycles_used_show(struct device *fbdev,
42953@@ -1325,7 +1325,7 @@ static ssize_t metrics_cpu_kcycles_used_
42954 struct fb_info *fb_info = dev_get_drvdata(fbdev);
42955 struct dlfb_data *dev = fb_info->par;
42956 return snprintf(buf, PAGE_SIZE, "%u\n",
42957- atomic_read(&dev->cpu_kcycles_used));
42958+ atomic_read_unchecked(&dev->cpu_kcycles_used));
42959 }
42960
42961 static ssize_t edid_show(
42962@@ -1382,10 +1382,10 @@ static ssize_t metrics_reset_store(struc
42963 struct fb_info *fb_info = dev_get_drvdata(fbdev);
42964 struct dlfb_data *dev = fb_info->par;
42965
42966- atomic_set(&dev->bytes_rendered, 0);
42967- atomic_set(&dev->bytes_identical, 0);
42968- atomic_set(&dev->bytes_sent, 0);
42969- atomic_set(&dev->cpu_kcycles_used, 0);
42970+ atomic_set_unchecked(&dev->bytes_rendered, 0);
42971+ atomic_set_unchecked(&dev->bytes_identical, 0);
42972+ atomic_set_unchecked(&dev->bytes_sent, 0);
42973+ atomic_set_unchecked(&dev->cpu_kcycles_used, 0);
42974
42975 return count;
42976 }
42977diff -urNp linux-2.6.39/drivers/video/uvesafb.c linux-2.6.39/drivers/video/uvesafb.c
42978--- linux-2.6.39/drivers/video/uvesafb.c 2011-05-19 00:06:34.000000000 -0400
42979+++ linux-2.6.39/drivers/video/uvesafb.c 2011-05-22 19:36:32.000000000 -0400
42980@@ -19,6 +19,7 @@
42981 #include <linux/io.h>
42982 #include <linux/mutex.h>
42983 #include <linux/slab.h>
42984+#include <linux/moduleloader.h>
42985 #include <video/edid.h>
42986 #include <video/uvesafb.h>
42987 #ifdef CONFIG_X86
42988@@ -121,7 +122,7 @@ static int uvesafb_helper_start(void)
42989 NULL,
42990 };
42991
42992- return call_usermodehelper(v86d_path, argv, envp, 1);
42993+ return call_usermodehelper(v86d_path, argv, envp, UMH_WAIT_PROC);
42994 }
42995
42996 /*
42997@@ -569,10 +570,32 @@ static int __devinit uvesafb_vbe_getpmi(
42998 if ((task->t.regs.eax & 0xffff) != 0x4f || task->t.regs.es < 0xc000) {
42999 par->pmi_setpal = par->ypan = 0;
43000 } else {
43001+
43002+#ifdef CONFIG_PAX_KERNEXEC
43003+#ifdef CONFIG_MODULES
43004+ par->pmi_code = module_alloc_exec((u16)task->t.regs.ecx);
43005+#endif
43006+ if (!par->pmi_code) {
43007+ par->pmi_setpal = par->ypan = 0;
43008+ return 0;
43009+ }
43010+#endif
43011+
43012 par->pmi_base = (u16 *)phys_to_virt(((u32)task->t.regs.es << 4)
43013 + task->t.regs.edi);
43014+
43015+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
43016+ pax_open_kernel();
43017+ memcpy(par->pmi_code, par->pmi_base, (u16)task->t.regs.ecx);
43018+ pax_close_kernel();
43019+
43020+ par->pmi_start = ktva_ktla(par->pmi_code + par->pmi_base[1]);
43021+ par->pmi_pal = ktva_ktla(par->pmi_code + par->pmi_base[2]);
43022+#else
43023 par->pmi_start = (u8 *)par->pmi_base + par->pmi_base[1];
43024 par->pmi_pal = (u8 *)par->pmi_base + par->pmi_base[2];
43025+#endif
43026+
43027 printk(KERN_INFO "uvesafb: protected mode interface info at "
43028 "%04x:%04x\n",
43029 (u16)task->t.regs.es, (u16)task->t.regs.edi);
43030@@ -1821,6 +1844,11 @@ out:
43031 if (par->vbe_modes)
43032 kfree(par->vbe_modes);
43033
43034+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
43035+ if (par->pmi_code)
43036+ module_free_exec(NULL, par->pmi_code);
43037+#endif
43038+
43039 framebuffer_release(info);
43040 return err;
43041 }
43042@@ -1847,6 +1875,12 @@ static int uvesafb_remove(struct platfor
43043 kfree(par->vbe_state_orig);
43044 if (par->vbe_state_saved)
43045 kfree(par->vbe_state_saved);
43046+
43047+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
43048+ if (par->pmi_code)
43049+ module_free_exec(NULL, par->pmi_code);
43050+#endif
43051+
43052 }
43053
43054 framebuffer_release(info);
43055@@ -2013,7 +2047,7 @@ static int param_set_scroll(const char *
43056
43057 return 0;
43058 }
43059-static struct kernel_param_ops param_ops_scroll = {
43060+static const struct kernel_param_ops param_ops_scroll = {
43061 .set = param_set_scroll,
43062 };
43063 #define param_check_scroll(name, p) __param_check(name, p, void)
43064diff -urNp linux-2.6.39/drivers/video/vesafb.c linux-2.6.39/drivers/video/vesafb.c
43065--- linux-2.6.39/drivers/video/vesafb.c 2011-05-19 00:06:34.000000000 -0400
43066+++ linux-2.6.39/drivers/video/vesafb.c 2011-05-22 19:36:32.000000000 -0400
43067@@ -9,6 +9,7 @@
43068 */
43069
43070 #include <linux/module.h>
43071+#include <linux/moduleloader.h>
43072 #include <linux/kernel.h>
43073 #include <linux/errno.h>
43074 #include <linux/string.h>
43075@@ -52,8 +53,8 @@ static int vram_remap __initdata; /*
43076 static int vram_total __initdata; /* Set total amount of memory */
43077 static int pmi_setpal __read_mostly = 1; /* pmi for palette changes ??? */
43078 static int ypan __read_mostly; /* 0..nothing, 1..ypan, 2..ywrap */
43079-static void (*pmi_start)(void) __read_mostly;
43080-static void (*pmi_pal) (void) __read_mostly;
43081+static void (*pmi_start)(void) __read_only;
43082+static void (*pmi_pal) (void) __read_only;
43083 static int depth __read_mostly;
43084 static int vga_compat __read_mostly;
43085 /* --------------------------------------------------------------------- */
43086@@ -232,6 +233,7 @@ static int __init vesafb_probe(struct pl
43087 unsigned int size_vmode;
43088 unsigned int size_remap;
43089 unsigned int size_total;
43090+ void *pmi_code = NULL;
43091
43092 if (screen_info.orig_video_isVGA != VIDEO_TYPE_VLFB)
43093 return -ENODEV;
43094@@ -274,10 +276,6 @@ static int __init vesafb_probe(struct pl
43095 size_remap = size_total;
43096 vesafb_fix.smem_len = size_remap;
43097
43098-#ifndef __i386__
43099- screen_info.vesapm_seg = 0;
43100-#endif
43101-
43102 if (!request_mem_region(vesafb_fix.smem_start, size_total, "vesafb")) {
43103 printk(KERN_WARNING
43104 "vesafb: cannot reserve video memory at 0x%lx\n",
43105@@ -306,9 +304,21 @@ static int __init vesafb_probe(struct pl
43106 printk(KERN_INFO "vesafb: mode is %dx%dx%d, linelength=%d, pages=%d\n",
43107 vesafb_defined.xres, vesafb_defined.yres, vesafb_defined.bits_per_pixel, vesafb_fix.line_length, screen_info.pages);
43108
43109+#ifdef __i386__
43110+
43111+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
43112+ pmi_code = module_alloc_exec(screen_info.vesapm_size);
43113+ if (!pmi_code)
43114+#elif !defined(CONFIG_PAX_KERNEXEC)
43115+ if (0)
43116+#endif
43117+
43118+#endif
43119+ screen_info.vesapm_seg = 0;
43120+
43121 if (screen_info.vesapm_seg) {
43122- printk(KERN_INFO "vesafb: protected mode interface info at %04x:%04x\n",
43123- screen_info.vesapm_seg,screen_info.vesapm_off);
43124+ printk(KERN_INFO "vesafb: protected mode interface info at %04x:%04x %04x bytes\n",
43125+ screen_info.vesapm_seg,screen_info.vesapm_off,screen_info.vesapm_size);
43126 }
43127
43128 if (screen_info.vesapm_seg < 0xc000)
43129@@ -316,9 +326,25 @@ static int __init vesafb_probe(struct pl
43130
43131 if (ypan || pmi_setpal) {
43132 unsigned short *pmi_base;
43133- pmi_base = (unsigned short*)phys_to_virt(((unsigned long)screen_info.vesapm_seg << 4) + screen_info.vesapm_off);
43134- pmi_start = (void*)((char*)pmi_base + pmi_base[1]);
43135- pmi_pal = (void*)((char*)pmi_base + pmi_base[2]);
43136+
43137+ pmi_base = (unsigned short*)phys_to_virt(((unsigned long)screen_info.vesapm_seg << 4) + screen_info.vesapm_off);
43138+
43139+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
43140+ pax_open_kernel();
43141+ memcpy(pmi_code, pmi_base, screen_info.vesapm_size);
43142+#else
43143+ pmi_code = pmi_base;
43144+#endif
43145+
43146+ pmi_start = (void*)((char*)pmi_code + pmi_base[1]);
43147+ pmi_pal = (void*)((char*)pmi_code + pmi_base[2]);
43148+
43149+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
43150+ pmi_start = ktva_ktla(pmi_start);
43151+ pmi_pal = ktva_ktla(pmi_pal);
43152+ pax_close_kernel();
43153+#endif
43154+
43155 printk(KERN_INFO "vesafb: pmi: set display start = %p, set palette = %p\n",pmi_start,pmi_pal);
43156 if (pmi_base[3]) {
43157 printk(KERN_INFO "vesafb: pmi: ports = ");
43158@@ -487,6 +513,11 @@ static int __init vesafb_probe(struct pl
43159 info->node, info->fix.id);
43160 return 0;
43161 err:
43162+
43163+#if defined(__i386__) && defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
43164+ module_free_exec(NULL, pmi_code);
43165+#endif
43166+
43167 if (info->screen_base)
43168 iounmap(info->screen_base);
43169 framebuffer_release(info);
43170diff -urNp linux-2.6.39/drivers/virtio/virtio_balloon.c linux-2.6.39/drivers/virtio/virtio_balloon.c
43171--- linux-2.6.39/drivers/virtio/virtio_balloon.c 2011-05-19 00:06:34.000000000 -0400
43172+++ linux-2.6.39/drivers/virtio/virtio_balloon.c 2011-05-22 19:36:32.000000000 -0400
43173@@ -176,6 +176,8 @@ static void update_balloon_stats(struct
43174 struct sysinfo i;
43175 int idx = 0;
43176
43177+ pax_track_stack();
43178+
43179 all_vm_events(events);
43180 si_meminfo(&i);
43181
43182diff -urNp linux-2.6.39/drivers/xen/gntalloc.c linux-2.6.39/drivers/xen/gntalloc.c
43183--- linux-2.6.39/drivers/xen/gntalloc.c 2011-05-19 00:06:34.000000000 -0400
43184+++ linux-2.6.39/drivers/xen/gntalloc.c 2011-05-22 19:36:32.000000000 -0400
43185@@ -440,7 +440,7 @@ static void gntalloc_vma_close(struct vm
43186 spin_unlock(&gref_lock);
43187 }
43188
43189-static struct vm_operations_struct gntalloc_vmops = {
43190+static const struct vm_operations_struct gntalloc_vmops = {
43191 .close = gntalloc_vma_close,
43192 };
43193
43194diff -urNp linux-2.6.39/drivers/xen/gntdev.c linux-2.6.39/drivers/xen/gntdev.c
43195--- linux-2.6.39/drivers/xen/gntdev.c 2011-05-19 00:06:34.000000000 -0400
43196+++ linux-2.6.39/drivers/xen/gntdev.c 2011-05-22 19:36:32.000000000 -0400
43197@@ -340,7 +340,7 @@ static void gntdev_vma_close(struct vm_a
43198 gntdev_put_map(map);
43199 }
43200
43201-static struct vm_operations_struct gntdev_vmops = {
43202+static const struct vm_operations_struct gntdev_vmops = {
43203 .close = gntdev_vma_close,
43204 };
43205
43206@@ -404,7 +404,7 @@ static void mn_release(struct mmu_notifi
43207 spin_unlock(&priv->lock);
43208 }
43209
43210-struct mmu_notifier_ops gntdev_mmu_ops = {
43211+const struct mmu_notifier_ops gntdev_mmu_ops = {
43212 .release = mn_release,
43213 .invalidate_page = mn_invl_page,
43214 .invalidate_range_start = mn_invl_range_start,
43215diff -urNp linux-2.6.39/drivers/xen/xenfs/privcmd.c linux-2.6.39/drivers/xen/xenfs/privcmd.c
43216--- linux-2.6.39/drivers/xen/xenfs/privcmd.c 2011-05-19 00:06:34.000000000 -0400
43217+++ linux-2.6.39/drivers/xen/xenfs/privcmd.c 2011-05-22 19:36:32.000000000 -0400
43218@@ -268,7 +268,7 @@ static int mmap_return_errors(void *data
43219 return put_user(*mfnp, st->user++);
43220 }
43221
43222-static struct vm_operations_struct privcmd_vm_ops;
43223+static const struct vm_operations_struct privcmd_vm_ops;
43224
43225 static long privcmd_ioctl_mmap_batch(void __user *udata)
43226 {
43227@@ -369,7 +369,7 @@ static int privcmd_fault(struct vm_area_
43228 return VM_FAULT_SIGBUS;
43229 }
43230
43231-static struct vm_operations_struct privcmd_vm_ops = {
43232+static const struct vm_operations_struct privcmd_vm_ops = {
43233 .fault = privcmd_fault
43234 };
43235
43236diff -urNp linux-2.6.39/fs/9p/vfs_inode.c linux-2.6.39/fs/9p/vfs_inode.c
43237--- linux-2.6.39/fs/9p/vfs_inode.c 2011-05-19 00:06:34.000000000 -0400
43238+++ linux-2.6.39/fs/9p/vfs_inode.c 2011-05-22 19:36:32.000000000 -0400
43239@@ -1210,7 +1210,7 @@ static void *v9fs_vfs_follow_link(struct
43240 void
43241 v9fs_vfs_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
43242 {
43243- char *s = nd_get_link(nd);
43244+ const char *s = nd_get_link(nd);
43245
43246 P9_DPRINTK(P9_DEBUG_VFS, " %s %s\n", dentry->d_name.name,
43247 IS_ERR(s) ? "<error>" : s);
43248diff -urNp linux-2.6.39/fs/aio.c linux-2.6.39/fs/aio.c
43249--- linux-2.6.39/fs/aio.c 2011-05-19 00:06:34.000000000 -0400
43250+++ linux-2.6.39/fs/aio.c 2011-05-22 19:36:32.000000000 -0400
43251@@ -119,7 +119,7 @@ static int aio_setup_ring(struct kioctx
43252 size += sizeof(struct io_event) * nr_events;
43253 nr_pages = (size + PAGE_SIZE-1) >> PAGE_SHIFT;
43254
43255- if (nr_pages < 0)
43256+ if (nr_pages <= 0)
43257 return -EINVAL;
43258
43259 nr_events = (PAGE_SIZE * nr_pages - sizeof(struct aio_ring)) / sizeof(struct io_event);
43260@@ -1088,6 +1088,8 @@ static int read_events(struct kioctx *ct
43261 struct aio_timeout to;
43262 int retry = 0;
43263
43264+ pax_track_stack();
43265+
43266 /* needed to zero any padding within an entry (there shouldn't be
43267 * any, but C is fun!
43268 */
43269diff -urNp linux-2.6.39/fs/attr.c linux-2.6.39/fs/attr.c
43270--- linux-2.6.39/fs/attr.c 2011-05-19 00:06:34.000000000 -0400
43271+++ linux-2.6.39/fs/attr.c 2011-05-22 19:41:37.000000000 -0400
43272@@ -98,6 +98,7 @@ int inode_newsize_ok(const struct inode
43273 unsigned long limit;
43274
43275 limit = rlimit(RLIMIT_FSIZE);
43276+ gr_learn_resource(current, RLIMIT_FSIZE, (unsigned long)offset, 1);
43277 if (limit != RLIM_INFINITY && offset > limit)
43278 goto out_sig;
43279 if (offset > inode->i_sb->s_maxbytes)
43280diff -urNp linux-2.6.39/fs/befs/linuxvfs.c linux-2.6.39/fs/befs/linuxvfs.c
43281--- linux-2.6.39/fs/befs/linuxvfs.c 2011-05-19 00:06:34.000000000 -0400
43282+++ linux-2.6.39/fs/befs/linuxvfs.c 2011-05-22 19:36:32.000000000 -0400
43283@@ -498,7 +498,7 @@ static void befs_put_link(struct dentry
43284 {
43285 befs_inode_info *befs_ino = BEFS_I(dentry->d_inode);
43286 if (befs_ino->i_flags & BEFS_LONG_SYMLINK) {
43287- char *link = nd_get_link(nd);
43288+ const char *link = nd_get_link(nd);
43289 if (!IS_ERR(link))
43290 kfree(link);
43291 }
43292diff -urNp linux-2.6.39/fs/binfmt_aout.c linux-2.6.39/fs/binfmt_aout.c
43293--- linux-2.6.39/fs/binfmt_aout.c 2011-05-19 00:06:34.000000000 -0400
43294+++ linux-2.6.39/fs/binfmt_aout.c 2011-05-22 19:41:37.000000000 -0400
43295@@ -16,6 +16,7 @@
43296 #include <linux/string.h>
43297 #include <linux/fs.h>
43298 #include <linux/file.h>
43299+#include <linux/security.h>
43300 #include <linux/stat.h>
43301 #include <linux/fcntl.h>
43302 #include <linux/ptrace.h>
43303@@ -86,6 +87,8 @@ static int aout_core_dump(struct coredum
43304 #endif
43305 # define START_STACK(u) ((void __user *)u.start_stack)
43306
43307+ memset(&dump, 0, sizeof(dump));
43308+
43309 fs = get_fs();
43310 set_fs(KERNEL_DS);
43311 has_dumped = 1;
43312@@ -97,10 +100,12 @@ static int aout_core_dump(struct coredum
43313
43314 /* If the size of the dump file exceeds the rlimit, then see what would happen
43315 if we wrote the stack, but not the data area. */
43316+ gr_learn_resource(current, RLIMIT_CORE, (dump.u_dsize + dump.u_ssize+1) * PAGE_SIZE, 1);
43317 if ((dump.u_dsize + dump.u_ssize+1) * PAGE_SIZE > cprm->limit)
43318 dump.u_dsize = 0;
43319
43320 /* Make sure we have enough room to write the stack and data areas. */
43321+ gr_learn_resource(current, RLIMIT_CORE, (dump.u_ssize + 1) * PAGE_SIZE, 1);
43322 if ((dump.u_ssize + 1) * PAGE_SIZE > cprm->limit)
43323 dump.u_ssize = 0;
43324
43325@@ -234,6 +239,8 @@ static int load_aout_binary(struct linux
43326 rlim = rlimit(RLIMIT_DATA);
43327 if (rlim >= RLIM_INFINITY)
43328 rlim = ~0;
43329+
43330+ gr_learn_resource(current, RLIMIT_DATA, ex.a_data + ex.a_bss, 1);
43331 if (ex.a_data + ex.a_bss > rlim)
43332 return -ENOMEM;
43333
43334@@ -262,6 +269,27 @@ static int load_aout_binary(struct linux
43335 install_exec_creds(bprm);
43336 current->flags &= ~PF_FORKNOEXEC;
43337
43338+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
43339+ current->mm->pax_flags = 0UL;
43340+#endif
43341+
43342+#ifdef CONFIG_PAX_PAGEEXEC
43343+ if (!(N_FLAGS(ex) & F_PAX_PAGEEXEC)) {
43344+ current->mm->pax_flags |= MF_PAX_PAGEEXEC;
43345+
43346+#ifdef CONFIG_PAX_EMUTRAMP
43347+ if (N_FLAGS(ex) & F_PAX_EMUTRAMP)
43348+ current->mm->pax_flags |= MF_PAX_EMUTRAMP;
43349+#endif
43350+
43351+#ifdef CONFIG_PAX_MPROTECT
43352+ if (!(N_FLAGS(ex) & F_PAX_MPROTECT))
43353+ current->mm->pax_flags |= MF_PAX_MPROTECT;
43354+#endif
43355+
43356+ }
43357+#endif
43358+
43359 if (N_MAGIC(ex) == OMAGIC) {
43360 unsigned long text_addr, map_size;
43361 loff_t pos;
43362@@ -334,7 +362,7 @@ static int load_aout_binary(struct linux
43363
43364 down_write(&current->mm->mmap_sem);
43365 error = do_mmap(bprm->file, N_DATADDR(ex), ex.a_data,
43366- PROT_READ | PROT_WRITE | PROT_EXEC,
43367+ PROT_READ | PROT_WRITE,
43368 MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE | MAP_EXECUTABLE,
43369 fd_offset + ex.a_text);
43370 up_write(&current->mm->mmap_sem);
43371diff -urNp linux-2.6.39/fs/binfmt_elf.c linux-2.6.39/fs/binfmt_elf.c
43372--- linux-2.6.39/fs/binfmt_elf.c 2011-05-19 00:06:34.000000000 -0400
43373+++ linux-2.6.39/fs/binfmt_elf.c 2011-05-22 19:41:37.000000000 -0400
43374@@ -51,6 +51,10 @@ static int elf_core_dump(struct coredump
43375 #define elf_core_dump NULL
43376 #endif
43377
43378+#ifdef CONFIG_PAX_MPROTECT
43379+static void elf_handle_mprotect(struct vm_area_struct *vma, unsigned long newflags);
43380+#endif
43381+
43382 #if ELF_EXEC_PAGESIZE > PAGE_SIZE
43383 #define ELF_MIN_ALIGN ELF_EXEC_PAGESIZE
43384 #else
43385@@ -70,6 +74,11 @@ static struct linux_binfmt elf_format =
43386 .load_binary = load_elf_binary,
43387 .load_shlib = load_elf_library,
43388 .core_dump = elf_core_dump,
43389+
43390+#ifdef CONFIG_PAX_MPROTECT
43391+ .handle_mprotect= elf_handle_mprotect,
43392+#endif
43393+
43394 .min_coredump = ELF_EXEC_PAGESIZE,
43395 };
43396
43397@@ -77,6 +86,8 @@ static struct linux_binfmt elf_format =
43398
43399 static int set_brk(unsigned long start, unsigned long end)
43400 {
43401+ unsigned long e = end;
43402+
43403 start = ELF_PAGEALIGN(start);
43404 end = ELF_PAGEALIGN(end);
43405 if (end > start) {
43406@@ -87,7 +98,7 @@ static int set_brk(unsigned long start,
43407 if (BAD_ADDR(addr))
43408 return addr;
43409 }
43410- current->mm->start_brk = current->mm->brk = end;
43411+ current->mm->start_brk = current->mm->brk = e;
43412 return 0;
43413 }
43414
43415@@ -148,12 +159,15 @@ create_elf_tables(struct linux_binprm *b
43416 elf_addr_t __user *u_rand_bytes;
43417 const char *k_platform = ELF_PLATFORM;
43418 const char *k_base_platform = ELF_BASE_PLATFORM;
43419- unsigned char k_rand_bytes[16];
43420+ u32 k_rand_bytes[4];
43421 int items;
43422 elf_addr_t *elf_info;
43423 int ei_index = 0;
43424 const struct cred *cred = current_cred();
43425 struct vm_area_struct *vma;
43426+ unsigned long saved_auxv[AT_VECTOR_SIZE];
43427+
43428+ pax_track_stack();
43429
43430 /*
43431 * In some cases (e.g. Hyper-Threading), we want to avoid L1
43432@@ -195,8 +209,12 @@ create_elf_tables(struct linux_binprm *b
43433 * Generate 16 random bytes for userspace PRNG seeding.
43434 */
43435 get_random_bytes(k_rand_bytes, sizeof(k_rand_bytes));
43436- u_rand_bytes = (elf_addr_t __user *)
43437- STACK_ALLOC(p, sizeof(k_rand_bytes));
43438+ srandom32(k_rand_bytes[0] ^ random32());
43439+ srandom32(k_rand_bytes[1] ^ random32());
43440+ srandom32(k_rand_bytes[2] ^ random32());
43441+ srandom32(k_rand_bytes[3] ^ random32());
43442+ p = STACK_ROUND(p, sizeof(k_rand_bytes));
43443+ u_rand_bytes = (elf_addr_t __user *) p;
43444 if (__copy_to_user(u_rand_bytes, k_rand_bytes, sizeof(k_rand_bytes)))
43445 return -EFAULT;
43446
43447@@ -308,9 +326,11 @@ create_elf_tables(struct linux_binprm *b
43448 return -EFAULT;
43449 current->mm->env_end = p;
43450
43451+ memcpy(saved_auxv, elf_info, ei_index * sizeof(elf_addr_t));
43452+
43453 /* Put the elf_info on the stack in the right place. */
43454 sp = (elf_addr_t __user *)envp + 1;
43455- if (copy_to_user(sp, elf_info, ei_index * sizeof(elf_addr_t)))
43456+ if (copy_to_user(sp, saved_auxv, ei_index * sizeof(elf_addr_t)))
43457 return -EFAULT;
43458 return 0;
43459 }
43460@@ -381,10 +401,10 @@ static unsigned long load_elf_interp(str
43461 {
43462 struct elf_phdr *elf_phdata;
43463 struct elf_phdr *eppnt;
43464- unsigned long load_addr = 0;
43465+ unsigned long load_addr = 0, pax_task_size = TASK_SIZE;
43466 int load_addr_set = 0;
43467 unsigned long last_bss = 0, elf_bss = 0;
43468- unsigned long error = ~0UL;
43469+ unsigned long error = -EINVAL;
43470 unsigned long total_size;
43471 int retval, i, size;
43472
43473@@ -430,6 +450,11 @@ static unsigned long load_elf_interp(str
43474 goto out_close;
43475 }
43476
43477+#ifdef CONFIG_PAX_SEGMEXEC
43478+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
43479+ pax_task_size = SEGMEXEC_TASK_SIZE;
43480+#endif
43481+
43482 eppnt = elf_phdata;
43483 for (i = 0; i < interp_elf_ex->e_phnum; i++, eppnt++) {
43484 if (eppnt->p_type == PT_LOAD) {
43485@@ -473,8 +498,8 @@ static unsigned long load_elf_interp(str
43486 k = load_addr + eppnt->p_vaddr;
43487 if (BAD_ADDR(k) ||
43488 eppnt->p_filesz > eppnt->p_memsz ||
43489- eppnt->p_memsz > TASK_SIZE ||
43490- TASK_SIZE - eppnt->p_memsz < k) {
43491+ eppnt->p_memsz > pax_task_size ||
43492+ pax_task_size - eppnt->p_memsz < k) {
43493 error = -ENOMEM;
43494 goto out_close;
43495 }
43496@@ -528,6 +553,193 @@ out:
43497 return error;
43498 }
43499
43500+#if (defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS)) && defined(CONFIG_PAX_SOFTMODE)
43501+static unsigned long pax_parse_softmode(const struct elf_phdr * const elf_phdata)
43502+{
43503+ unsigned long pax_flags = 0UL;
43504+
43505+#ifdef CONFIG_PAX_PAGEEXEC
43506+ if (elf_phdata->p_flags & PF_PAGEEXEC)
43507+ pax_flags |= MF_PAX_PAGEEXEC;
43508+#endif
43509+
43510+#ifdef CONFIG_PAX_SEGMEXEC
43511+ if (elf_phdata->p_flags & PF_SEGMEXEC)
43512+ pax_flags |= MF_PAX_SEGMEXEC;
43513+#endif
43514+
43515+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
43516+ if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
43517+ if ((__supported_pte_mask & _PAGE_NX))
43518+ pax_flags &= ~MF_PAX_SEGMEXEC;
43519+ else
43520+ pax_flags &= ~MF_PAX_PAGEEXEC;
43521+ }
43522+#endif
43523+
43524+#ifdef CONFIG_PAX_EMUTRAMP
43525+ if (elf_phdata->p_flags & PF_EMUTRAMP)
43526+ pax_flags |= MF_PAX_EMUTRAMP;
43527+#endif
43528+
43529+#ifdef CONFIG_PAX_MPROTECT
43530+ if (elf_phdata->p_flags & PF_MPROTECT)
43531+ pax_flags |= MF_PAX_MPROTECT;
43532+#endif
43533+
43534+#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)
43535+ if (randomize_va_space && (elf_phdata->p_flags & PF_RANDMMAP))
43536+ pax_flags |= MF_PAX_RANDMMAP;
43537+#endif
43538+
43539+ return pax_flags;
43540+}
43541+#endif
43542+
43543+#ifdef CONFIG_PAX_PT_PAX_FLAGS
43544+static unsigned long pax_parse_hardmode(const struct elf_phdr * const elf_phdata)
43545+{
43546+ unsigned long pax_flags = 0UL;
43547+
43548+#ifdef CONFIG_PAX_PAGEEXEC
43549+ if (!(elf_phdata->p_flags & PF_NOPAGEEXEC))
43550+ pax_flags |= MF_PAX_PAGEEXEC;
43551+#endif
43552+
43553+#ifdef CONFIG_PAX_SEGMEXEC
43554+ if (!(elf_phdata->p_flags & PF_NOSEGMEXEC))
43555+ pax_flags |= MF_PAX_SEGMEXEC;
43556+#endif
43557+
43558+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
43559+ if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
43560+ if ((__supported_pte_mask & _PAGE_NX))
43561+ pax_flags &= ~MF_PAX_SEGMEXEC;
43562+ else
43563+ pax_flags &= ~MF_PAX_PAGEEXEC;
43564+ }
43565+#endif
43566+
43567+#ifdef CONFIG_PAX_EMUTRAMP
43568+ if (!(elf_phdata->p_flags & PF_NOEMUTRAMP))
43569+ pax_flags |= MF_PAX_EMUTRAMP;
43570+#endif
43571+
43572+#ifdef CONFIG_PAX_MPROTECT
43573+ if (!(elf_phdata->p_flags & PF_NOMPROTECT))
43574+ pax_flags |= MF_PAX_MPROTECT;
43575+#endif
43576+
43577+#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)
43578+ if (randomize_va_space && !(elf_phdata->p_flags & PF_NORANDMMAP))
43579+ pax_flags |= MF_PAX_RANDMMAP;
43580+#endif
43581+
43582+ return pax_flags;
43583+}
43584+#endif
43585+
43586+#ifdef CONFIG_PAX_EI_PAX
43587+static unsigned long pax_parse_ei_pax(const struct elfhdr * const elf_ex)
43588+{
43589+ unsigned long pax_flags = 0UL;
43590+
43591+#ifdef CONFIG_PAX_PAGEEXEC
43592+ if (!(elf_ex->e_ident[EI_PAX] & EF_PAX_PAGEEXEC))
43593+ pax_flags |= MF_PAX_PAGEEXEC;
43594+#endif
43595+
43596+#ifdef CONFIG_PAX_SEGMEXEC
43597+ if (!(elf_ex->e_ident[EI_PAX] & EF_PAX_SEGMEXEC))
43598+ pax_flags |= MF_PAX_SEGMEXEC;
43599+#endif
43600+
43601+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
43602+ if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
43603+ if ((__supported_pte_mask & _PAGE_NX))
43604+ pax_flags &= ~MF_PAX_SEGMEXEC;
43605+ else
43606+ pax_flags &= ~MF_PAX_PAGEEXEC;
43607+ }
43608+#endif
43609+
43610+#ifdef CONFIG_PAX_EMUTRAMP
43611+ if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) && (elf_ex->e_ident[EI_PAX] & EF_PAX_EMUTRAMP))
43612+ pax_flags |= MF_PAX_EMUTRAMP;
43613+#endif
43614+
43615+#ifdef CONFIG_PAX_MPROTECT
43616+ if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) && !(elf_ex->e_ident[EI_PAX] & EF_PAX_MPROTECT))
43617+ pax_flags |= MF_PAX_MPROTECT;
43618+#endif
43619+
43620+#ifdef CONFIG_PAX_ASLR
43621+ if (randomize_va_space && !(elf_ex->e_ident[EI_PAX] & EF_PAX_RANDMMAP))
43622+ pax_flags |= MF_PAX_RANDMMAP;
43623+#endif
43624+
43625+ return pax_flags;
43626+}
43627+#endif
43628+
43629+#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS)
43630+static long pax_parse_elf_flags(const struct elfhdr * const elf_ex, const struct elf_phdr * const elf_phdata)
43631+{
43632+ unsigned long pax_flags = 0UL;
43633+
43634+#ifdef CONFIG_PAX_PT_PAX_FLAGS
43635+ unsigned long i;
43636+ int found_flags = 0;
43637+#endif
43638+
43639+#ifdef CONFIG_PAX_EI_PAX
43640+ pax_flags = pax_parse_ei_pax(elf_ex);
43641+#endif
43642+
43643+#ifdef CONFIG_PAX_PT_PAX_FLAGS
43644+ for (i = 0UL; i < elf_ex->e_phnum; i++)
43645+ if (elf_phdata[i].p_type == PT_PAX_FLAGS) {
43646+ if (((elf_phdata[i].p_flags & PF_PAGEEXEC) && (elf_phdata[i].p_flags & PF_NOPAGEEXEC)) ||
43647+ ((elf_phdata[i].p_flags & PF_SEGMEXEC) && (elf_phdata[i].p_flags & PF_NOSEGMEXEC)) ||
43648+ ((elf_phdata[i].p_flags & PF_EMUTRAMP) && (elf_phdata[i].p_flags & PF_NOEMUTRAMP)) ||
43649+ ((elf_phdata[i].p_flags & PF_MPROTECT) && (elf_phdata[i].p_flags & PF_NOMPROTECT)) ||
43650+ ((elf_phdata[i].p_flags & PF_RANDMMAP) && (elf_phdata[i].p_flags & PF_NORANDMMAP)))
43651+ return -EINVAL;
43652+
43653+#ifdef CONFIG_PAX_SOFTMODE
43654+ if (pax_softmode)
43655+ pax_flags = pax_parse_softmode(&elf_phdata[i]);
43656+ else
43657+#endif
43658+
43659+ pax_flags = pax_parse_hardmode(&elf_phdata[i]);
43660+ found_flags = 1;
43661+ break;
43662+ }
43663+#endif
43664+
43665+#if !defined(CONFIG_PAX_EI_PAX) && defined(CONFIG_PAX_PT_PAX_FLAGS)
43666+ if (found_flags == 0) {
43667+ struct elf_phdr phdr;
43668+ memset(&phdr, 0, sizeof(phdr));
43669+ phdr.p_flags = PF_NOEMUTRAMP;
43670+#ifdef CONFIG_PAX_SOFTMODE
43671+ if (pax_softmode)
43672+ pax_flags = pax_parse_softmode(&phdr);
43673+ else
43674+#endif
43675+ pax_flags = pax_parse_hardmode(&phdr);
43676+ }
43677+#endif
43678+
43679+ if (0 > pax_check_flags(&pax_flags))
43680+ return -EINVAL;
43681+
43682+ current->mm->pax_flags = pax_flags;
43683+ return 0;
43684+}
43685+#endif
43686+
43687 /*
43688 * These are the functions used to load ELF style executables and shared
43689 * libraries. There is no binary dependent code anywhere else.
43690@@ -544,6 +756,11 @@ static unsigned long randomize_stack_top
43691 {
43692 unsigned int random_variable = 0;
43693
43694+#ifdef CONFIG_PAX_RANDUSTACK
43695+ if (randomize_va_space)
43696+ return stack_top - current->mm->delta_stack;
43697+#endif
43698+
43699 if ((current->flags & PF_RANDOMIZE) &&
43700 !(current->personality & ADDR_NO_RANDOMIZE)) {
43701 random_variable = get_random_int() & STACK_RND_MASK;
43702@@ -562,7 +779,7 @@ static int load_elf_binary(struct linux_
43703 unsigned long load_addr = 0, load_bias = 0;
43704 int load_addr_set = 0;
43705 char * elf_interpreter = NULL;
43706- unsigned long error;
43707+ unsigned long error = 0;
43708 struct elf_phdr *elf_ppnt, *elf_phdata;
43709 unsigned long elf_bss, elf_brk;
43710 int retval, i;
43711@@ -572,11 +789,11 @@ static int load_elf_binary(struct linux_
43712 unsigned long start_code, end_code, start_data, end_data;
43713 unsigned long reloc_func_desc __maybe_unused = 0;
43714 int executable_stack = EXSTACK_DEFAULT;
43715- unsigned long def_flags = 0;
43716 struct {
43717 struct elfhdr elf_ex;
43718 struct elfhdr interp_elf_ex;
43719 } *loc;
43720+ unsigned long pax_task_size = TASK_SIZE;
43721
43722 loc = kmalloc(sizeof(*loc), GFP_KERNEL);
43723 if (!loc) {
43724@@ -714,11 +931,81 @@ static int load_elf_binary(struct linux_
43725
43726 /* OK, This is the point of no return */
43727 current->flags &= ~PF_FORKNOEXEC;
43728- current->mm->def_flags = def_flags;
43729+
43730+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
43731+ current->mm->pax_flags = 0UL;
43732+#endif
43733+
43734+#ifdef CONFIG_PAX_DLRESOLVE
43735+ current->mm->call_dl_resolve = 0UL;
43736+#endif
43737+
43738+#if defined(CONFIG_PPC32) && defined(CONFIG_PAX_EMUSIGRT)
43739+ current->mm->call_syscall = 0UL;
43740+#endif
43741+
43742+#ifdef CONFIG_PAX_ASLR
43743+ current->mm->delta_mmap = 0UL;
43744+ current->mm->delta_stack = 0UL;
43745+#endif
43746+
43747+ current->mm->def_flags = 0;
43748+
43749+#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS)
43750+ if (0 > pax_parse_elf_flags(&loc->elf_ex, elf_phdata)) {
43751+ send_sig(SIGKILL, current, 0);
43752+ goto out_free_dentry;
43753+ }
43754+#endif
43755+
43756+#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
43757+ pax_set_initial_flags(bprm);
43758+#elif defined(CONFIG_PAX_HOOK_ACL_FLAGS)
43759+ if (pax_set_initial_flags_func)
43760+ (pax_set_initial_flags_func)(bprm);
43761+#endif
43762+
43763+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
43764+ if ((current->mm->pax_flags & MF_PAX_PAGEEXEC) && !(__supported_pte_mask & _PAGE_NX)) {
43765+ current->mm->context.user_cs_limit = PAGE_SIZE;
43766+ current->mm->def_flags |= VM_PAGEEXEC;
43767+ }
43768+#endif
43769+
43770+#ifdef CONFIG_PAX_SEGMEXEC
43771+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
43772+ current->mm->context.user_cs_base = SEGMEXEC_TASK_SIZE;
43773+ current->mm->context.user_cs_limit = TASK_SIZE-SEGMEXEC_TASK_SIZE;
43774+ pax_task_size = SEGMEXEC_TASK_SIZE;
43775+ current->mm->def_flags |= VM_NOHUGEPAGE;
43776+ }
43777+#endif
43778+
43779+#if defined(CONFIG_ARCH_TRACK_EXEC_LIMIT) || defined(CONFIG_PAX_SEGMEXEC)
43780+ if (current->mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
43781+ set_user_cs(current->mm->context.user_cs_base, current->mm->context.user_cs_limit, get_cpu());
43782+ put_cpu();
43783+ }
43784+#endif
43785
43786 /* Do this immediately, since STACK_TOP as used in setup_arg_pages
43787 may depend on the personality. */
43788 SET_PERSONALITY(loc->elf_ex);
43789+
43790+#ifdef CONFIG_PAX_ASLR
43791+ if (current->mm->pax_flags & MF_PAX_RANDMMAP) {
43792+ current->mm->delta_mmap = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN)-1)) << PAGE_SHIFT;
43793+ current->mm->delta_stack = (pax_get_random_long() & ((1UL << PAX_DELTA_STACK_LEN)-1)) << PAGE_SHIFT;
43794+ }
43795+#endif
43796+
43797+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
43798+ if (current->mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
43799+ executable_stack = EXSTACK_DISABLE_X;
43800+ current->personality &= ~READ_IMPLIES_EXEC;
43801+ } else
43802+#endif
43803+
43804 if (elf_read_implies_exec(loc->elf_ex, executable_stack))
43805 current->personality |= READ_IMPLIES_EXEC;
43806
43807@@ -800,6 +1087,20 @@ static int load_elf_binary(struct linux_
43808 #else
43809 load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
43810 #endif
43811+
43812+#ifdef CONFIG_PAX_RANDMMAP
43813+ /* PaX: randomize base address at the default exe base if requested */
43814+ if ((current->mm->pax_flags & MF_PAX_RANDMMAP) && elf_interpreter) {
43815+#ifdef CONFIG_SPARC64
43816+ load_bias = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN) - 1)) << (PAGE_SHIFT+1);
43817+#else
43818+ load_bias = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN) - 1)) << PAGE_SHIFT;
43819+#endif
43820+ load_bias = ELF_PAGESTART(PAX_ELF_ET_DYN_BASE - vaddr + load_bias);
43821+ elf_flags |= MAP_FIXED;
43822+ }
43823+#endif
43824+
43825 }
43826
43827 error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,
43828@@ -832,9 +1133,9 @@ static int load_elf_binary(struct linux_
43829 * allowed task size. Note that p_filesz must always be
43830 * <= p_memsz so it is only necessary to check p_memsz.
43831 */
43832- if (BAD_ADDR(k) || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
43833- elf_ppnt->p_memsz > TASK_SIZE ||
43834- TASK_SIZE - elf_ppnt->p_memsz < k) {
43835+ if (k >= pax_task_size || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
43836+ elf_ppnt->p_memsz > pax_task_size ||
43837+ pax_task_size - elf_ppnt->p_memsz < k) {
43838 /* set_brk can never work. Avoid overflows. */
43839 send_sig(SIGKILL, current, 0);
43840 retval = -EINVAL;
43841@@ -862,6 +1163,11 @@ static int load_elf_binary(struct linux_
43842 start_data += load_bias;
43843 end_data += load_bias;
43844
43845+#ifdef CONFIG_PAX_RANDMMAP
43846+ if (current->mm->pax_flags & MF_PAX_RANDMMAP)
43847+ elf_brk += PAGE_SIZE + ((pax_get_random_long() & ~PAGE_MASK) << 4);
43848+#endif
43849+
43850 /* Calling set_brk effectively mmaps the pages that we need
43851 * for the bss and break sections. We must do this before
43852 * mapping in the interpreter, to make sure it doesn't wind
43853@@ -873,9 +1179,11 @@ static int load_elf_binary(struct linux_
43854 goto out_free_dentry;
43855 }
43856 if (likely(elf_bss != elf_brk) && unlikely(padzero(elf_bss))) {
43857- send_sig(SIGSEGV, current, 0);
43858- retval = -EFAULT; /* Nobody gets to see this, but.. */
43859- goto out_free_dentry;
43860+ /*
43861+ * This bss-zeroing can fail if the ELF
43862+ * file specifies odd protections. So
43863+ * we don't check the return value
43864+ */
43865 }
43866
43867 if (elf_interpreter) {
43868@@ -1090,7 +1398,7 @@ out:
43869 * Decide what to dump of a segment, part, all or none.
43870 */
43871 static unsigned long vma_dump_size(struct vm_area_struct *vma,
43872- unsigned long mm_flags)
43873+ unsigned long mm_flags, long signr)
43874 {
43875 #define FILTER(type) (mm_flags & (1UL << MMF_DUMP_##type))
43876
43877@@ -1124,7 +1432,7 @@ static unsigned long vma_dump_size(struc
43878 if (vma->vm_file == NULL)
43879 return 0;
43880
43881- if (FILTER(MAPPED_PRIVATE))
43882+ if (signr == SIGKILL || FILTER(MAPPED_PRIVATE))
43883 goto whole;
43884
43885 /*
43886@@ -1346,9 +1654,9 @@ static void fill_auxv_note(struct memelf
43887 {
43888 elf_addr_t *auxv = (elf_addr_t *) mm->saved_auxv;
43889 int i = 0;
43890- do
43891+ do {
43892 i += 2;
43893- while (auxv[i - 2] != AT_NULL);
43894+ } while (auxv[i - 2] != AT_NULL);
43895 fill_note(note, "CORE", NT_AUXV, i * sizeof(elf_addr_t), auxv);
43896 }
43897
43898@@ -1854,14 +2162,14 @@ static void fill_extnum_info(struct elfh
43899 }
43900
43901 static size_t elf_core_vma_data_size(struct vm_area_struct *gate_vma,
43902- unsigned long mm_flags)
43903+ struct coredump_params *cprm)
43904 {
43905 struct vm_area_struct *vma;
43906 size_t size = 0;
43907
43908 for (vma = first_vma(current, gate_vma); vma != NULL;
43909 vma = next_vma(vma, gate_vma))
43910- size += vma_dump_size(vma, mm_flags);
43911+ size += vma_dump_size(vma, cprm->mm_flags, cprm->signr);
43912 return size;
43913 }
43914
43915@@ -1955,7 +2263,7 @@ static int elf_core_dump(struct coredump
43916
43917 dataoff = offset = roundup(offset, ELF_EXEC_PAGESIZE);
43918
43919- offset += elf_core_vma_data_size(gate_vma, cprm->mm_flags);
43920+ offset += elf_core_vma_data_size(gate_vma, cprm);
43921 offset += elf_core_extra_data_size();
43922 e_shoff = offset;
43923
43924@@ -1969,10 +2277,12 @@ static int elf_core_dump(struct coredump
43925 offset = dataoff;
43926
43927 size += sizeof(*elf);
43928+ gr_learn_resource(current, RLIMIT_CORE, size, 1);
43929 if (size > cprm->limit || !dump_write(cprm->file, elf, sizeof(*elf)))
43930 goto end_coredump;
43931
43932 size += sizeof(*phdr4note);
43933+ gr_learn_resource(current, RLIMIT_CORE, size, 1);
43934 if (size > cprm->limit
43935 || !dump_write(cprm->file, phdr4note, sizeof(*phdr4note)))
43936 goto end_coredump;
43937@@ -1986,7 +2296,7 @@ static int elf_core_dump(struct coredump
43938 phdr.p_offset = offset;
43939 phdr.p_vaddr = vma->vm_start;
43940 phdr.p_paddr = 0;
43941- phdr.p_filesz = vma_dump_size(vma, cprm->mm_flags);
43942+ phdr.p_filesz = vma_dump_size(vma, cprm->mm_flags, cprm->signr);
43943 phdr.p_memsz = vma->vm_end - vma->vm_start;
43944 offset += phdr.p_filesz;
43945 phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0;
43946@@ -1997,6 +2307,7 @@ static int elf_core_dump(struct coredump
43947 phdr.p_align = ELF_EXEC_PAGESIZE;
43948
43949 size += sizeof(phdr);
43950+ gr_learn_resource(current, RLIMIT_CORE, size, 1);
43951 if (size > cprm->limit
43952 || !dump_write(cprm->file, &phdr, sizeof(phdr)))
43953 goto end_coredump;
43954@@ -2021,7 +2332,7 @@ static int elf_core_dump(struct coredump
43955 unsigned long addr;
43956 unsigned long end;
43957
43958- end = vma->vm_start + vma_dump_size(vma, cprm->mm_flags);
43959+ end = vma->vm_start + vma_dump_size(vma, cprm->mm_flags, cprm->signr);
43960
43961 for (addr = vma->vm_start; addr < end; addr += PAGE_SIZE) {
43962 struct page *page;
43963@@ -2030,6 +2341,7 @@ static int elf_core_dump(struct coredump
43964 page = get_dump_page(addr);
43965 if (page) {
43966 void *kaddr = kmap(page);
43967+ gr_learn_resource(current, RLIMIT_CORE, size + PAGE_SIZE, 1);
43968 stop = ((size += PAGE_SIZE) > cprm->limit) ||
43969 !dump_write(cprm->file, kaddr,
43970 PAGE_SIZE);
43971@@ -2047,6 +2359,7 @@ static int elf_core_dump(struct coredump
43972
43973 if (e_phnum == PN_XNUM) {
43974 size += sizeof(*shdr4extnum);
43975+ gr_learn_resource(current, RLIMIT_CORE, size, 1);
43976 if (size > cprm->limit
43977 || !dump_write(cprm->file, shdr4extnum,
43978 sizeof(*shdr4extnum)))
43979@@ -2067,6 +2380,97 @@ out:
43980
43981 #endif /* CONFIG_ELF_CORE */
43982
43983+#ifdef CONFIG_PAX_MPROTECT
43984+/* PaX: non-PIC ELF libraries need relocations on their executable segments
43985+ * therefore we'll grant them VM_MAYWRITE once during their life. Similarly
43986+ * we'll remove VM_MAYWRITE for good on RELRO segments.
43987+ *
43988+ * The checks favour ld-linux.so behaviour which operates on a per ELF segment
43989+ * basis because we want to allow the common case and not the special ones.
43990+ */
43991+static void elf_handle_mprotect(struct vm_area_struct *vma, unsigned long newflags)
43992+{
43993+ struct elfhdr elf_h;
43994+ struct elf_phdr elf_p;
43995+ unsigned long i;
43996+ unsigned long oldflags;
43997+ bool is_textrel_rw, is_textrel_rx, is_relro;
43998+
43999+ if (!(vma->vm_mm->pax_flags & MF_PAX_MPROTECT))
44000+ return;
44001+
44002+ oldflags = vma->vm_flags & (VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_EXEC | VM_WRITE | VM_READ);
44003+ newflags &= VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_EXEC | VM_WRITE | VM_READ;
44004+
44005+#ifdef CONFIG_PAX_ELFRELOCS
44006+ /* possible TEXTREL */
44007+ is_textrel_rw = vma->vm_file && !vma->anon_vma && oldflags == (VM_MAYEXEC | VM_MAYREAD | VM_EXEC | VM_READ) && newflags == (VM_WRITE | VM_READ);
44008+ is_textrel_rx = vma->vm_file && vma->anon_vma && oldflags == (VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_WRITE | VM_READ) && newflags == (VM_EXEC | VM_READ);
44009+#else
44010+ is_textrel_rw = false;
44011+ is_textrel_rx = false;
44012+#endif
44013+
44014+ /* possible RELRO */
44015+ is_relro = vma->vm_file && vma->anon_vma && oldflags == (VM_MAYWRITE | VM_MAYREAD | VM_READ) && newflags == (VM_MAYWRITE | VM_MAYREAD | VM_READ);
44016+
44017+ if (!is_textrel_rw && !is_textrel_rx && !is_relro)
44018+ return;
44019+
44020+ if (sizeof(elf_h) != kernel_read(vma->vm_file, 0UL, (char *)&elf_h, sizeof(elf_h)) ||
44021+ memcmp(elf_h.e_ident, ELFMAG, SELFMAG) ||
44022+
44023+#ifdef CONFIG_PAX_ETEXECRELOCS
44024+ ((is_textrel_rw || is_textrel_rx) && (elf_h.e_type != ET_DYN && elf_h.e_type != ET_EXEC)) ||
44025+#else
44026+ ((is_textrel_rw || is_textrel_rx) && elf_h.e_type != ET_DYN) ||
44027+#endif
44028+
44029+ (is_relro && (elf_h.e_type != ET_DYN && elf_h.e_type != ET_EXEC)) ||
44030+ !elf_check_arch(&elf_h) ||
44031+ elf_h.e_phentsize != sizeof(struct elf_phdr) ||
44032+ elf_h.e_phnum > 65536UL / sizeof(struct elf_phdr))
44033+ return;
44034+
44035+ for (i = 0UL; i < elf_h.e_phnum; i++) {
44036+ if (sizeof(elf_p) != kernel_read(vma->vm_file, elf_h.e_phoff + i*sizeof(elf_p), (char *)&elf_p, sizeof(elf_p)))
44037+ return;
44038+ switch (elf_p.p_type) {
44039+ case PT_DYNAMIC:
44040+ if (!is_textrel_rw && !is_textrel_rx)
44041+ continue;
44042+ i = 0UL;
44043+ while ((i+1) * sizeof(elf_dyn) <= elf_p.p_filesz) {
44044+ elf_dyn dyn;
44045+
44046+ if (sizeof(dyn) != kernel_read(vma->vm_file, elf_p.p_offset + i*sizeof(dyn), (char *)&dyn, sizeof(dyn)))
44047+ return;
44048+ if (dyn.d_tag == DT_NULL)
44049+ return;
44050+ if (dyn.d_tag == DT_TEXTREL || (dyn.d_tag == DT_FLAGS && (dyn.d_un.d_val & DF_TEXTREL))) {
44051+ gr_log_textrel(vma);
44052+ if (is_textrel_rw)
44053+ vma->vm_flags |= VM_MAYWRITE;
44054+ else
44055+ /* PaX: disallow write access after relocs are done, hopefully noone else needs it... */
44056+ vma->vm_flags &= ~VM_MAYWRITE;
44057+ return;
44058+ }
44059+ i++;
44060+ }
44061+ return;
44062+
44063+ case PT_GNU_RELRO:
44064+ if (!is_relro)
44065+ continue;
44066+ if ((elf_p.p_offset >> PAGE_SHIFT) == vma->vm_pgoff && ELF_PAGEALIGN(elf_p.p_memsz) == vma->vm_end - vma->vm_start)
44067+ vma->vm_flags &= ~VM_MAYWRITE;
44068+ return;
44069+ }
44070+ }
44071+}
44072+#endif
44073+
44074 static int __init init_elf_binfmt(void)
44075 {
44076 return register_binfmt(&elf_format);
44077diff -urNp linux-2.6.39/fs/binfmt_flat.c linux-2.6.39/fs/binfmt_flat.c
44078--- linux-2.6.39/fs/binfmt_flat.c 2011-05-19 00:06:34.000000000 -0400
44079+++ linux-2.6.39/fs/binfmt_flat.c 2011-05-22 19:36:32.000000000 -0400
44080@@ -567,7 +567,9 @@ static int load_flat_file(struct linux_b
44081 realdatastart = (unsigned long) -ENOMEM;
44082 printk("Unable to allocate RAM for process data, errno %d\n",
44083 (int)-realdatastart);
44084+ down_write(&current->mm->mmap_sem);
44085 do_munmap(current->mm, textpos, text_len);
44086+ up_write(&current->mm->mmap_sem);
44087 ret = realdatastart;
44088 goto err;
44089 }
44090@@ -591,8 +593,10 @@ static int load_flat_file(struct linux_b
44091 }
44092 if (IS_ERR_VALUE(result)) {
44093 printk("Unable to read data+bss, errno %d\n", (int)-result);
44094+ down_write(&current->mm->mmap_sem);
44095 do_munmap(current->mm, textpos, text_len);
44096 do_munmap(current->mm, realdatastart, len);
44097+ up_write(&current->mm->mmap_sem);
44098 ret = result;
44099 goto err;
44100 }
44101@@ -661,8 +665,10 @@ static int load_flat_file(struct linux_b
44102 }
44103 if (IS_ERR_VALUE(result)) {
44104 printk("Unable to read code+data+bss, errno %d\n",(int)-result);
44105+ down_write(&current->mm->mmap_sem);
44106 do_munmap(current->mm, textpos, text_len + data_len + extra +
44107 MAX_SHARED_LIBS * sizeof(unsigned long));
44108+ up_write(&current->mm->mmap_sem);
44109 ret = result;
44110 goto err;
44111 }
44112diff -urNp linux-2.6.39/fs/bio.c linux-2.6.39/fs/bio.c
44113--- linux-2.6.39/fs/bio.c 2011-05-19 00:06:34.000000000 -0400
44114+++ linux-2.6.39/fs/bio.c 2011-05-22 19:36:32.000000000 -0400
44115@@ -1233,7 +1233,7 @@ static void bio_copy_kern_endio(struct b
44116 const int read = bio_data_dir(bio) == READ;
44117 struct bio_map_data *bmd = bio->bi_private;
44118 int i;
44119- char *p = bmd->sgvecs[0].iov_base;
44120+ char *p = (__force char *)bmd->sgvecs[0].iov_base;
44121
44122 __bio_for_each_segment(bvec, bio, i, 0) {
44123 char *addr = page_address(bvec->bv_page);
44124diff -urNp linux-2.6.39/fs/block_dev.c linux-2.6.39/fs/block_dev.c
44125--- linux-2.6.39/fs/block_dev.c 2011-05-19 00:06:34.000000000 -0400
44126+++ linux-2.6.39/fs/block_dev.c 2011-05-22 19:36:32.000000000 -0400
44127@@ -671,7 +671,7 @@ static bool bd_may_claim(struct block_de
44128 else if (bdev->bd_contains == bdev)
44129 return true; /* is a whole device which isn't held */
44130
44131- else if (whole->bd_holder == bd_may_claim)
44132+ else if (whole->bd_holder == (void *)bd_may_claim)
44133 return true; /* is a partition of a device that is being partitioned */
44134 else if (whole->bd_holder != NULL)
44135 return false; /* is a partition of a held device */
44136diff -urNp linux-2.6.39/fs/btrfs/compression.c linux-2.6.39/fs/btrfs/compression.c
44137--- linux-2.6.39/fs/btrfs/compression.c 2011-05-19 00:06:34.000000000 -0400
44138+++ linux-2.6.39/fs/btrfs/compression.c 2011-05-22 19:36:32.000000000 -0400
44139@@ -719,7 +719,7 @@ static int comp_num_workspace[BTRFS_COMP
44140 static atomic_t comp_alloc_workspace[BTRFS_COMPRESS_TYPES];
44141 static wait_queue_head_t comp_workspace_wait[BTRFS_COMPRESS_TYPES];
44142
44143-struct btrfs_compress_op *btrfs_compress_op[] = {
44144+const struct btrfs_compress_op *btrfs_compress_op[] = {
44145 &btrfs_zlib_compress,
44146 &btrfs_lzo_compress,
44147 };
44148diff -urNp linux-2.6.39/fs/btrfs/compression.h linux-2.6.39/fs/btrfs/compression.h
44149--- linux-2.6.39/fs/btrfs/compression.h 2011-05-19 00:06:34.000000000 -0400
44150+++ linux-2.6.39/fs/btrfs/compression.h 2011-05-22 19:36:32.000000000 -0400
44151@@ -77,7 +77,7 @@ struct btrfs_compress_op {
44152 size_t srclen, size_t destlen);
44153 };
44154
44155-extern struct btrfs_compress_op btrfs_zlib_compress;
44156-extern struct btrfs_compress_op btrfs_lzo_compress;
44157+extern const struct btrfs_compress_op btrfs_zlib_compress;
44158+extern const struct btrfs_compress_op btrfs_lzo_compress;
44159
44160 #endif
44161diff -urNp linux-2.6.39/fs/btrfs/ctree.c linux-2.6.39/fs/btrfs/ctree.c
44162--- linux-2.6.39/fs/btrfs/ctree.c 2011-05-19 00:06:34.000000000 -0400
44163+++ linux-2.6.39/fs/btrfs/ctree.c 2011-05-22 19:36:32.000000000 -0400
44164@@ -461,9 +461,12 @@ static noinline int __btrfs_cow_block(st
44165 free_extent_buffer(buf);
44166 add_root_to_dirty_list(root);
44167 } else {
44168- if (root->root_key.objectid == BTRFS_TREE_RELOC_OBJECTID)
44169- parent_start = parent->start;
44170- else
44171+ if (root->root_key.objectid == BTRFS_TREE_RELOC_OBJECTID) {
44172+ if (parent)
44173+ parent_start = parent->start;
44174+ else
44175+ parent_start = 0;
44176+ } else
44177 parent_start = 0;
44178
44179 WARN_ON(trans->transid != btrfs_header_generation(parent));
44180@@ -3647,7 +3650,6 @@ setup_items_for_insert(struct btrfs_tran
44181
44182 ret = 0;
44183 if (slot == 0) {
44184- struct btrfs_disk_key disk_key;
44185 btrfs_cpu_key_to_disk(&disk_key, cpu_key);
44186 ret = fixup_low_keys(trans, root, path, &disk_key, 1);
44187 }
44188diff -urNp linux-2.6.39/fs/btrfs/disk-io.c linux-2.6.39/fs/btrfs/disk-io.c
44189--- linux-2.6.39/fs/btrfs/disk-io.c 2011-05-19 00:06:34.000000000 -0400
44190+++ linux-2.6.39/fs/btrfs/disk-io.c 2011-05-22 19:36:32.000000000 -0400
44191@@ -42,7 +42,7 @@
44192 #include "tree-log.h"
44193 #include "free-space-cache.h"
44194
44195-static struct extent_io_ops btree_extent_io_ops;
44196+static const struct extent_io_ops btree_extent_io_ops;
44197 static void end_workqueue_fn(struct btrfs_work *work);
44198 static void free_fs_root(struct btrfs_root *root);
44199 static void btrfs_check_super_valid(struct btrfs_fs_info *fs_info,
44200@@ -3070,7 +3070,7 @@ static int btrfs_cleanup_transaction(str
44201 return 0;
44202 }
44203
44204-static struct extent_io_ops btree_extent_io_ops = {
44205+static const struct extent_io_ops btree_extent_io_ops = {
44206 .write_cache_pages_lock_hook = btree_lock_page_hook,
44207 .readpage_end_io_hook = btree_readpage_end_io_hook,
44208 .submit_bio_hook = btree_submit_bio_hook,
44209diff -urNp linux-2.6.39/fs/btrfs/extent_io.h linux-2.6.39/fs/btrfs/extent_io.h
44210--- linux-2.6.39/fs/btrfs/extent_io.h 2011-05-19 00:06:34.000000000 -0400
44211+++ linux-2.6.39/fs/btrfs/extent_io.h 2011-05-22 19:36:32.000000000 -0400
44212@@ -56,36 +56,36 @@ typedef int (extent_submit_bio_hook_t)(s
44213 struct bio *bio, int mirror_num,
44214 unsigned long bio_flags, u64 bio_offset);
44215 struct extent_io_ops {
44216- int (*fill_delalloc)(struct inode *inode, struct page *locked_page,
44217+ int (* const fill_delalloc)(struct inode *inode, struct page *locked_page,
44218 u64 start, u64 end, int *page_started,
44219 unsigned long *nr_written);
44220- int (*writepage_start_hook)(struct page *page, u64 start, u64 end);
44221- int (*writepage_io_hook)(struct page *page, u64 start, u64 end);
44222+ int (* const writepage_start_hook)(struct page *page, u64 start, u64 end);
44223+ int (* const writepage_io_hook)(struct page *page, u64 start, u64 end);
44224 extent_submit_bio_hook_t *submit_bio_hook;
44225- int (*merge_bio_hook)(struct page *page, unsigned long offset,
44226+ int (* const merge_bio_hook)(struct page *page, unsigned long offset,
44227 size_t size, struct bio *bio,
44228 unsigned long bio_flags);
44229- int (*readpage_io_hook)(struct page *page, u64 start, u64 end);
44230- int (*readpage_io_failed_hook)(struct bio *bio, struct page *page,
44231+ int (* const readpage_io_hook)(struct page *page, u64 start, u64 end);
44232+ int (* const readpage_io_failed_hook)(struct bio *bio, struct page *page,
44233 u64 start, u64 end,
44234 struct extent_state *state);
44235- int (*writepage_io_failed_hook)(struct bio *bio, struct page *page,
44236+ int (* const writepage_io_failed_hook)(struct bio *bio, struct page *page,
44237 u64 start, u64 end,
44238 struct extent_state *state);
44239- int (*readpage_end_io_hook)(struct page *page, u64 start, u64 end,
44240+ int (* const readpage_end_io_hook)(struct page *page, u64 start, u64 end,
44241 struct extent_state *state);
44242- int (*writepage_end_io_hook)(struct page *page, u64 start, u64 end,
44243+ int (* const writepage_end_io_hook)(struct page *page, u64 start, u64 end,
44244 struct extent_state *state, int uptodate);
44245- int (*set_bit_hook)(struct inode *inode, struct extent_state *state,
44246+ int (* const set_bit_hook)(struct inode *inode, struct extent_state *state,
44247 int *bits);
44248- int (*clear_bit_hook)(struct inode *inode, struct extent_state *state,
44249+ int (* const clear_bit_hook)(struct inode *inode, struct extent_state *state,
44250 int *bits);
44251- int (*merge_extent_hook)(struct inode *inode,
44252+ int (* const merge_extent_hook)(struct inode *inode,
44253 struct extent_state *new,
44254 struct extent_state *other);
44255- int (*split_extent_hook)(struct inode *inode,
44256+ int (* const split_extent_hook)(struct inode *inode,
44257 struct extent_state *orig, u64 split);
44258- int (*write_cache_pages_lock_hook)(struct page *page);
44259+ int (* const write_cache_pages_lock_hook)(struct page *page);
44260 };
44261
44262 struct extent_io_tree {
44263@@ -95,7 +95,7 @@ struct extent_io_tree {
44264 u64 dirty_bytes;
44265 spinlock_t lock;
44266 spinlock_t buffer_lock;
44267- struct extent_io_ops *ops;
44268+ const struct extent_io_ops *ops;
44269 };
44270
44271 struct extent_state {
44272diff -urNp linux-2.6.39/fs/btrfs/free-space-cache.c linux-2.6.39/fs/btrfs/free-space-cache.c
44273--- linux-2.6.39/fs/btrfs/free-space-cache.c 2011-05-19 00:06:34.000000000 -0400
44274+++ linux-2.6.39/fs/btrfs/free-space-cache.c 2011-05-22 19:36:32.000000000 -0400
44275@@ -1910,8 +1910,6 @@ u64 btrfs_alloc_from_cluster(struct btrf
44276 while(1) {
44277 if (entry->bytes < bytes ||
44278 (!entry->bitmap && entry->offset < min_start)) {
44279- struct rb_node *node;
44280-
44281 node = rb_next(&entry->offset_index);
44282 if (!node)
44283 break;
44284@@ -1925,7 +1923,6 @@ u64 btrfs_alloc_from_cluster(struct btrf
44285 cluster, entry, bytes,
44286 min_start);
44287 if (ret == 0) {
44288- struct rb_node *node;
44289 node = rb_next(&entry->offset_index);
44290 if (!node)
44291 break;
44292diff -urNp linux-2.6.39/fs/btrfs/inode.c linux-2.6.39/fs/btrfs/inode.c
44293--- linux-2.6.39/fs/btrfs/inode.c 2011-05-19 00:06:34.000000000 -0400
44294+++ linux-2.6.39/fs/btrfs/inode.c 2011-05-22 20:42:42.000000000 -0400
44295@@ -65,7 +65,7 @@ static const struct inode_operations btr
44296 static const struct address_space_operations btrfs_aops;
44297 static const struct address_space_operations btrfs_symlink_aops;
44298 static const struct file_operations btrfs_dir_file_operations;
44299-static struct extent_io_ops btrfs_extent_io_ops;
44300+static const struct extent_io_ops btrfs_extent_io_ops;
44301
44302 static struct kmem_cache *btrfs_inode_cachep;
44303 struct kmem_cache *btrfs_trans_handle_cachep;
44304@@ -6947,7 +6947,7 @@ fail:
44305 return -ENOMEM;
44306 }
44307
44308-static int btrfs_getattr(struct vfsmount *mnt,
44309+int btrfs_getattr(struct vfsmount *mnt,
44310 struct dentry *dentry, struct kstat *stat)
44311 {
44312 struct inode *inode = dentry->d_inode;
44313@@ -6959,6 +6959,14 @@ static int btrfs_getattr(struct vfsmount
44314 return 0;
44315 }
44316
44317+EXPORT_SYMBOL(btrfs_getattr);
44318+
44319+dev_t get_btrfs_dev_from_inode(struct inode *inode)
44320+{
44321+ return BTRFS_I(inode)->root->anon_super.s_dev;
44322+}
44323+EXPORT_SYMBOL(get_btrfs_dev_from_inode);
44324+
44325 /*
44326 * If a file is moved, it will inherit the cow and compression flags of the new
44327 * directory.
44328@@ -7488,7 +7496,7 @@ static const struct file_operations btrf
44329 .fsync = btrfs_sync_file,
44330 };
44331
44332-static struct extent_io_ops btrfs_extent_io_ops = {
44333+static const struct extent_io_ops btrfs_extent_io_ops = {
44334 .fill_delalloc = run_delalloc_range,
44335 .submit_bio_hook = btrfs_submit_bio_hook,
44336 .merge_bio_hook = btrfs_merge_bio_hook,
44337diff -urNp linux-2.6.39/fs/btrfs/ioctl.c linux-2.6.39/fs/btrfs/ioctl.c
44338--- linux-2.6.39/fs/btrfs/ioctl.c 2011-05-19 00:06:34.000000000 -0400
44339+++ linux-2.6.39/fs/btrfs/ioctl.c 2011-05-22 19:41:37.000000000 -0400
44340@@ -2361,9 +2361,12 @@ long btrfs_ioctl_space_info(struct btrfs
44341 for (i = 0; i < num_types; i++) {
44342 struct btrfs_space_info *tmp;
44343
44344+ /* Don't copy in more than we allocated */
44345 if (!slot_count)
44346 break;
44347
44348+ slot_count--;
44349+
44350 info = NULL;
44351 rcu_read_lock();
44352 list_for_each_entry_rcu(tmp, &root->fs_info->space_info,
44353@@ -2385,10 +2388,7 @@ long btrfs_ioctl_space_info(struct btrfs
44354 memcpy(dest, &space, sizeof(space));
44355 dest++;
44356 space_args.total_spaces++;
44357- slot_count--;
44358 }
44359- if (!slot_count)
44360- break;
44361 }
44362 up_read(&info->groups_sem);
44363 }
44364diff -urNp linux-2.6.39/fs/btrfs/lzo.c linux-2.6.39/fs/btrfs/lzo.c
44365--- linux-2.6.39/fs/btrfs/lzo.c 2011-05-19 00:06:34.000000000 -0400
44366+++ linux-2.6.39/fs/btrfs/lzo.c 2011-05-22 19:36:32.000000000 -0400
44367@@ -418,7 +418,7 @@ out:
44368 return ret;
44369 }
44370
44371-struct btrfs_compress_op btrfs_lzo_compress = {
44372+const struct btrfs_compress_op btrfs_lzo_compress = {
44373 .alloc_workspace = lzo_alloc_workspace,
44374 .free_workspace = lzo_free_workspace,
44375 .compress_pages = lzo_compress_pages,
44376diff -urNp linux-2.6.39/fs/btrfs/relocation.c linux-2.6.39/fs/btrfs/relocation.c
44377--- linux-2.6.39/fs/btrfs/relocation.c 2011-05-19 00:06:34.000000000 -0400
44378+++ linux-2.6.39/fs/btrfs/relocation.c 2011-05-22 19:36:32.000000000 -0400
44379@@ -1239,7 +1239,7 @@ static int __update_reloc_root(struct bt
44380 }
44381 spin_unlock(&rc->reloc_root_tree.lock);
44382
44383- BUG_ON((struct btrfs_root *)node->data != root);
44384+ BUG_ON(!node || (struct btrfs_root *)node->data != root);
44385
44386 if (!del) {
44387 spin_lock(&rc->reloc_root_tree.lock);
44388diff -urNp linux-2.6.39/fs/btrfs/zlib.c linux-2.6.39/fs/btrfs/zlib.c
44389--- linux-2.6.39/fs/btrfs/zlib.c 2011-05-19 00:06:34.000000000 -0400
44390+++ linux-2.6.39/fs/btrfs/zlib.c 2011-05-22 19:36:32.000000000 -0400
44391@@ -390,7 +390,7 @@ next:
44392 return ret;
44393 }
44394
44395-struct btrfs_compress_op btrfs_zlib_compress = {
44396+const struct btrfs_compress_op btrfs_zlib_compress = {
44397 .alloc_workspace = zlib_alloc_workspace,
44398 .free_workspace = zlib_free_workspace,
44399 .compress_pages = zlib_compress_pages,
44400diff -urNp linux-2.6.39/fs/cachefiles/bind.c linux-2.6.39/fs/cachefiles/bind.c
44401--- linux-2.6.39/fs/cachefiles/bind.c 2011-05-19 00:06:34.000000000 -0400
44402+++ linux-2.6.39/fs/cachefiles/bind.c 2011-05-22 19:36:32.000000000 -0400
44403@@ -39,13 +39,11 @@ int cachefiles_daemon_bind(struct cachef
44404 args);
44405
44406 /* start by checking things over */
44407- ASSERT(cache->fstop_percent >= 0 &&
44408- cache->fstop_percent < cache->fcull_percent &&
44409+ ASSERT(cache->fstop_percent < cache->fcull_percent &&
44410 cache->fcull_percent < cache->frun_percent &&
44411 cache->frun_percent < 100);
44412
44413- ASSERT(cache->bstop_percent >= 0 &&
44414- cache->bstop_percent < cache->bcull_percent &&
44415+ ASSERT(cache->bstop_percent < cache->bcull_percent &&
44416 cache->bcull_percent < cache->brun_percent &&
44417 cache->brun_percent < 100);
44418
44419diff -urNp linux-2.6.39/fs/cachefiles/daemon.c linux-2.6.39/fs/cachefiles/daemon.c
44420--- linux-2.6.39/fs/cachefiles/daemon.c 2011-05-19 00:06:34.000000000 -0400
44421+++ linux-2.6.39/fs/cachefiles/daemon.c 2011-05-22 19:36:32.000000000 -0400
44422@@ -196,7 +196,7 @@ static ssize_t cachefiles_daemon_read(st
44423 if (n > buflen)
44424 return -EMSGSIZE;
44425
44426- if (copy_to_user(_buffer, buffer, n) != 0)
44427+ if (n > sizeof(buffer) || copy_to_user(_buffer, buffer, n) != 0)
44428 return -EFAULT;
44429
44430 return n;
44431@@ -222,7 +222,7 @@ static ssize_t cachefiles_daemon_write(s
44432 if (test_bit(CACHEFILES_DEAD, &cache->flags))
44433 return -EIO;
44434
44435- if (datalen < 0 || datalen > PAGE_SIZE - 1)
44436+ if (datalen > PAGE_SIZE - 1)
44437 return -EOPNOTSUPP;
44438
44439 /* drag the command string into the kernel so we can parse it */
44440@@ -386,7 +386,7 @@ static int cachefiles_daemon_fstop(struc
44441 if (args[0] != '%' || args[1] != '\0')
44442 return -EINVAL;
44443
44444- if (fstop < 0 || fstop >= cache->fcull_percent)
44445+ if (fstop >= cache->fcull_percent)
44446 return cachefiles_daemon_range_error(cache, args);
44447
44448 cache->fstop_percent = fstop;
44449@@ -458,7 +458,7 @@ static int cachefiles_daemon_bstop(struc
44450 if (args[0] != '%' || args[1] != '\0')
44451 return -EINVAL;
44452
44453- if (bstop < 0 || bstop >= cache->bcull_percent)
44454+ if (bstop >= cache->bcull_percent)
44455 return cachefiles_daemon_range_error(cache, args);
44456
44457 cache->bstop_percent = bstop;
44458diff -urNp linux-2.6.39/fs/cachefiles/internal.h linux-2.6.39/fs/cachefiles/internal.h
44459--- linux-2.6.39/fs/cachefiles/internal.h 2011-05-19 00:06:34.000000000 -0400
44460+++ linux-2.6.39/fs/cachefiles/internal.h 2011-05-22 19:36:32.000000000 -0400
44461@@ -57,7 +57,7 @@ struct cachefiles_cache {
44462 wait_queue_head_t daemon_pollwq; /* poll waitqueue for daemon */
44463 struct rb_root active_nodes; /* active nodes (can't be culled) */
44464 rwlock_t active_lock; /* lock for active_nodes */
44465- atomic_t gravecounter; /* graveyard uniquifier */
44466+ atomic_unchecked_t gravecounter; /* graveyard uniquifier */
44467 unsigned frun_percent; /* when to stop culling (% files) */
44468 unsigned fcull_percent; /* when to start culling (% files) */
44469 unsigned fstop_percent; /* when to stop allocating (% files) */
44470@@ -169,19 +169,19 @@ extern int cachefiles_check_in_use(struc
44471 * proc.c
44472 */
44473 #ifdef CONFIG_CACHEFILES_HISTOGRAM
44474-extern atomic_t cachefiles_lookup_histogram[HZ];
44475-extern atomic_t cachefiles_mkdir_histogram[HZ];
44476-extern atomic_t cachefiles_create_histogram[HZ];
44477+extern atomic_unchecked_t cachefiles_lookup_histogram[HZ];
44478+extern atomic_unchecked_t cachefiles_mkdir_histogram[HZ];
44479+extern atomic_unchecked_t cachefiles_create_histogram[HZ];
44480
44481 extern int __init cachefiles_proc_init(void);
44482 extern void cachefiles_proc_cleanup(void);
44483 static inline
44484-void cachefiles_hist(atomic_t histogram[], unsigned long start_jif)
44485+void cachefiles_hist(atomic_unchecked_t histogram[], unsigned long start_jif)
44486 {
44487 unsigned long jif = jiffies - start_jif;
44488 if (jif >= HZ)
44489 jif = HZ - 1;
44490- atomic_inc(&histogram[jif]);
44491+ atomic_inc_unchecked(&histogram[jif]);
44492 }
44493
44494 #else
44495diff -urNp linux-2.6.39/fs/cachefiles/namei.c linux-2.6.39/fs/cachefiles/namei.c
44496--- linux-2.6.39/fs/cachefiles/namei.c 2011-05-19 00:06:34.000000000 -0400
44497+++ linux-2.6.39/fs/cachefiles/namei.c 2011-05-22 19:36:32.000000000 -0400
44498@@ -318,7 +318,7 @@ try_again:
44499 /* first step is to make up a grave dentry in the graveyard */
44500 sprintf(nbuffer, "%08x%08x",
44501 (uint32_t) get_seconds(),
44502- (uint32_t) atomic_inc_return(&cache->gravecounter));
44503+ (uint32_t) atomic_inc_return_unchecked(&cache->gravecounter));
44504
44505 /* do the multiway lock magic */
44506 trap = lock_rename(cache->graveyard, dir);
44507diff -urNp linux-2.6.39/fs/cachefiles/proc.c linux-2.6.39/fs/cachefiles/proc.c
44508--- linux-2.6.39/fs/cachefiles/proc.c 2011-05-19 00:06:34.000000000 -0400
44509+++ linux-2.6.39/fs/cachefiles/proc.c 2011-05-22 19:36:32.000000000 -0400
44510@@ -14,9 +14,9 @@
44511 #include <linux/seq_file.h>
44512 #include "internal.h"
44513
44514-atomic_t cachefiles_lookup_histogram[HZ];
44515-atomic_t cachefiles_mkdir_histogram[HZ];
44516-atomic_t cachefiles_create_histogram[HZ];
44517+atomic_unchecked_t cachefiles_lookup_histogram[HZ];
44518+atomic_unchecked_t cachefiles_mkdir_histogram[HZ];
44519+atomic_unchecked_t cachefiles_create_histogram[HZ];
44520
44521 /*
44522 * display the latency histogram
44523@@ -35,9 +35,9 @@ static int cachefiles_histogram_show(str
44524 return 0;
44525 default:
44526 index = (unsigned long) v - 3;
44527- x = atomic_read(&cachefiles_lookup_histogram[index]);
44528- y = atomic_read(&cachefiles_mkdir_histogram[index]);
44529- z = atomic_read(&cachefiles_create_histogram[index]);
44530+ x = atomic_read_unchecked(&cachefiles_lookup_histogram[index]);
44531+ y = atomic_read_unchecked(&cachefiles_mkdir_histogram[index]);
44532+ z = atomic_read_unchecked(&cachefiles_create_histogram[index]);
44533 if (x == 0 && y == 0 && z == 0)
44534 return 0;
44535
44536diff -urNp linux-2.6.39/fs/cachefiles/rdwr.c linux-2.6.39/fs/cachefiles/rdwr.c
44537--- linux-2.6.39/fs/cachefiles/rdwr.c 2011-05-19 00:06:34.000000000 -0400
44538+++ linux-2.6.39/fs/cachefiles/rdwr.c 2011-05-22 19:36:32.000000000 -0400
44539@@ -945,7 +945,7 @@ int cachefiles_write_page(struct fscache
44540 old_fs = get_fs();
44541 set_fs(KERNEL_DS);
44542 ret = file->f_op->write(
44543- file, (const void __user *) data, len, &pos);
44544+ file, (__force const void __user *) data, len, &pos);
44545 set_fs(old_fs);
44546 kunmap(page);
44547 if (ret != len)
44548diff -urNp linux-2.6.39/fs/ceph/addr.c linux-2.6.39/fs/ceph/addr.c
44549--- linux-2.6.39/fs/ceph/addr.c 2011-05-19 00:06:34.000000000 -0400
44550+++ linux-2.6.39/fs/ceph/addr.c 2011-05-22 19:36:32.000000000 -0400
44551@@ -1164,7 +1164,7 @@ out:
44552 return ret;
44553 }
44554
44555-static struct vm_operations_struct ceph_vmops = {
44556+static const struct vm_operations_struct ceph_vmops = {
44557 .fault = filemap_fault,
44558 .page_mkwrite = ceph_page_mkwrite,
44559 };
44560diff -urNp linux-2.6.39/fs/ceph/dir.c linux-2.6.39/fs/ceph/dir.c
44561--- linux-2.6.39/fs/ceph/dir.c 2011-05-19 00:06:34.000000000 -0400
44562+++ linux-2.6.39/fs/ceph/dir.c 2011-05-22 19:36:32.000000000 -0400
44563@@ -226,7 +226,7 @@ static int ceph_readdir(struct file *fil
44564 struct ceph_fs_client *fsc = ceph_inode_to_client(inode);
44565 struct ceph_mds_client *mdsc = fsc->mdsc;
44566 unsigned frag = fpos_frag(filp->f_pos);
44567- int off = fpos_off(filp->f_pos);
44568+ unsigned int off = fpos_off(filp->f_pos);
44569 int err;
44570 u32 ftype;
44571 struct ceph_mds_reply_info_parsed *rinfo;
44572@@ -360,7 +360,7 @@ more:
44573 rinfo = &fi->last_readdir->r_reply_info;
44574 dout("readdir frag %x num %d off %d chunkoff %d\n", frag,
44575 rinfo->dir_nr, off, fi->offset);
44576- while (off - fi->offset >= 0 && off - fi->offset < rinfo->dir_nr) {
44577+ while (off >= fi->offset && off - fi->offset < rinfo->dir_nr) {
44578 u64 pos = ceph_make_fpos(frag, off);
44579 struct ceph_mds_reply_inode *in =
44580 rinfo->dir_in[off - fi->offset].in;
44581diff -urNp linux-2.6.39/fs/cifs/cifs_debug.c linux-2.6.39/fs/cifs/cifs_debug.c
44582--- linux-2.6.39/fs/cifs/cifs_debug.c 2011-05-19 00:06:34.000000000 -0400
44583+++ linux-2.6.39/fs/cifs/cifs_debug.c 2011-05-22 19:36:32.000000000 -0400
44584@@ -279,25 +279,25 @@ static ssize_t cifs_stats_proc_write(str
44585 tcon = list_entry(tmp3,
44586 struct cifsTconInfo,
44587 tcon_list);
44588- atomic_set(&tcon->num_smbs_sent, 0);
44589- atomic_set(&tcon->num_writes, 0);
44590- atomic_set(&tcon->num_reads, 0);
44591- atomic_set(&tcon->num_oplock_brks, 0);
44592- atomic_set(&tcon->num_opens, 0);
44593- atomic_set(&tcon->num_posixopens, 0);
44594- atomic_set(&tcon->num_posixmkdirs, 0);
44595- atomic_set(&tcon->num_closes, 0);
44596- atomic_set(&tcon->num_deletes, 0);
44597- atomic_set(&tcon->num_mkdirs, 0);
44598- atomic_set(&tcon->num_rmdirs, 0);
44599- atomic_set(&tcon->num_renames, 0);
44600- atomic_set(&tcon->num_t2renames, 0);
44601- atomic_set(&tcon->num_ffirst, 0);
44602- atomic_set(&tcon->num_fnext, 0);
44603- atomic_set(&tcon->num_fclose, 0);
44604- atomic_set(&tcon->num_hardlinks, 0);
44605- atomic_set(&tcon->num_symlinks, 0);
44606- atomic_set(&tcon->num_locks, 0);
44607+ atomic_set_unchecked(&tcon->num_smbs_sent, 0);
44608+ atomic_set_unchecked(&tcon->num_writes, 0);
44609+ atomic_set_unchecked(&tcon->num_reads, 0);
44610+ atomic_set_unchecked(&tcon->num_oplock_brks, 0);
44611+ atomic_set_unchecked(&tcon->num_opens, 0);
44612+ atomic_set_unchecked(&tcon->num_posixopens, 0);
44613+ atomic_set_unchecked(&tcon->num_posixmkdirs, 0);
44614+ atomic_set_unchecked(&tcon->num_closes, 0);
44615+ atomic_set_unchecked(&tcon->num_deletes, 0);
44616+ atomic_set_unchecked(&tcon->num_mkdirs, 0);
44617+ atomic_set_unchecked(&tcon->num_rmdirs, 0);
44618+ atomic_set_unchecked(&tcon->num_renames, 0);
44619+ atomic_set_unchecked(&tcon->num_t2renames, 0);
44620+ atomic_set_unchecked(&tcon->num_ffirst, 0);
44621+ atomic_set_unchecked(&tcon->num_fnext, 0);
44622+ atomic_set_unchecked(&tcon->num_fclose, 0);
44623+ atomic_set_unchecked(&tcon->num_hardlinks, 0);
44624+ atomic_set_unchecked(&tcon->num_symlinks, 0);
44625+ atomic_set_unchecked(&tcon->num_locks, 0);
44626 }
44627 }
44628 }
44629@@ -357,41 +357,41 @@ static int cifs_stats_proc_show(struct s
44630 if (tcon->need_reconnect)
44631 seq_puts(m, "\tDISCONNECTED ");
44632 seq_printf(m, "\nSMBs: %d Oplock Breaks: %d",
44633- atomic_read(&tcon->num_smbs_sent),
44634- atomic_read(&tcon->num_oplock_brks));
44635+ atomic_read_unchecked(&tcon->num_smbs_sent),
44636+ atomic_read_unchecked(&tcon->num_oplock_brks));
44637 seq_printf(m, "\nReads: %d Bytes: %lld",
44638- atomic_read(&tcon->num_reads),
44639+ atomic_read_unchecked(&tcon->num_reads),
44640 (long long)(tcon->bytes_read));
44641 seq_printf(m, "\nWrites: %d Bytes: %lld",
44642- atomic_read(&tcon->num_writes),
44643+ atomic_read_unchecked(&tcon->num_writes),
44644 (long long)(tcon->bytes_written));
44645 seq_printf(m, "\nFlushes: %d",
44646- atomic_read(&tcon->num_flushes));
44647+ atomic_read_unchecked(&tcon->num_flushes));
44648 seq_printf(m, "\nLocks: %d HardLinks: %d "
44649 "Symlinks: %d",
44650- atomic_read(&tcon->num_locks),
44651- atomic_read(&tcon->num_hardlinks),
44652- atomic_read(&tcon->num_symlinks));
44653+ atomic_read_unchecked(&tcon->num_locks),
44654+ atomic_read_unchecked(&tcon->num_hardlinks),
44655+ atomic_read_unchecked(&tcon->num_symlinks));
44656 seq_printf(m, "\nOpens: %d Closes: %d "
44657 "Deletes: %d",
44658- atomic_read(&tcon->num_opens),
44659- atomic_read(&tcon->num_closes),
44660- atomic_read(&tcon->num_deletes));
44661+ atomic_read_unchecked(&tcon->num_opens),
44662+ atomic_read_unchecked(&tcon->num_closes),
44663+ atomic_read_unchecked(&tcon->num_deletes));
44664 seq_printf(m, "\nPosix Opens: %d "
44665 "Posix Mkdirs: %d",
44666- atomic_read(&tcon->num_posixopens),
44667- atomic_read(&tcon->num_posixmkdirs));
44668+ atomic_read_unchecked(&tcon->num_posixopens),
44669+ atomic_read_unchecked(&tcon->num_posixmkdirs));
44670 seq_printf(m, "\nMkdirs: %d Rmdirs: %d",
44671- atomic_read(&tcon->num_mkdirs),
44672- atomic_read(&tcon->num_rmdirs));
44673+ atomic_read_unchecked(&tcon->num_mkdirs),
44674+ atomic_read_unchecked(&tcon->num_rmdirs));
44675 seq_printf(m, "\nRenames: %d T2 Renames %d",
44676- atomic_read(&tcon->num_renames),
44677- atomic_read(&tcon->num_t2renames));
44678+ atomic_read_unchecked(&tcon->num_renames),
44679+ atomic_read_unchecked(&tcon->num_t2renames));
44680 seq_printf(m, "\nFindFirst: %d FNext %d "
44681 "FClose %d",
44682- atomic_read(&tcon->num_ffirst),
44683- atomic_read(&tcon->num_fnext),
44684- atomic_read(&tcon->num_fclose));
44685+ atomic_read_unchecked(&tcon->num_ffirst),
44686+ atomic_read_unchecked(&tcon->num_fnext),
44687+ atomic_read_unchecked(&tcon->num_fclose));
44688 }
44689 }
44690 }
44691diff -urNp linux-2.6.39/fs/cifs/cifsglob.h linux-2.6.39/fs/cifs/cifsglob.h
44692--- linux-2.6.39/fs/cifs/cifsglob.h 2011-05-19 00:06:34.000000000 -0400
44693+++ linux-2.6.39/fs/cifs/cifsglob.h 2011-05-22 19:36:32.000000000 -0400
44694@@ -305,28 +305,28 @@ struct cifsTconInfo {
44695 __u16 Flags; /* optional support bits */
44696 enum statusEnum tidStatus;
44697 #ifdef CONFIG_CIFS_STATS
44698- atomic_t num_smbs_sent;
44699- atomic_t num_writes;
44700- atomic_t num_reads;
44701- atomic_t num_flushes;
44702- atomic_t num_oplock_brks;
44703- atomic_t num_opens;
44704- atomic_t num_closes;
44705- atomic_t num_deletes;
44706- atomic_t num_mkdirs;
44707- atomic_t num_posixopens;
44708- atomic_t num_posixmkdirs;
44709- atomic_t num_rmdirs;
44710- atomic_t num_renames;
44711- atomic_t num_t2renames;
44712- atomic_t num_ffirst;
44713- atomic_t num_fnext;
44714- atomic_t num_fclose;
44715- atomic_t num_hardlinks;
44716- atomic_t num_symlinks;
44717- atomic_t num_locks;
44718- atomic_t num_acl_get;
44719- atomic_t num_acl_set;
44720+ atomic_unchecked_t num_smbs_sent;
44721+ atomic_unchecked_t num_writes;
44722+ atomic_unchecked_t num_reads;
44723+ atomic_unchecked_t num_flushes;
44724+ atomic_unchecked_t num_oplock_brks;
44725+ atomic_unchecked_t num_opens;
44726+ atomic_unchecked_t num_closes;
44727+ atomic_unchecked_t num_deletes;
44728+ atomic_unchecked_t num_mkdirs;
44729+ atomic_unchecked_t num_posixopens;
44730+ atomic_unchecked_t num_posixmkdirs;
44731+ atomic_unchecked_t num_rmdirs;
44732+ atomic_unchecked_t num_renames;
44733+ atomic_unchecked_t num_t2renames;
44734+ atomic_unchecked_t num_ffirst;
44735+ atomic_unchecked_t num_fnext;
44736+ atomic_unchecked_t num_fclose;
44737+ atomic_unchecked_t num_hardlinks;
44738+ atomic_unchecked_t num_symlinks;
44739+ atomic_unchecked_t num_locks;
44740+ atomic_unchecked_t num_acl_get;
44741+ atomic_unchecked_t num_acl_set;
44742 #ifdef CONFIG_CIFS_STATS2
44743 unsigned long long time_writes;
44744 unsigned long long time_reads;
44745@@ -509,7 +509,7 @@ static inline char CIFS_DIR_SEP(const st
44746 }
44747
44748 #ifdef CONFIG_CIFS_STATS
44749-#define cifs_stats_inc atomic_inc
44750+#define cifs_stats_inc atomic_inc_unchecked
44751
44752 static inline void cifs_stats_bytes_written(struct cifsTconInfo *tcon,
44753 unsigned int bytes)
44754diff -urNp linux-2.6.39/fs/cifs/link.c linux-2.6.39/fs/cifs/link.c
44755--- linux-2.6.39/fs/cifs/link.c 2011-05-19 00:06:34.000000000 -0400
44756+++ linux-2.6.39/fs/cifs/link.c 2011-05-22 19:36:32.000000000 -0400
44757@@ -577,7 +577,7 @@ symlink_exit:
44758
44759 void cifs_put_link(struct dentry *direntry, struct nameidata *nd, void *cookie)
44760 {
44761- char *p = nd_get_link(nd);
44762+ const char *p = nd_get_link(nd);
44763 if (!IS_ERR(p))
44764 kfree(p);
44765 }
44766diff -urNp linux-2.6.39/fs/coda/cache.c linux-2.6.39/fs/coda/cache.c
44767--- linux-2.6.39/fs/coda/cache.c 2011-05-19 00:06:34.000000000 -0400
44768+++ linux-2.6.39/fs/coda/cache.c 2011-05-22 19:36:32.000000000 -0400
44769@@ -24,7 +24,7 @@
44770 #include "coda_linux.h"
44771 #include "coda_cache.h"
44772
44773-static atomic_t permission_epoch = ATOMIC_INIT(0);
44774+static atomic_unchecked_t permission_epoch = ATOMIC_INIT(0);
44775
44776 /* replace or extend an acl cache hit */
44777 void coda_cache_enter(struct inode *inode, int mask)
44778@@ -32,7 +32,7 @@ void coda_cache_enter(struct inode *inod
44779 struct coda_inode_info *cii = ITOC(inode);
44780
44781 spin_lock(&cii->c_lock);
44782- cii->c_cached_epoch = atomic_read(&permission_epoch);
44783+ cii->c_cached_epoch = atomic_read_unchecked(&permission_epoch);
44784 if (cii->c_uid != current_fsuid()) {
44785 cii->c_uid = current_fsuid();
44786 cii->c_cached_perm = mask;
44787@@ -46,14 +46,14 @@ void coda_cache_clear_inode(struct inode
44788 {
44789 struct coda_inode_info *cii = ITOC(inode);
44790 spin_lock(&cii->c_lock);
44791- cii->c_cached_epoch = atomic_read(&permission_epoch) - 1;
44792+ cii->c_cached_epoch = atomic_read_unchecked(&permission_epoch) - 1;
44793 spin_unlock(&cii->c_lock);
44794 }
44795
44796 /* remove all acl caches */
44797 void coda_cache_clear_all(struct super_block *sb)
44798 {
44799- atomic_inc(&permission_epoch);
44800+ atomic_inc_unchecked(&permission_epoch);
44801 }
44802
44803
44804@@ -66,7 +66,7 @@ int coda_cache_check(struct inode *inode
44805 spin_lock(&cii->c_lock);
44806 hit = (mask & cii->c_cached_perm) == mask &&
44807 cii->c_uid == current_fsuid() &&
44808- cii->c_cached_epoch == atomic_read(&permission_epoch);
44809+ cii->c_cached_epoch == atomic_read_unchecked(&permission_epoch);
44810 spin_unlock(&cii->c_lock);
44811
44812 return hit;
44813diff -urNp linux-2.6.39/fs/compat_binfmt_elf.c linux-2.6.39/fs/compat_binfmt_elf.c
44814--- linux-2.6.39/fs/compat_binfmt_elf.c 2011-05-19 00:06:34.000000000 -0400
44815+++ linux-2.6.39/fs/compat_binfmt_elf.c 2011-05-22 19:36:32.000000000 -0400
44816@@ -30,11 +30,13 @@
44817 #undef elf_phdr
44818 #undef elf_shdr
44819 #undef elf_note
44820+#undef elf_dyn
44821 #undef elf_addr_t
44822 #define elfhdr elf32_hdr
44823 #define elf_phdr elf32_phdr
44824 #define elf_shdr elf32_shdr
44825 #define elf_note elf32_note
44826+#define elf_dyn Elf32_Dyn
44827 #define elf_addr_t Elf32_Addr
44828
44829 /*
44830diff -urNp linux-2.6.39/fs/compat.c linux-2.6.39/fs/compat.c
44831--- linux-2.6.39/fs/compat.c 2011-05-19 00:06:34.000000000 -0400
44832+++ linux-2.6.39/fs/compat.c 2011-05-22 19:41:37.000000000 -0400
44833@@ -566,7 +566,7 @@ ssize_t compat_rw_copy_check_uvector(int
44834 goto out;
44835
44836 ret = -EINVAL;
44837- if (nr_segs > UIO_MAXIOV || nr_segs < 0)
44838+ if (nr_segs > UIO_MAXIOV)
44839 goto out;
44840 if (nr_segs > fast_segs) {
44841 ret = -ENOMEM;
44842@@ -848,6 +848,7 @@ struct compat_old_linux_dirent {
44843
44844 struct compat_readdir_callback {
44845 struct compat_old_linux_dirent __user *dirent;
44846+ struct file * file;
44847 int result;
44848 };
44849
44850@@ -865,6 +866,10 @@ static int compat_fillonedir(void *__buf
44851 buf->result = -EOVERFLOW;
44852 return -EOVERFLOW;
44853 }
44854+
44855+ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
44856+ return 0;
44857+
44858 buf->result++;
44859 dirent = buf->dirent;
44860 if (!access_ok(VERIFY_WRITE, dirent,
44861@@ -897,6 +902,7 @@ asmlinkage long compat_sys_old_readdir(u
44862
44863 buf.result = 0;
44864 buf.dirent = dirent;
44865+ buf.file = file;
44866
44867 error = vfs_readdir(file, compat_fillonedir, &buf);
44868 if (buf.result)
44869@@ -917,6 +923,7 @@ struct compat_linux_dirent {
44870 struct compat_getdents_callback {
44871 struct compat_linux_dirent __user *current_dir;
44872 struct compat_linux_dirent __user *previous;
44873+ struct file * file;
44874 int count;
44875 int error;
44876 };
44877@@ -938,6 +945,10 @@ static int compat_filldir(void *__buf, c
44878 buf->error = -EOVERFLOW;
44879 return -EOVERFLOW;
44880 }
44881+
44882+ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
44883+ return 0;
44884+
44885 dirent = buf->previous;
44886 if (dirent) {
44887 if (__put_user(offset, &dirent->d_off))
44888@@ -985,6 +996,7 @@ asmlinkage long compat_sys_getdents(unsi
44889 buf.previous = NULL;
44890 buf.count = count;
44891 buf.error = 0;
44892+ buf.file = file;
44893
44894 error = vfs_readdir(file, compat_filldir, &buf);
44895 if (error >= 0)
44896@@ -1006,6 +1018,7 @@ out:
44897 struct compat_getdents_callback64 {
44898 struct linux_dirent64 __user *current_dir;
44899 struct linux_dirent64 __user *previous;
44900+ struct file * file;
44901 int count;
44902 int error;
44903 };
44904@@ -1022,6 +1035,10 @@ static int compat_filldir64(void * __buf
44905 buf->error = -EINVAL; /* only used if we fail.. */
44906 if (reclen > buf->count)
44907 return -EINVAL;
44908+
44909+ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
44910+ return 0;
44911+
44912 dirent = buf->previous;
44913
44914 if (dirent) {
44915@@ -1073,6 +1090,7 @@ asmlinkage long compat_sys_getdents64(un
44916 buf.previous = NULL;
44917 buf.count = count;
44918 buf.error = 0;
44919+ buf.file = file;
44920
44921 error = vfs_readdir(file, compat_filldir64, &buf);
44922 if (error >= 0)
44923@@ -1436,6 +1454,11 @@ int compat_do_execve(char * filename,
44924 compat_uptr_t __user *envp,
44925 struct pt_regs * regs)
44926 {
44927+#ifdef CONFIG_GRKERNSEC
44928+ struct file *old_exec_file;
44929+ struct acl_subject_label *old_acl;
44930+ struct rlimit old_rlim[RLIM_NLIMITS];
44931+#endif
44932 struct linux_binprm *bprm;
44933 struct file *file;
44934 struct files_struct *displaced;
44935@@ -1472,6 +1495,19 @@ int compat_do_execve(char * filename,
44936 bprm->filename = filename;
44937 bprm->interp = filename;
44938
44939+ if (gr_process_user_ban()) {
44940+ retval = -EPERM;
44941+ goto out_file;
44942+ }
44943+
44944+ gr_learn_resource(current, RLIMIT_NPROC, atomic_read(&current->cred->user->processes), 1);
44945+ retval = -EAGAIN;
44946+ if (gr_handle_nproc())
44947+ goto out_file;
44948+ retval = -EACCES;
44949+ if (!gr_acl_handle_execve(file->f_dentry, file->f_vfsmnt))
44950+ goto out_file;
44951+
44952 retval = bprm_mm_init(bprm);
44953 if (retval)
44954 goto out_file;
44955@@ -1501,9 +1537,40 @@ int compat_do_execve(char * filename,
44956 if (retval < 0)
44957 goto out;
44958
44959+ if (!gr_tpe_allow(file)) {
44960+ retval = -EACCES;
44961+ goto out;
44962+ }
44963+
44964+ if (gr_check_crash_exec(file)) {
44965+ retval = -EACCES;
44966+ goto out;
44967+ }
44968+
44969+ gr_log_chroot_exec(file->f_dentry, file->f_vfsmnt);
44970+
44971+ gr_handle_exec_args_compat(bprm, argv);
44972+
44973+#ifdef CONFIG_GRKERNSEC
44974+ old_acl = current->acl;
44975+ memcpy(old_rlim, current->signal->rlim, sizeof(old_rlim));
44976+ old_exec_file = current->exec_file;
44977+ get_file(file);
44978+ current->exec_file = file;
44979+#endif
44980+
44981+ retval = gr_set_proc_label(file->f_dentry, file->f_vfsmnt,
44982+ bprm->unsafe & LSM_UNSAFE_SHARE);
44983+ if (retval < 0)
44984+ goto out_fail;
44985+
44986 retval = search_binary_handler(bprm, regs);
44987 if (retval < 0)
44988- goto out;
44989+ goto out_fail;
44990+#ifdef CONFIG_GRKERNSEC
44991+ if (old_exec_file)
44992+ fput(old_exec_file);
44993+#endif
44994
44995 /* execve succeeded */
44996 current->fs->in_exec = 0;
44997@@ -1514,6 +1581,14 @@ int compat_do_execve(char * filename,
44998 put_files_struct(displaced);
44999 return retval;
45000
45001+out_fail:
45002+#ifdef CONFIG_GRKERNSEC
45003+ current->acl = old_acl;
45004+ memcpy(current->signal->rlim, old_rlim, sizeof(old_rlim));
45005+ fput(current->exec_file);
45006+ current->exec_file = old_exec_file;
45007+#endif
45008+
45009 out:
45010 if (bprm->mm) {
45011 acct_arg_size(bprm, 0);
45012@@ -1681,6 +1756,8 @@ int compat_core_sys_select(int n, compat
45013 struct fdtable *fdt;
45014 long stack_fds[SELECT_STACK_ALLOC/sizeof(long)];
45015
45016+ pax_track_stack();
45017+
45018 if (n < 0)
45019 goto out_nofds;
45020
45021diff -urNp linux-2.6.39/fs/compat_ioctl.c linux-2.6.39/fs/compat_ioctl.c
45022--- linux-2.6.39/fs/compat_ioctl.c 2011-05-19 00:06:34.000000000 -0400
45023+++ linux-2.6.39/fs/compat_ioctl.c 2011-05-22 19:36:32.000000000 -0400
45024@@ -208,6 +208,8 @@ static int do_video_set_spu_palette(unsi
45025
45026 err = get_user(palp, &up->palette);
45027 err |= get_user(length, &up->length);
45028+ if (err)
45029+ return -EFAULT;
45030
45031 up_native = compat_alloc_user_space(sizeof(struct video_spu_palette));
45032 err = put_user(compat_ptr(palp), &up_native->palette);
45033@@ -1638,8 +1640,8 @@ asmlinkage long compat_sys_ioctl(unsigne
45034 static int __init init_sys32_ioctl_cmp(const void *p, const void *q)
45035 {
45036 unsigned int a, b;
45037- a = *(unsigned int *)p;
45038- b = *(unsigned int *)q;
45039+ a = *(const unsigned int *)p;
45040+ b = *(const unsigned int *)q;
45041 if (a > b)
45042 return 1;
45043 if (a < b)
45044diff -urNp linux-2.6.39/fs/configfs/dir.c linux-2.6.39/fs/configfs/dir.c
45045--- linux-2.6.39/fs/configfs/dir.c 2011-05-19 00:06:34.000000000 -0400
45046+++ linux-2.6.39/fs/configfs/dir.c 2011-05-22 19:36:32.000000000 -0400
45047@@ -1575,7 +1575,8 @@ static int configfs_readdir(struct file
45048 }
45049 for (p=q->next; p!= &parent_sd->s_children; p=p->next) {
45050 struct configfs_dirent *next;
45051- const char * name;
45052+ const unsigned char * name;
45053+ char d_name[sizeof(next->s_dentry->d_iname)];
45054 int len;
45055 struct inode *inode = NULL;
45056
45057@@ -1585,7 +1586,12 @@ static int configfs_readdir(struct file
45058 continue;
45059
45060 name = configfs_get_name(next);
45061- len = strlen(name);
45062+ if (next->s_dentry && name == next->s_dentry->d_iname) {
45063+ len = next->s_dentry->d_name.len;
45064+ memcpy(d_name, name, len);
45065+ name = d_name;
45066+ } else
45067+ len = strlen(name);
45068
45069 /*
45070 * We'll have a dentry and an inode for
45071diff -urNp linux-2.6.39/fs/configfs/file.c linux-2.6.39/fs/configfs/file.c
45072--- linux-2.6.39/fs/configfs/file.c 2011-05-19 00:06:34.000000000 -0400
45073+++ linux-2.6.39/fs/configfs/file.c 2011-05-22 19:36:32.000000000 -0400
45074@@ -215,7 +215,7 @@ static int check_perm(struct inode * ino
45075 struct config_item *item = configfs_get_config_item(file->f_path.dentry->d_parent);
45076 struct configfs_attribute * attr = to_attr(file->f_path.dentry);
45077 struct configfs_buffer * buffer;
45078- struct configfs_item_operations * ops = NULL;
45079+ struct configfs_item_operations *ops = NULL;
45080 int error = 0;
45081
45082 if (!item || !attr)
45083diff -urNp linux-2.6.39/fs/configfs/item.c linux-2.6.39/fs/configfs/item.c
45084--- linux-2.6.39/fs/configfs/item.c 2011-05-19 00:06:34.000000000 -0400
45085+++ linux-2.6.39/fs/configfs/item.c 2011-05-22 19:36:32.000000000 -0400
45086@@ -123,7 +123,7 @@ void config_item_init_type_name(struct c
45087 EXPORT_SYMBOL(config_item_init_type_name);
45088
45089 void config_group_init_type_name(struct config_group *group, const char *name,
45090- struct config_item_type *type)
45091+ struct config_item_type *type)
45092 {
45093 config_item_set_name(&group->cg_item, name);
45094 group->cg_item.ci_type = type;
45095diff -urNp linux-2.6.39/fs/dcache.c linux-2.6.39/fs/dcache.c
45096--- linux-2.6.39/fs/dcache.c 2011-05-19 00:06:34.000000000 -0400
45097+++ linux-2.6.39/fs/dcache.c 2011-05-22 19:36:32.000000000 -0400
45098@@ -3069,7 +3069,7 @@ void __init vfs_caches_init(unsigned lon
45099 mempages -= reserve;
45100
45101 names_cachep = kmem_cache_create("names_cache", PATH_MAX, 0,
45102- SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL);
45103+ SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_USERCOPY, NULL);
45104
45105 dcache_init();
45106 inode_init();
45107diff -urNp linux-2.6.39/fs/dlm/lockspace.c linux-2.6.39/fs/dlm/lockspace.c
45108--- linux-2.6.39/fs/dlm/lockspace.c 2011-05-19 00:06:34.000000000 -0400
45109+++ linux-2.6.39/fs/dlm/lockspace.c 2011-05-22 19:36:32.000000000 -0400
45110@@ -200,7 +200,7 @@ static int dlm_uevent(struct kset *kset,
45111 return 0;
45112 }
45113
45114-static struct kset_uevent_ops dlm_uevent_ops = {
45115+static const struct kset_uevent_ops dlm_uevent_ops = {
45116 .uevent = dlm_uevent,
45117 };
45118
45119diff -urNp linux-2.6.39/fs/ecryptfs/inode.c linux-2.6.39/fs/ecryptfs/inode.c
45120--- linux-2.6.39/fs/ecryptfs/inode.c 2011-05-19 00:06:34.000000000 -0400
45121+++ linux-2.6.39/fs/ecryptfs/inode.c 2011-05-22 19:36:32.000000000 -0400
45122@@ -621,7 +621,7 @@ static int ecryptfs_readlink_lower(struc
45123 old_fs = get_fs();
45124 set_fs(get_ds());
45125 rc = lower_dentry->d_inode->i_op->readlink(lower_dentry,
45126- (char __user *)lower_buf,
45127+ (__force char __user *)lower_buf,
45128 lower_bufsiz);
45129 set_fs(old_fs);
45130 if (rc < 0)
45131@@ -667,7 +667,7 @@ static void *ecryptfs_follow_link(struct
45132 }
45133 old_fs = get_fs();
45134 set_fs(get_ds());
45135- rc = dentry->d_inode->i_op->readlink(dentry, (char __user *)buf, len);
45136+ rc = dentry->d_inode->i_op->readlink(dentry, (__force char __user *)buf, len);
45137 set_fs(old_fs);
45138 if (rc < 0) {
45139 kfree(buf);
45140@@ -682,7 +682,7 @@ out:
45141 static void
45142 ecryptfs_put_link(struct dentry *dentry, struct nameidata *nd, void *ptr)
45143 {
45144- char *buf = nd_get_link(nd);
45145+ const char *buf = nd_get_link(nd);
45146 if (!IS_ERR(buf)) {
45147 /* Free the char* */
45148 kfree(buf);
45149diff -urNp linux-2.6.39/fs/ecryptfs/miscdev.c linux-2.6.39/fs/ecryptfs/miscdev.c
45150--- linux-2.6.39/fs/ecryptfs/miscdev.c 2011-05-19 00:06:34.000000000 -0400
45151+++ linux-2.6.39/fs/ecryptfs/miscdev.c 2011-05-22 19:36:32.000000000 -0400
45152@@ -328,7 +328,7 @@ check_list:
45153 goto out_unlock_msg_ctx;
45154 i = 5;
45155 if (msg_ctx->msg) {
45156- if (copy_to_user(&buf[i], packet_length, packet_length_size))
45157+ if (packet_length_size > sizeof(packet_length) || copy_to_user(&buf[i], packet_length, packet_length_size))
45158 goto out_unlock_msg_ctx;
45159 i += packet_length_size;
45160 if (copy_to_user(&buf[i], msg_ctx->msg, msg_ctx->msg_size))
45161diff -urNp linux-2.6.39/fs/exec.c linux-2.6.39/fs/exec.c
45162--- linux-2.6.39/fs/exec.c 2011-05-19 00:06:34.000000000 -0400
45163+++ linux-2.6.39/fs/exec.c 2011-05-22 20:44:52.000000000 -0400
45164@@ -55,12 +55,24 @@
45165 #include <linux/fs_struct.h>
45166 #include <linux/pipe_fs_i.h>
45167 #include <linux/oom.h>
45168+#include <linux/random.h>
45169+#include <linux/seq_file.h>
45170+
45171+#ifdef CONFIG_PAX_REFCOUNT
45172+#include <linux/kallsyms.h>
45173+#include <linux/kdebug.h>
45174+#endif
45175
45176 #include <asm/uaccess.h>
45177 #include <asm/mmu_context.h>
45178 #include <asm/tlb.h>
45179 #include "internal.h"
45180
45181+#ifdef CONFIG_PAX_HOOK_ACL_FLAGS
45182+void (*pax_set_initial_flags_func)(struct linux_binprm *bprm);
45183+EXPORT_SYMBOL(pax_set_initial_flags_func);
45184+#endif
45185+
45186 int core_uses_pid;
45187 char core_pattern[CORENAME_MAX_SIZE] = "core";
45188 unsigned int core_pipe_limit;
45189@@ -70,7 +82,7 @@ struct core_name {
45190 char *corename;
45191 int used, size;
45192 };
45193-static atomic_t call_count = ATOMIC_INIT(1);
45194+static atomic_unchecked_t call_count = ATOMIC_INIT(1);
45195
45196 /* The maximal length of core_pattern is also specified in sysctl.c */
45197
45198@@ -116,7 +128,7 @@ SYSCALL_DEFINE1(uselib, const char __use
45199 char *tmp = getname(library);
45200 int error = PTR_ERR(tmp);
45201 static const struct open_flags uselib_flags = {
45202- .open_flag = O_LARGEFILE | O_RDONLY | __FMODE_EXEC,
45203+ .open_flag = O_LARGEFILE | O_RDONLY | __FMODE_EXEC | FMODE_GREXEC,
45204 .acc_mode = MAY_READ | MAY_EXEC | MAY_OPEN,
45205 .intent = LOOKUP_OPEN
45206 };
45207@@ -190,18 +202,10 @@ struct page *get_arg_page(struct linux_b
45208 int write)
45209 {
45210 struct page *page;
45211- int ret;
45212
45213-#ifdef CONFIG_STACK_GROWSUP
45214- if (write) {
45215- ret = expand_stack_downwards(bprm->vma, pos);
45216- if (ret < 0)
45217- return NULL;
45218- }
45219-#endif
45220- ret = get_user_pages(current, bprm->mm, pos,
45221- 1, write, 1, &page, NULL);
45222- if (ret <= 0)
45223+ if (0 > expand_stack_downwards(bprm->vma, pos))
45224+ return NULL;
45225+ if (0 >= get_user_pages(current, bprm->mm, pos, 1, write, 1, &page, NULL))
45226 return NULL;
45227
45228 if (write) {
45229@@ -276,6 +280,11 @@ static int __bprm_mm_init(struct linux_b
45230 vma->vm_end = STACK_TOP_MAX;
45231 vma->vm_start = vma->vm_end - PAGE_SIZE;
45232 vma->vm_flags = VM_STACK_FLAGS | VM_STACK_INCOMPLETE_SETUP;
45233+
45234+#ifdef CONFIG_PAX_SEGMEXEC
45235+ vma->vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
45236+#endif
45237+
45238 vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
45239 INIT_LIST_HEAD(&vma->anon_vma_chain);
45240
45241@@ -290,6 +299,12 @@ static int __bprm_mm_init(struct linux_b
45242 mm->stack_vm = mm->total_vm = 1;
45243 up_write(&mm->mmap_sem);
45244 bprm->p = vma->vm_end - sizeof(void *);
45245+
45246+#ifdef CONFIG_PAX_RANDUSTACK
45247+ if (randomize_va_space)
45248+ bprm->p ^= (pax_get_random_long() & ~15) & ~PAGE_MASK;
45249+#endif
45250+
45251 return 0;
45252 err:
45253 up_write(&mm->mmap_sem);
45254@@ -525,7 +540,7 @@ int copy_strings_kernel(int argc, const
45255 int r;
45256 mm_segment_t oldfs = get_fs();
45257 set_fs(KERNEL_DS);
45258- r = copy_strings(argc, (const char __user *const __user *)argv, bprm);
45259+ r = copy_strings(argc, (__force const char __user *const __user *)argv, bprm);
45260 set_fs(oldfs);
45261 return r;
45262 }
45263@@ -555,7 +570,8 @@ static int shift_arg_pages(struct vm_are
45264 unsigned long new_end = old_end - shift;
45265 struct mmu_gather *tlb;
45266
45267- BUG_ON(new_start > new_end);
45268+ if (new_start >= new_end || new_start < mmap_min_addr)
45269+ return -ENOMEM;
45270
45271 /*
45272 * ensure there are no vmas between where we want to go
45273@@ -564,6 +580,10 @@ static int shift_arg_pages(struct vm_are
45274 if (vma != find_vma(mm, new_start))
45275 return -EFAULT;
45276
45277+#ifdef CONFIG_PAX_SEGMEXEC
45278+ BUG_ON(pax_find_mirror_vma(vma));
45279+#endif
45280+
45281 /*
45282 * cover the whole range: [new_start, old_end)
45283 */
45284@@ -644,10 +664,6 @@ int setup_arg_pages(struct linux_binprm
45285 stack_top = arch_align_stack(stack_top);
45286 stack_top = PAGE_ALIGN(stack_top);
45287
45288- if (unlikely(stack_top < mmap_min_addr) ||
45289- unlikely(vma->vm_end - vma->vm_start >= stack_top - mmap_min_addr))
45290- return -ENOMEM;
45291-
45292 stack_shift = vma->vm_end - stack_top;
45293
45294 bprm->p -= stack_shift;
45295@@ -659,8 +675,28 @@ int setup_arg_pages(struct linux_binprm
45296 bprm->exec -= stack_shift;
45297
45298 down_write(&mm->mmap_sem);
45299+
45300+ /* Move stack pages down in memory. */
45301+ if (stack_shift) {
45302+ ret = shift_arg_pages(vma, stack_shift);
45303+ if (ret)
45304+ goto out_unlock;
45305+ }
45306+
45307 vm_flags = VM_STACK_FLAGS;
45308
45309+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
45310+ if (mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
45311+ vm_flags &= ~VM_EXEC;
45312+
45313+#ifdef CONFIG_PAX_MPROTECT
45314+ if (mm->pax_flags & MF_PAX_MPROTECT)
45315+ vm_flags &= ~VM_MAYEXEC;
45316+#endif
45317+
45318+ }
45319+#endif
45320+
45321 /*
45322 * Adjust stack execute permissions; explicitly enable for
45323 * EXSTACK_ENABLE_X, disable for EXSTACK_DISABLE_X and leave alone
45324@@ -679,13 +715,6 @@ int setup_arg_pages(struct linux_binprm
45325 goto out_unlock;
45326 BUG_ON(prev != vma);
45327
45328- /* Move stack pages down in memory. */
45329- if (stack_shift) {
45330- ret = shift_arg_pages(vma, stack_shift);
45331- if (ret)
45332- goto out_unlock;
45333- }
45334-
45335 /* mprotect_fixup is overkill to remove the temporary stack flags */
45336 vma->vm_flags &= ~VM_STACK_INCOMPLETE_SETUP;
45337
45338@@ -725,7 +754,7 @@ struct file *open_exec(const char *name)
45339 struct file *file;
45340 int err;
45341 static const struct open_flags open_exec_flags = {
45342- .open_flag = O_LARGEFILE | O_RDONLY | __FMODE_EXEC,
45343+ .open_flag = O_LARGEFILE | O_RDONLY | __FMODE_EXEC | FMODE_GREXEC,
45344 .acc_mode = MAY_EXEC | MAY_OPEN,
45345 .intent = LOOKUP_OPEN
45346 };
45347@@ -766,7 +795,7 @@ int kernel_read(struct file *file, loff_
45348 old_fs = get_fs();
45349 set_fs(get_ds());
45350 /* The cast to a user pointer is valid due to the set_fs() */
45351- result = vfs_read(file, (void __user *)addr, count, &pos);
45352+ result = vfs_read(file, (__force void __user *)addr, count, &pos);
45353 set_fs(old_fs);
45354 return result;
45355 }
45356@@ -1188,7 +1217,7 @@ int check_unsafe_exec(struct linux_binpr
45357 }
45358 rcu_read_unlock();
45359
45360- if (p->fs->users > n_fs) {
45361+ if (atomic_read(&p->fs->users) > n_fs) {
45362 bprm->unsafe |= LSM_UNSAFE_SHARE;
45363 } else {
45364 res = -EAGAIN;
45365@@ -1384,6 +1413,11 @@ int do_execve(const char * filename,
45366 const char __user *const __user *envp,
45367 struct pt_regs * regs)
45368 {
45369+#ifdef CONFIG_GRKERNSEC
45370+ struct file *old_exec_file;
45371+ struct acl_subject_label *old_acl;
45372+ struct rlimit old_rlim[RLIM_NLIMITS];
45373+#endif
45374 struct linux_binprm *bprm;
45375 struct file *file;
45376 struct files_struct *displaced;
45377@@ -1420,6 +1454,23 @@ int do_execve(const char * filename,
45378 bprm->filename = filename;
45379 bprm->interp = filename;
45380
45381+ if (gr_process_user_ban()) {
45382+ retval = -EPERM;
45383+ goto out_file;
45384+ }
45385+
45386+ gr_learn_resource(current, RLIMIT_NPROC, atomic_read(&current->cred->user->processes), 1);
45387+
45388+ if (gr_handle_nproc()) {
45389+ retval = -EAGAIN;
45390+ goto out_file;
45391+ }
45392+
45393+ if (!gr_acl_handle_execve(file->f_dentry, file->f_vfsmnt)) {
45394+ retval = -EACCES;
45395+ goto out_file;
45396+ }
45397+
45398 retval = bprm_mm_init(bprm);
45399 if (retval)
45400 goto out_file;
45401@@ -1449,9 +1500,40 @@ int do_execve(const char * filename,
45402 if (retval < 0)
45403 goto out;
45404
45405+ if (!gr_tpe_allow(file)) {
45406+ retval = -EACCES;
45407+ goto out;
45408+ }
45409+
45410+ if (gr_check_crash_exec(file)) {
45411+ retval = -EACCES;
45412+ goto out;
45413+ }
45414+
45415+ gr_log_chroot_exec(file->f_dentry, file->f_vfsmnt);
45416+
45417+ gr_handle_exec_args(bprm, argv);
45418+
45419+#ifdef CONFIG_GRKERNSEC
45420+ old_acl = current->acl;
45421+ memcpy(old_rlim, current->signal->rlim, sizeof(old_rlim));
45422+ old_exec_file = current->exec_file;
45423+ get_file(file);
45424+ current->exec_file = file;
45425+#endif
45426+
45427+ retval = gr_set_proc_label(file->f_dentry, file->f_vfsmnt,
45428+ bprm->unsafe & LSM_UNSAFE_SHARE);
45429+ if (retval < 0)
45430+ goto out_fail;
45431+
45432 retval = search_binary_handler(bprm,regs);
45433 if (retval < 0)
45434- goto out;
45435+ goto out_fail;
45436+#ifdef CONFIG_GRKERNSEC
45437+ if (old_exec_file)
45438+ fput(old_exec_file);
45439+#endif
45440
45441 /* execve succeeded */
45442 current->fs->in_exec = 0;
45443@@ -1462,6 +1544,14 @@ int do_execve(const char * filename,
45444 put_files_struct(displaced);
45445 return retval;
45446
45447+out_fail:
45448+#ifdef CONFIG_GRKERNSEC
45449+ current->acl = old_acl;
45450+ memcpy(current->signal->rlim, old_rlim, sizeof(old_rlim));
45451+ fput(current->exec_file);
45452+ current->exec_file = old_exec_file;
45453+#endif
45454+
45455 out:
45456 if (bprm->mm) {
45457 acct_arg_size(bprm, 0);
45458@@ -1507,7 +1597,7 @@ static int expand_corename(struct core_n
45459 {
45460 char *old_corename = cn->corename;
45461
45462- cn->size = CORENAME_MAX_SIZE * atomic_inc_return(&call_count);
45463+ cn->size = CORENAME_MAX_SIZE * atomic_inc_return_unchecked(&call_count);
45464 cn->corename = krealloc(old_corename, cn->size, GFP_KERNEL);
45465
45466 if (!cn->corename) {
45467@@ -1560,7 +1650,7 @@ static int format_corename(struct core_n
45468 int pid_in_pattern = 0;
45469 int err = 0;
45470
45471- cn->size = CORENAME_MAX_SIZE * atomic_read(&call_count);
45472+ cn->size = CORENAME_MAX_SIZE * atomic_read_unchecked(&call_count);
45473 cn->corename = kmalloc(cn->size, GFP_KERNEL);
45474 cn->used = 0;
45475
45476@@ -1648,6 +1738,208 @@ out:
45477 return ispipe;
45478 }
45479
45480+int pax_check_flags(unsigned long *flags)
45481+{
45482+ int retval = 0;
45483+
45484+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_SEGMEXEC)
45485+ if (*flags & MF_PAX_SEGMEXEC)
45486+ {
45487+ *flags &= ~MF_PAX_SEGMEXEC;
45488+ retval = -EINVAL;
45489+ }
45490+#endif
45491+
45492+ if ((*flags & MF_PAX_PAGEEXEC)
45493+
45494+#ifdef CONFIG_PAX_PAGEEXEC
45495+ && (*flags & MF_PAX_SEGMEXEC)
45496+#endif
45497+
45498+ )
45499+ {
45500+ *flags &= ~MF_PAX_PAGEEXEC;
45501+ retval = -EINVAL;
45502+ }
45503+
45504+ if ((*flags & MF_PAX_MPROTECT)
45505+
45506+#ifdef CONFIG_PAX_MPROTECT
45507+ && !(*flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC))
45508+#endif
45509+
45510+ )
45511+ {
45512+ *flags &= ~MF_PAX_MPROTECT;
45513+ retval = -EINVAL;
45514+ }
45515+
45516+ if ((*flags & MF_PAX_EMUTRAMP)
45517+
45518+#ifdef CONFIG_PAX_EMUTRAMP
45519+ && !(*flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC))
45520+#endif
45521+
45522+ )
45523+ {
45524+ *flags &= ~MF_PAX_EMUTRAMP;
45525+ retval = -EINVAL;
45526+ }
45527+
45528+ return retval;
45529+}
45530+
45531+EXPORT_SYMBOL(pax_check_flags);
45532+
45533+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
45534+void pax_report_fault(struct pt_regs *regs, void *pc, void *sp)
45535+{
45536+ struct task_struct *tsk = current;
45537+ struct mm_struct *mm = current->mm;
45538+ char *buffer_exec = (char *)__get_free_page(GFP_KERNEL);
45539+ char *buffer_fault = (char *)__get_free_page(GFP_KERNEL);
45540+ char *path_exec = NULL;
45541+ char *path_fault = NULL;
45542+ unsigned long start = 0UL, end = 0UL, offset = 0UL;
45543+
45544+ if (buffer_exec && buffer_fault) {
45545+ struct vm_area_struct *vma, *vma_exec = NULL, *vma_fault = NULL;
45546+
45547+ down_read(&mm->mmap_sem);
45548+ vma = mm->mmap;
45549+ while (vma && (!vma_exec || !vma_fault)) {
45550+ if ((vma->vm_flags & VM_EXECUTABLE) && vma->vm_file)
45551+ vma_exec = vma;
45552+ if (vma->vm_start <= (unsigned long)pc && (unsigned long)pc < vma->vm_end)
45553+ vma_fault = vma;
45554+ vma = vma->vm_next;
45555+ }
45556+ if (vma_exec) {
45557+ path_exec = d_path(&vma_exec->vm_file->f_path, buffer_exec, PAGE_SIZE);
45558+ if (IS_ERR(path_exec))
45559+ path_exec = "<path too long>";
45560+ else {
45561+ path_exec = mangle_path(buffer_exec, path_exec, "\t\n\\");
45562+ if (path_exec) {
45563+ *path_exec = 0;
45564+ path_exec = buffer_exec;
45565+ } else
45566+ path_exec = "<path too long>";
45567+ }
45568+ }
45569+ if (vma_fault) {
45570+ start = vma_fault->vm_start;
45571+ end = vma_fault->vm_end;
45572+ offset = vma_fault->vm_pgoff << PAGE_SHIFT;
45573+ if (vma_fault->vm_file) {
45574+ path_fault = d_path(&vma_fault->vm_file->f_path, buffer_fault, PAGE_SIZE);
45575+ if (IS_ERR(path_fault))
45576+ path_fault = "<path too long>";
45577+ else {
45578+ path_fault = mangle_path(buffer_fault, path_fault, "\t\n\\");
45579+ if (path_fault) {
45580+ *path_fault = 0;
45581+ path_fault = buffer_fault;
45582+ } else
45583+ path_fault = "<path too long>";
45584+ }
45585+ } else
45586+ path_fault = "<anonymous mapping>";
45587+ }
45588+ up_read(&mm->mmap_sem);
45589+ }
45590+ if (tsk->signal->curr_ip)
45591+ printk(KERN_ERR "PAX: From %pI4: execution attempt in: %s, %08lx-%08lx %08lx\n", &tsk->signal->curr_ip, path_fault, start, end, offset);
45592+ else
45593+ printk(KERN_ERR "PAX: execution attempt in: %s, %08lx-%08lx %08lx\n", path_fault, start, end, offset);
45594+ printk(KERN_ERR "PAX: terminating task: %s(%s):%d, uid/euid: %u/%u, "
45595+ "PC: %p, SP: %p\n", path_exec, tsk->comm, task_pid_nr(tsk),
45596+ task_uid(tsk), task_euid(tsk), pc, sp);
45597+ free_page((unsigned long)buffer_exec);
45598+ free_page((unsigned long)buffer_fault);
45599+ pax_report_insns(pc, sp);
45600+ do_coredump(SIGKILL, SIGKILL, regs);
45601+}
45602+#endif
45603+
45604+#ifdef CONFIG_PAX_REFCOUNT
45605+void pax_report_refcount_overflow(struct pt_regs *regs)
45606+{
45607+ if (current->signal->curr_ip)
45608+ printk(KERN_ERR "PAX: From %pI4: refcount overflow detected in: %s:%d, uid/euid: %u/%u\n",
45609+ &current->signal->curr_ip, current->comm, task_pid_nr(current), current_uid(), current_euid());
45610+ else
45611+ printk(KERN_ERR "PAX: refcount overflow detected in: %s:%d, uid/euid: %u/%u\n",
45612+ current->comm, task_pid_nr(current), current_uid(), current_euid());
45613+ print_symbol(KERN_ERR "PAX: refcount overflow occured at: %s\n", instruction_pointer(regs));
45614+ show_regs(regs);
45615+ force_sig_info(SIGKILL, SEND_SIG_FORCED, current);
45616+}
45617+#endif
45618+
45619+#ifdef CONFIG_PAX_USERCOPY
45620+/* 0: not at all, 1: fully, 2: fully inside frame, -1: partially (implies an error) */
45621+int object_is_on_stack(const void *obj, unsigned long len)
45622+{
45623+ const void * const stack = task_stack_page(current);
45624+ const void * const stackend = stack + THREAD_SIZE;
45625+
45626+#if defined(CONFIG_FRAME_POINTER) && defined(CONFIG_X86)
45627+ const void *frame = NULL;
45628+ const void *oldframe;
45629+#endif
45630+
45631+ if (obj + len < obj)
45632+ return -1;
45633+
45634+ if (obj + len <= stack || stackend <= obj)
45635+ return 0;
45636+
45637+ if (obj < stack || stackend < obj + len)
45638+ return -1;
45639+
45640+#if defined(CONFIG_FRAME_POINTER) && defined(CONFIG_X86)
45641+ oldframe = __builtin_frame_address(1);
45642+ if (oldframe)
45643+ frame = __builtin_frame_address(2);
45644+ /*
45645+ low ----------------------------------------------> high
45646+ [saved bp][saved ip][args][local vars][saved bp][saved ip]
45647+ ^----------------^
45648+ allow copies only within here
45649+ */
45650+ while (stack <= frame && frame < stackend) {
45651+ /* if obj + len extends past the last frame, this
45652+ check won't pass and the next frame will be 0,
45653+ causing us to bail out and correctly report
45654+ the copy as invalid
45655+ */
45656+ if (obj + len <= frame)
45657+ return obj >= oldframe + 2 * sizeof(void *) ? 2 : -1;
45658+ oldframe = frame;
45659+ frame = *(const void * const *)frame;
45660+ }
45661+ return -1;
45662+#else
45663+ return 1;
45664+#endif
45665+}
45666+
45667+
45668+void pax_report_usercopy(const void *ptr, unsigned long len, bool to, const char *type)
45669+{
45670+ if (current->signal->curr_ip)
45671+ printk(KERN_ERR "PAX: From %pI4: kernel memory %s attempt detected %s %p (%s) (%lu bytes)\n",
45672+ &current->signal->curr_ip, to ? "leak" : "overwrite", to ? "from" : "to", ptr, type ? : "unknown", len);
45673+ else
45674+ printk(KERN_ERR "PAX: kernel memory %s attempt detected %s %p (%s) (%lu bytes)\n",
45675+ to ? "leak" : "overwrite", to ? "from" : "to", ptr, type ? : "unknown", len);
45676+ dump_stack();
45677+ gr_handle_kernel_exploit();
45678+ do_group_exit(SIGKILL);
45679+}
45680+#endif
45681+
45682 static int zap_process(struct task_struct *start, int exit_code)
45683 {
45684 struct task_struct *t;
45685@@ -1858,17 +2150,17 @@ static void wait_for_dump_helpers(struct
45686 pipe = file->f_path.dentry->d_inode->i_pipe;
45687
45688 pipe_lock(pipe);
45689- pipe->readers++;
45690- pipe->writers--;
45691+ atomic_inc(&pipe->readers);
45692+ atomic_dec(&pipe->writers);
45693
45694- while ((pipe->readers > 1) && (!signal_pending(current))) {
45695+ while ((atomic_read(&pipe->readers) > 1) && (!signal_pending(current))) {
45696 wake_up_interruptible_sync(&pipe->wait);
45697 kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
45698 pipe_wait(pipe);
45699 }
45700
45701- pipe->readers--;
45702- pipe->writers++;
45703+ atomic_dec(&pipe->readers);
45704+ atomic_inc(&pipe->writers);
45705 pipe_unlock(pipe);
45706
45707 }
45708@@ -1929,7 +2221,7 @@ void do_coredump(long signr, int exit_co
45709 int retval = 0;
45710 int flag = 0;
45711 int ispipe;
45712- static atomic_t core_dump_count = ATOMIC_INIT(0);
45713+ static atomic_unchecked_t core_dump_count = ATOMIC_INIT(0);
45714 struct coredump_params cprm = {
45715 .signr = signr,
45716 .regs = regs,
45717@@ -1944,6 +2236,9 @@ void do_coredump(long signr, int exit_co
45718
45719 audit_core_dumps(signr);
45720
45721+ if (signr == SIGSEGV || signr == SIGBUS || signr == SIGKILL || signr == SIGILL)
45722+ gr_handle_brute_attach(current, cprm.mm_flags);
45723+
45724 binfmt = mm->binfmt;
45725 if (!binfmt || !binfmt->core_dump)
45726 goto fail;
45727@@ -1984,6 +2279,8 @@ void do_coredump(long signr, int exit_co
45728 goto fail_corename;
45729 }
45730
45731+ gr_learn_resource(current, RLIMIT_CORE, binfmt->min_coredump, 1);
45732+
45733 if (ispipe) {
45734 int dump_count;
45735 char **helper_argv;
45736@@ -2011,7 +2308,7 @@ void do_coredump(long signr, int exit_co
45737 }
45738 cprm.limit = RLIM_INFINITY;
45739
45740- dump_count = atomic_inc_return(&core_dump_count);
45741+ dump_count = atomic_inc_return_unchecked(&core_dump_count);
45742 if (core_pipe_limit && (core_pipe_limit < dump_count)) {
45743 printk(KERN_WARNING "Pid %d(%s) over core_pipe_limit\n",
45744 task_tgid_vnr(current), current->comm);
45745@@ -2081,7 +2378,7 @@ close_fail:
45746 filp_close(cprm.file, NULL);
45747 fail_dropcount:
45748 if (ispipe)
45749- atomic_dec(&core_dump_count);
45750+ atomic_dec_unchecked(&core_dump_count);
45751 fail_unlock:
45752 kfree(cn.corename);
45753 fail_corename:
45754diff -urNp linux-2.6.39/fs/ext2/balloc.c linux-2.6.39/fs/ext2/balloc.c
45755--- linux-2.6.39/fs/ext2/balloc.c 2011-05-19 00:06:34.000000000 -0400
45756+++ linux-2.6.39/fs/ext2/balloc.c 2011-05-22 19:41:37.000000000 -0400
45757@@ -1192,7 +1192,7 @@ static int ext2_has_free_blocks(struct e
45758
45759 free_blocks = percpu_counter_read_positive(&sbi->s_freeblocks_counter);
45760 root_blocks = le32_to_cpu(sbi->s_es->s_r_blocks_count);
45761- if (free_blocks < root_blocks + 1 && !capable(CAP_SYS_RESOURCE) &&
45762+ if (free_blocks < root_blocks + 1 && !capable_nolog(CAP_SYS_RESOURCE) &&
45763 sbi->s_resuid != current_fsuid() &&
45764 (sbi->s_resgid == 0 || !in_group_p (sbi->s_resgid))) {
45765 return 0;
45766diff -urNp linux-2.6.39/fs/ext3/balloc.c linux-2.6.39/fs/ext3/balloc.c
45767--- linux-2.6.39/fs/ext3/balloc.c 2011-05-19 00:06:34.000000000 -0400
45768+++ linux-2.6.39/fs/ext3/balloc.c 2011-05-22 19:41:37.000000000 -0400
45769@@ -1441,7 +1441,7 @@ static int ext3_has_free_blocks(struct e
45770
45771 free_blocks = percpu_counter_read_positive(&sbi->s_freeblocks_counter);
45772 root_blocks = le32_to_cpu(sbi->s_es->s_r_blocks_count);
45773- if (free_blocks < root_blocks + 1 && !capable(CAP_SYS_RESOURCE) &&
45774+ if (free_blocks < root_blocks + 1 && !capable_nolog(CAP_SYS_RESOURCE) &&
45775 sbi->s_resuid != current_fsuid() &&
45776 (sbi->s_resgid == 0 || !in_group_p (sbi->s_resgid))) {
45777 return 0;
45778diff -urNp linux-2.6.39/fs/ext4/balloc.c linux-2.6.39/fs/ext4/balloc.c
45779--- linux-2.6.39/fs/ext4/balloc.c 2011-05-19 00:06:34.000000000 -0400
45780+++ linux-2.6.39/fs/ext4/balloc.c 2011-05-22 19:41:37.000000000 -0400
45781@@ -522,7 +522,7 @@ static int ext4_has_free_blocks(struct e
45782 /* Hm, nope. Are (enough) root reserved blocks available? */
45783 if (sbi->s_resuid == current_fsuid() ||
45784 ((sbi->s_resgid != 0) && in_group_p(sbi->s_resgid)) ||
45785- capable(CAP_SYS_RESOURCE)) {
45786+ capable_nolog(CAP_SYS_RESOURCE)) {
45787 if (free_blocks >= (nblocks + dirty_blocks))
45788 return 1;
45789 }
45790diff -urNp linux-2.6.39/fs/ext4/ext4.h linux-2.6.39/fs/ext4/ext4.h
45791--- linux-2.6.39/fs/ext4/ext4.h 2011-05-19 00:06:34.000000000 -0400
45792+++ linux-2.6.39/fs/ext4/ext4.h 2011-05-22 19:36:32.000000000 -0400
45793@@ -1166,19 +1166,19 @@ struct ext4_sb_info {
45794 unsigned long s_mb_last_start;
45795
45796 /* stats for buddy allocator */
45797- atomic_t s_bal_reqs; /* number of reqs with len > 1 */
45798- atomic_t s_bal_success; /* we found long enough chunks */
45799- atomic_t s_bal_allocated; /* in blocks */
45800- atomic_t s_bal_ex_scanned; /* total extents scanned */
45801- atomic_t s_bal_goals; /* goal hits */
45802- atomic_t s_bal_breaks; /* too long searches */
45803- atomic_t s_bal_2orders; /* 2^order hits */
45804+ atomic_unchecked_t s_bal_reqs; /* number of reqs with len > 1 */
45805+ atomic_unchecked_t s_bal_success; /* we found long enough chunks */
45806+ atomic_unchecked_t s_bal_allocated; /* in blocks */
45807+ atomic_unchecked_t s_bal_ex_scanned; /* total extents scanned */
45808+ atomic_unchecked_t s_bal_goals; /* goal hits */
45809+ atomic_unchecked_t s_bal_breaks; /* too long searches */
45810+ atomic_unchecked_t s_bal_2orders; /* 2^order hits */
45811 spinlock_t s_bal_lock;
45812 unsigned long s_mb_buddies_generated;
45813 unsigned long long s_mb_generation_time;
45814- atomic_t s_mb_lost_chunks;
45815- atomic_t s_mb_preallocated;
45816- atomic_t s_mb_discarded;
45817+ atomic_unchecked_t s_mb_lost_chunks;
45818+ atomic_unchecked_t s_mb_preallocated;
45819+ atomic_unchecked_t s_mb_discarded;
45820 atomic_t s_lock_busy;
45821
45822 /* locality groups */
45823diff -urNp linux-2.6.39/fs/ext4/mballoc.c linux-2.6.39/fs/ext4/mballoc.c
45824--- linux-2.6.39/fs/ext4/mballoc.c 2011-05-19 00:06:34.000000000 -0400
45825+++ linux-2.6.39/fs/ext4/mballoc.c 2011-05-22 19:36:32.000000000 -0400
45826@@ -1851,7 +1851,7 @@ void ext4_mb_simple_scan_group(struct ex
45827 BUG_ON(ac->ac_b_ex.fe_len != ac->ac_g_ex.fe_len);
45828
45829 if (EXT4_SB(sb)->s_mb_stats)
45830- atomic_inc(&EXT4_SB(sb)->s_bal_2orders);
45831+ atomic_inc_unchecked(&EXT4_SB(sb)->s_bal_2orders);
45832
45833 break;
45834 }
45835@@ -2145,7 +2145,7 @@ repeat:
45836 ac->ac_status = AC_STATUS_CONTINUE;
45837 ac->ac_flags |= EXT4_MB_HINT_FIRST;
45838 cr = 3;
45839- atomic_inc(&sbi->s_mb_lost_chunks);
45840+ atomic_inc_unchecked(&sbi->s_mb_lost_chunks);
45841 goto repeat;
45842 }
45843 }
45844@@ -2188,6 +2188,8 @@ static int ext4_mb_seq_groups_show(struc
45845 ext4_grpblk_t counters[16];
45846 } sg;
45847
45848+ pax_track_stack();
45849+
45850 group--;
45851 if (group == 0)
45852 seq_printf(seq, "#%-5s: %-5s %-5s %-5s "
45853@@ -2611,25 +2613,25 @@ int ext4_mb_release(struct super_block *
45854 if (sbi->s_mb_stats) {
45855 printk(KERN_INFO
45856 "EXT4-fs: mballoc: %u blocks %u reqs (%u success)\n",
45857- atomic_read(&sbi->s_bal_allocated),
45858- atomic_read(&sbi->s_bal_reqs),
45859- atomic_read(&sbi->s_bal_success));
45860+ atomic_read_unchecked(&sbi->s_bal_allocated),
45861+ atomic_read_unchecked(&sbi->s_bal_reqs),
45862+ atomic_read_unchecked(&sbi->s_bal_success));
45863 printk(KERN_INFO
45864 "EXT4-fs: mballoc: %u extents scanned, %u goal hits, "
45865 "%u 2^N hits, %u breaks, %u lost\n",
45866- atomic_read(&sbi->s_bal_ex_scanned),
45867- atomic_read(&sbi->s_bal_goals),
45868- atomic_read(&sbi->s_bal_2orders),
45869- atomic_read(&sbi->s_bal_breaks),
45870- atomic_read(&sbi->s_mb_lost_chunks));
45871+ atomic_read_unchecked(&sbi->s_bal_ex_scanned),
45872+ atomic_read_unchecked(&sbi->s_bal_goals),
45873+ atomic_read_unchecked(&sbi->s_bal_2orders),
45874+ atomic_read_unchecked(&sbi->s_bal_breaks),
45875+ atomic_read_unchecked(&sbi->s_mb_lost_chunks));
45876 printk(KERN_INFO
45877 "EXT4-fs: mballoc: %lu generated and it took %Lu\n",
45878 sbi->s_mb_buddies_generated++,
45879 sbi->s_mb_generation_time);
45880 printk(KERN_INFO
45881 "EXT4-fs: mballoc: %u preallocated, %u discarded\n",
45882- atomic_read(&sbi->s_mb_preallocated),
45883- atomic_read(&sbi->s_mb_discarded));
45884+ atomic_read_unchecked(&sbi->s_mb_preallocated),
45885+ atomic_read_unchecked(&sbi->s_mb_discarded));
45886 }
45887
45888 free_percpu(sbi->s_locality_groups);
45889@@ -3105,16 +3107,16 @@ static void ext4_mb_collect_stats(struct
45890 struct ext4_sb_info *sbi = EXT4_SB(ac->ac_sb);
45891
45892 if (sbi->s_mb_stats && ac->ac_g_ex.fe_len > 1) {
45893- atomic_inc(&sbi->s_bal_reqs);
45894- atomic_add(ac->ac_b_ex.fe_len, &sbi->s_bal_allocated);
45895+ atomic_inc_unchecked(&sbi->s_bal_reqs);
45896+ atomic_add_unchecked(ac->ac_b_ex.fe_len, &sbi->s_bal_allocated);
45897 if (ac->ac_b_ex.fe_len >= ac->ac_o_ex.fe_len)
45898- atomic_inc(&sbi->s_bal_success);
45899- atomic_add(ac->ac_found, &sbi->s_bal_ex_scanned);
45900+ atomic_inc_unchecked(&sbi->s_bal_success);
45901+ atomic_add_unchecked(ac->ac_found, &sbi->s_bal_ex_scanned);
45902 if (ac->ac_g_ex.fe_start == ac->ac_b_ex.fe_start &&
45903 ac->ac_g_ex.fe_group == ac->ac_b_ex.fe_group)
45904- atomic_inc(&sbi->s_bal_goals);
45905+ atomic_inc_unchecked(&sbi->s_bal_goals);
45906 if (ac->ac_found > sbi->s_mb_max_to_scan)
45907- atomic_inc(&sbi->s_bal_breaks);
45908+ atomic_inc_unchecked(&sbi->s_bal_breaks);
45909 }
45910
45911 if (ac->ac_op == EXT4_MB_HISTORY_ALLOC)
45912@@ -3512,7 +3514,7 @@ ext4_mb_new_inode_pa(struct ext4_allocat
45913 trace_ext4_mb_new_inode_pa(ac, pa);
45914
45915 ext4_mb_use_inode_pa(ac, pa);
45916- atomic_add(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
45917+ atomic_add_unchecked(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
45918
45919 ei = EXT4_I(ac->ac_inode);
45920 grp = ext4_get_group_info(sb, ac->ac_b_ex.fe_group);
45921@@ -3572,7 +3574,7 @@ ext4_mb_new_group_pa(struct ext4_allocat
45922 trace_ext4_mb_new_group_pa(ac, pa);
45923
45924 ext4_mb_use_group_pa(ac, pa);
45925- atomic_add(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
45926+ atomic_add_unchecked(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
45927
45928 grp = ext4_get_group_info(sb, ac->ac_b_ex.fe_group);
45929 lg = ac->ac_lg;
45930@@ -3659,7 +3661,7 @@ ext4_mb_release_inode_pa(struct ext4_bud
45931 * from the bitmap and continue.
45932 */
45933 }
45934- atomic_add(free, &sbi->s_mb_discarded);
45935+ atomic_add_unchecked(free, &sbi->s_mb_discarded);
45936
45937 return err;
45938 }
45939@@ -3677,7 +3679,7 @@ ext4_mb_release_group_pa(struct ext4_bud
45940 ext4_get_group_no_and_offset(sb, pa->pa_pstart, &group, &bit);
45941 BUG_ON(group != e4b->bd_group && pa->pa_len != 0);
45942 mb_free_blocks(pa->pa_inode, e4b, bit, pa->pa_len);
45943- atomic_add(pa->pa_len, &EXT4_SB(sb)->s_mb_discarded);
45944+ atomic_add_unchecked(pa->pa_len, &EXT4_SB(sb)->s_mb_discarded);
45945 trace_ext4_mballoc_discard(sb, NULL, group, bit, pa->pa_len);
45946
45947 return 0;
45948diff -urNp linux-2.6.39/fs/fcntl.c linux-2.6.39/fs/fcntl.c
45949--- linux-2.6.39/fs/fcntl.c 2011-05-19 00:06:34.000000000 -0400
45950+++ linux-2.6.39/fs/fcntl.c 2011-05-22 20:45:50.000000000 -0400
45951@@ -224,6 +224,11 @@ int __f_setown(struct file *filp, struct
45952 if (err)
45953 return err;
45954
45955+ if (gr_handle_chroot_fowner(pid, type))
45956+ return -ENOENT;
45957+ if (gr_check_protected_task_fowner(pid, type))
45958+ return -EACCES;
45959+
45960 f_modown(filp, pid, type, force);
45961 return 0;
45962 }
45963@@ -348,6 +353,7 @@ static long do_fcntl(int fd, unsigned in
45964 switch (cmd) {
45965 case F_DUPFD:
45966 case F_DUPFD_CLOEXEC:
45967+ gr_learn_resource(current, RLIMIT_NOFILE, arg, 0);
45968 if (arg >= rlimit(RLIMIT_NOFILE))
45969 break;
45970 err = alloc_fd(arg, cmd == F_DUPFD_CLOEXEC ? O_CLOEXEC : 0);
45971@@ -835,14 +841,14 @@ static int __init fcntl_init(void)
45972 * Exceptions: O_NONBLOCK is a two bit define on parisc; O_NDELAY
45973 * is defined as O_NONBLOCK on some platforms and not on others.
45974 */
45975- BUILD_BUG_ON(19 - 1 /* for O_RDONLY being 0 */ != HWEIGHT32(
45976+ BUILD_BUG_ON(20 - 1 /* for O_RDONLY being 0 */ != HWEIGHT32(
45977 O_RDONLY | O_WRONLY | O_RDWR |
45978 O_CREAT | O_EXCL | O_NOCTTY |
45979 O_TRUNC | O_APPEND | /* O_NONBLOCK | */
45980 __O_SYNC | O_DSYNC | FASYNC |
45981 O_DIRECT | O_LARGEFILE | O_DIRECTORY |
45982 O_NOFOLLOW | O_NOATIME | O_CLOEXEC |
45983- __FMODE_EXEC | O_PATH
45984+ __FMODE_EXEC | O_PATH | FMODE_GREXEC
45985 ));
45986
45987 fasync_cache = kmem_cache_create("fasync_cache",
45988diff -urNp linux-2.6.39/fs/fifo.c linux-2.6.39/fs/fifo.c
45989--- linux-2.6.39/fs/fifo.c 2011-05-19 00:06:34.000000000 -0400
45990+++ linux-2.6.39/fs/fifo.c 2011-05-22 19:36:32.000000000 -0400
45991@@ -58,10 +58,10 @@ static int fifo_open(struct inode *inode
45992 */
45993 filp->f_op = &read_pipefifo_fops;
45994 pipe->r_counter++;
45995- if (pipe->readers++ == 0)
45996+ if (atomic_inc_return(&pipe->readers) == 1)
45997 wake_up_partner(inode);
45998
45999- if (!pipe->writers) {
46000+ if (!atomic_read(&pipe->writers)) {
46001 if ((filp->f_flags & O_NONBLOCK)) {
46002 /* suppress POLLHUP until we have
46003 * seen a writer */
46004@@ -81,15 +81,15 @@ static int fifo_open(struct inode *inode
46005 * errno=ENXIO when there is no process reading the FIFO.
46006 */
46007 ret = -ENXIO;
46008- if ((filp->f_flags & O_NONBLOCK) && !pipe->readers)
46009+ if ((filp->f_flags & O_NONBLOCK) && !atomic_read(&pipe->readers))
46010 goto err;
46011
46012 filp->f_op = &write_pipefifo_fops;
46013 pipe->w_counter++;
46014- if (!pipe->writers++)
46015+ if (atomic_inc_return(&pipe->writers) == 1)
46016 wake_up_partner(inode);
46017
46018- if (!pipe->readers) {
46019+ if (!atomic_read(&pipe->readers)) {
46020 wait_for_partner(inode, &pipe->r_counter);
46021 if (signal_pending(current))
46022 goto err_wr;
46023@@ -105,11 +105,11 @@ static int fifo_open(struct inode *inode
46024 */
46025 filp->f_op = &rdwr_pipefifo_fops;
46026
46027- pipe->readers++;
46028- pipe->writers++;
46029+ atomic_inc(&pipe->readers);
46030+ atomic_inc(&pipe->writers);
46031 pipe->r_counter++;
46032 pipe->w_counter++;
46033- if (pipe->readers == 1 || pipe->writers == 1)
46034+ if (atomic_read(&pipe->readers) == 1 || atomic_read(&pipe->writers) == 1)
46035 wake_up_partner(inode);
46036 break;
46037
46038@@ -123,19 +123,19 @@ static int fifo_open(struct inode *inode
46039 return 0;
46040
46041 err_rd:
46042- if (!--pipe->readers)
46043+ if (atomic_dec_and_test(&pipe->readers))
46044 wake_up_interruptible(&pipe->wait);
46045 ret = -ERESTARTSYS;
46046 goto err;
46047
46048 err_wr:
46049- if (!--pipe->writers)
46050+ if (atomic_dec_and_test(&pipe->writers))
46051 wake_up_interruptible(&pipe->wait);
46052 ret = -ERESTARTSYS;
46053 goto err;
46054
46055 err:
46056- if (!pipe->readers && !pipe->writers)
46057+ if (!atomic_read(&pipe->readers) && !atomic_read(&pipe->writers))
46058 free_pipe_info(inode);
46059
46060 err_nocleanup:
46061diff -urNp linux-2.6.39/fs/file.c linux-2.6.39/fs/file.c
46062--- linux-2.6.39/fs/file.c 2011-05-19 00:06:34.000000000 -0400
46063+++ linux-2.6.39/fs/file.c 2011-05-22 19:41:37.000000000 -0400
46064@@ -15,6 +15,7 @@
46065 #include <linux/slab.h>
46066 #include <linux/vmalloc.h>
46067 #include <linux/file.h>
46068+#include <linux/security.h>
46069 #include <linux/fdtable.h>
46070 #include <linux/bitops.h>
46071 #include <linux/interrupt.h>
46072@@ -254,6 +255,7 @@ int expand_files(struct files_struct *fi
46073 * N.B. For clone tasks sharing a files structure, this test
46074 * will limit the total number of files that can be opened.
46075 */
46076+ gr_learn_resource(current, RLIMIT_NOFILE, nr, 0);
46077 if (nr >= rlimit(RLIMIT_NOFILE))
46078 return -EMFILE;
46079
46080diff -urNp linux-2.6.39/fs/filesystems.c linux-2.6.39/fs/filesystems.c
46081--- linux-2.6.39/fs/filesystems.c 2011-05-19 00:06:34.000000000 -0400
46082+++ linux-2.6.39/fs/filesystems.c 2011-05-22 19:41:37.000000000 -0400
46083@@ -274,7 +274,12 @@ struct file_system_type *get_fs_type(con
46084 int len = dot ? dot - name : strlen(name);
46085
46086 fs = __get_fs_type(name, len);
46087+
46088+#ifdef CONFIG_GRKERNSEC_MODHARDEN
46089+ if (!fs && (___request_module(true, "grsec_modharden_fs", "%.*s", len, name) == 0))
46090+#else
46091 if (!fs && (request_module("%.*s", len, name) == 0))
46092+#endif
46093 fs = __get_fs_type(name, len);
46094
46095 if (dot && fs && !(fs->fs_flags & FS_HAS_SUBTYPE)) {
46096diff -urNp linux-2.6.39/fs/fscache/cookie.c linux-2.6.39/fs/fscache/cookie.c
46097--- linux-2.6.39/fs/fscache/cookie.c 2011-05-19 00:06:34.000000000 -0400
46098+++ linux-2.6.39/fs/fscache/cookie.c 2011-05-22 19:36:32.000000000 -0400
46099@@ -68,11 +68,11 @@ struct fscache_cookie *__fscache_acquire
46100 parent ? (char *) parent->def->name : "<no-parent>",
46101 def->name, netfs_data);
46102
46103- fscache_stat(&fscache_n_acquires);
46104+ fscache_stat_unchecked(&fscache_n_acquires);
46105
46106 /* if there's no parent cookie, then we don't create one here either */
46107 if (!parent) {
46108- fscache_stat(&fscache_n_acquires_null);
46109+ fscache_stat_unchecked(&fscache_n_acquires_null);
46110 _leave(" [no parent]");
46111 return NULL;
46112 }
46113@@ -87,7 +87,7 @@ struct fscache_cookie *__fscache_acquire
46114 /* allocate and initialise a cookie */
46115 cookie = kmem_cache_alloc(fscache_cookie_jar, GFP_KERNEL);
46116 if (!cookie) {
46117- fscache_stat(&fscache_n_acquires_oom);
46118+ fscache_stat_unchecked(&fscache_n_acquires_oom);
46119 _leave(" [ENOMEM]");
46120 return NULL;
46121 }
46122@@ -109,13 +109,13 @@ struct fscache_cookie *__fscache_acquire
46123
46124 switch (cookie->def->type) {
46125 case FSCACHE_COOKIE_TYPE_INDEX:
46126- fscache_stat(&fscache_n_cookie_index);
46127+ fscache_stat_unchecked(&fscache_n_cookie_index);
46128 break;
46129 case FSCACHE_COOKIE_TYPE_DATAFILE:
46130- fscache_stat(&fscache_n_cookie_data);
46131+ fscache_stat_unchecked(&fscache_n_cookie_data);
46132 break;
46133 default:
46134- fscache_stat(&fscache_n_cookie_special);
46135+ fscache_stat_unchecked(&fscache_n_cookie_special);
46136 break;
46137 }
46138
46139@@ -126,13 +126,13 @@ struct fscache_cookie *__fscache_acquire
46140 if (fscache_acquire_non_index_cookie(cookie) < 0) {
46141 atomic_dec(&parent->n_children);
46142 __fscache_cookie_put(cookie);
46143- fscache_stat(&fscache_n_acquires_nobufs);
46144+ fscache_stat_unchecked(&fscache_n_acquires_nobufs);
46145 _leave(" = NULL");
46146 return NULL;
46147 }
46148 }
46149
46150- fscache_stat(&fscache_n_acquires_ok);
46151+ fscache_stat_unchecked(&fscache_n_acquires_ok);
46152 _leave(" = %p", cookie);
46153 return cookie;
46154 }
46155@@ -168,7 +168,7 @@ static int fscache_acquire_non_index_coo
46156 cache = fscache_select_cache_for_object(cookie->parent);
46157 if (!cache) {
46158 up_read(&fscache_addremove_sem);
46159- fscache_stat(&fscache_n_acquires_no_cache);
46160+ fscache_stat_unchecked(&fscache_n_acquires_no_cache);
46161 _leave(" = -ENOMEDIUM [no cache]");
46162 return -ENOMEDIUM;
46163 }
46164@@ -256,12 +256,12 @@ static int fscache_alloc_object(struct f
46165 object = cache->ops->alloc_object(cache, cookie);
46166 fscache_stat_d(&fscache_n_cop_alloc_object);
46167 if (IS_ERR(object)) {
46168- fscache_stat(&fscache_n_object_no_alloc);
46169+ fscache_stat_unchecked(&fscache_n_object_no_alloc);
46170 ret = PTR_ERR(object);
46171 goto error;
46172 }
46173
46174- fscache_stat(&fscache_n_object_alloc);
46175+ fscache_stat_unchecked(&fscache_n_object_alloc);
46176
46177 object->debug_id = atomic_inc_return(&fscache_object_debug_id);
46178
46179@@ -377,10 +377,10 @@ void __fscache_update_cookie(struct fsca
46180 struct fscache_object *object;
46181 struct hlist_node *_p;
46182
46183- fscache_stat(&fscache_n_updates);
46184+ fscache_stat_unchecked(&fscache_n_updates);
46185
46186 if (!cookie) {
46187- fscache_stat(&fscache_n_updates_null);
46188+ fscache_stat_unchecked(&fscache_n_updates_null);
46189 _leave(" [no cookie]");
46190 return;
46191 }
46192@@ -414,12 +414,12 @@ void __fscache_relinquish_cookie(struct
46193 struct fscache_object *object;
46194 unsigned long event;
46195
46196- fscache_stat(&fscache_n_relinquishes);
46197+ fscache_stat_unchecked(&fscache_n_relinquishes);
46198 if (retire)
46199- fscache_stat(&fscache_n_relinquishes_retire);
46200+ fscache_stat_unchecked(&fscache_n_relinquishes_retire);
46201
46202 if (!cookie) {
46203- fscache_stat(&fscache_n_relinquishes_null);
46204+ fscache_stat_unchecked(&fscache_n_relinquishes_null);
46205 _leave(" [no cookie]");
46206 return;
46207 }
46208@@ -435,7 +435,7 @@ void __fscache_relinquish_cookie(struct
46209
46210 /* wait for the cookie to finish being instantiated (or to fail) */
46211 if (test_bit(FSCACHE_COOKIE_CREATING, &cookie->flags)) {
46212- fscache_stat(&fscache_n_relinquishes_waitcrt);
46213+ fscache_stat_unchecked(&fscache_n_relinquishes_waitcrt);
46214 wait_on_bit(&cookie->flags, FSCACHE_COOKIE_CREATING,
46215 fscache_wait_bit, TASK_UNINTERRUPTIBLE);
46216 }
46217diff -urNp linux-2.6.39/fs/fscache/internal.h linux-2.6.39/fs/fscache/internal.h
46218--- linux-2.6.39/fs/fscache/internal.h 2011-05-19 00:06:34.000000000 -0400
46219+++ linux-2.6.39/fs/fscache/internal.h 2011-05-22 19:36:32.000000000 -0400
46220@@ -144,94 +144,94 @@ extern void fscache_proc_cleanup(void);
46221 extern atomic_t fscache_n_ops_processed[FSCACHE_MAX_THREADS];
46222 extern atomic_t fscache_n_objs_processed[FSCACHE_MAX_THREADS];
46223
46224-extern atomic_t fscache_n_op_pend;
46225-extern atomic_t fscache_n_op_run;
46226-extern atomic_t fscache_n_op_enqueue;
46227-extern atomic_t fscache_n_op_deferred_release;
46228-extern atomic_t fscache_n_op_release;
46229-extern atomic_t fscache_n_op_gc;
46230-extern atomic_t fscache_n_op_cancelled;
46231-extern atomic_t fscache_n_op_rejected;
46232-
46233-extern atomic_t fscache_n_attr_changed;
46234-extern atomic_t fscache_n_attr_changed_ok;
46235-extern atomic_t fscache_n_attr_changed_nobufs;
46236-extern atomic_t fscache_n_attr_changed_nomem;
46237-extern atomic_t fscache_n_attr_changed_calls;
46238-
46239-extern atomic_t fscache_n_allocs;
46240-extern atomic_t fscache_n_allocs_ok;
46241-extern atomic_t fscache_n_allocs_wait;
46242-extern atomic_t fscache_n_allocs_nobufs;
46243-extern atomic_t fscache_n_allocs_intr;
46244-extern atomic_t fscache_n_allocs_object_dead;
46245-extern atomic_t fscache_n_alloc_ops;
46246-extern atomic_t fscache_n_alloc_op_waits;
46247-
46248-extern atomic_t fscache_n_retrievals;
46249-extern atomic_t fscache_n_retrievals_ok;
46250-extern atomic_t fscache_n_retrievals_wait;
46251-extern atomic_t fscache_n_retrievals_nodata;
46252-extern atomic_t fscache_n_retrievals_nobufs;
46253-extern atomic_t fscache_n_retrievals_intr;
46254-extern atomic_t fscache_n_retrievals_nomem;
46255-extern atomic_t fscache_n_retrievals_object_dead;
46256-extern atomic_t fscache_n_retrieval_ops;
46257-extern atomic_t fscache_n_retrieval_op_waits;
46258-
46259-extern atomic_t fscache_n_stores;
46260-extern atomic_t fscache_n_stores_ok;
46261-extern atomic_t fscache_n_stores_again;
46262-extern atomic_t fscache_n_stores_nobufs;
46263-extern atomic_t fscache_n_stores_oom;
46264-extern atomic_t fscache_n_store_ops;
46265-extern atomic_t fscache_n_store_calls;
46266-extern atomic_t fscache_n_store_pages;
46267-extern atomic_t fscache_n_store_radix_deletes;
46268-extern atomic_t fscache_n_store_pages_over_limit;
46269-
46270-extern atomic_t fscache_n_store_vmscan_not_storing;
46271-extern atomic_t fscache_n_store_vmscan_gone;
46272-extern atomic_t fscache_n_store_vmscan_busy;
46273-extern atomic_t fscache_n_store_vmscan_cancelled;
46274-
46275-extern atomic_t fscache_n_marks;
46276-extern atomic_t fscache_n_uncaches;
46277-
46278-extern atomic_t fscache_n_acquires;
46279-extern atomic_t fscache_n_acquires_null;
46280-extern atomic_t fscache_n_acquires_no_cache;
46281-extern atomic_t fscache_n_acquires_ok;
46282-extern atomic_t fscache_n_acquires_nobufs;
46283-extern atomic_t fscache_n_acquires_oom;
46284-
46285-extern atomic_t fscache_n_updates;
46286-extern atomic_t fscache_n_updates_null;
46287-extern atomic_t fscache_n_updates_run;
46288-
46289-extern atomic_t fscache_n_relinquishes;
46290-extern atomic_t fscache_n_relinquishes_null;
46291-extern atomic_t fscache_n_relinquishes_waitcrt;
46292-extern atomic_t fscache_n_relinquishes_retire;
46293-
46294-extern atomic_t fscache_n_cookie_index;
46295-extern atomic_t fscache_n_cookie_data;
46296-extern atomic_t fscache_n_cookie_special;
46297-
46298-extern atomic_t fscache_n_object_alloc;
46299-extern atomic_t fscache_n_object_no_alloc;
46300-extern atomic_t fscache_n_object_lookups;
46301-extern atomic_t fscache_n_object_lookups_negative;
46302-extern atomic_t fscache_n_object_lookups_positive;
46303-extern atomic_t fscache_n_object_lookups_timed_out;
46304-extern atomic_t fscache_n_object_created;
46305-extern atomic_t fscache_n_object_avail;
46306-extern atomic_t fscache_n_object_dead;
46307-
46308-extern atomic_t fscache_n_checkaux_none;
46309-extern atomic_t fscache_n_checkaux_okay;
46310-extern atomic_t fscache_n_checkaux_update;
46311-extern atomic_t fscache_n_checkaux_obsolete;
46312+extern atomic_unchecked_t fscache_n_op_pend;
46313+extern atomic_unchecked_t fscache_n_op_run;
46314+extern atomic_unchecked_t fscache_n_op_enqueue;
46315+extern atomic_unchecked_t fscache_n_op_deferred_release;
46316+extern atomic_unchecked_t fscache_n_op_release;
46317+extern atomic_unchecked_t fscache_n_op_gc;
46318+extern atomic_unchecked_t fscache_n_op_cancelled;
46319+extern atomic_unchecked_t fscache_n_op_rejected;
46320+
46321+extern atomic_unchecked_t fscache_n_attr_changed;
46322+extern atomic_unchecked_t fscache_n_attr_changed_ok;
46323+extern atomic_unchecked_t fscache_n_attr_changed_nobufs;
46324+extern atomic_unchecked_t fscache_n_attr_changed_nomem;
46325+extern atomic_unchecked_t fscache_n_attr_changed_calls;
46326+
46327+extern atomic_unchecked_t fscache_n_allocs;
46328+extern atomic_unchecked_t fscache_n_allocs_ok;
46329+extern atomic_unchecked_t fscache_n_allocs_wait;
46330+extern atomic_unchecked_t fscache_n_allocs_nobufs;
46331+extern atomic_unchecked_t fscache_n_allocs_intr;
46332+extern atomic_unchecked_t fscache_n_allocs_object_dead;
46333+extern atomic_unchecked_t fscache_n_alloc_ops;
46334+extern atomic_unchecked_t fscache_n_alloc_op_waits;
46335+
46336+extern atomic_unchecked_t fscache_n_retrievals;
46337+extern atomic_unchecked_t fscache_n_retrievals_ok;
46338+extern atomic_unchecked_t fscache_n_retrievals_wait;
46339+extern atomic_unchecked_t fscache_n_retrievals_nodata;
46340+extern atomic_unchecked_t fscache_n_retrievals_nobufs;
46341+extern atomic_unchecked_t fscache_n_retrievals_intr;
46342+extern atomic_unchecked_t fscache_n_retrievals_nomem;
46343+extern atomic_unchecked_t fscache_n_retrievals_object_dead;
46344+extern atomic_unchecked_t fscache_n_retrieval_ops;
46345+extern atomic_unchecked_t fscache_n_retrieval_op_waits;
46346+
46347+extern atomic_unchecked_t fscache_n_stores;
46348+extern atomic_unchecked_t fscache_n_stores_ok;
46349+extern atomic_unchecked_t fscache_n_stores_again;
46350+extern atomic_unchecked_t fscache_n_stores_nobufs;
46351+extern atomic_unchecked_t fscache_n_stores_oom;
46352+extern atomic_unchecked_t fscache_n_store_ops;
46353+extern atomic_unchecked_t fscache_n_store_calls;
46354+extern atomic_unchecked_t fscache_n_store_pages;
46355+extern atomic_unchecked_t fscache_n_store_radix_deletes;
46356+extern atomic_unchecked_t fscache_n_store_pages_over_limit;
46357+
46358+extern atomic_unchecked_t fscache_n_store_vmscan_not_storing;
46359+extern atomic_unchecked_t fscache_n_store_vmscan_gone;
46360+extern atomic_unchecked_t fscache_n_store_vmscan_busy;
46361+extern atomic_unchecked_t fscache_n_store_vmscan_cancelled;
46362+
46363+extern atomic_unchecked_t fscache_n_marks;
46364+extern atomic_unchecked_t fscache_n_uncaches;
46365+
46366+extern atomic_unchecked_t fscache_n_acquires;
46367+extern atomic_unchecked_t fscache_n_acquires_null;
46368+extern atomic_unchecked_t fscache_n_acquires_no_cache;
46369+extern atomic_unchecked_t fscache_n_acquires_ok;
46370+extern atomic_unchecked_t fscache_n_acquires_nobufs;
46371+extern atomic_unchecked_t fscache_n_acquires_oom;
46372+
46373+extern atomic_unchecked_t fscache_n_updates;
46374+extern atomic_unchecked_t fscache_n_updates_null;
46375+extern atomic_unchecked_t fscache_n_updates_run;
46376+
46377+extern atomic_unchecked_t fscache_n_relinquishes;
46378+extern atomic_unchecked_t fscache_n_relinquishes_null;
46379+extern atomic_unchecked_t fscache_n_relinquishes_waitcrt;
46380+extern atomic_unchecked_t fscache_n_relinquishes_retire;
46381+
46382+extern atomic_unchecked_t fscache_n_cookie_index;
46383+extern atomic_unchecked_t fscache_n_cookie_data;
46384+extern atomic_unchecked_t fscache_n_cookie_special;
46385+
46386+extern atomic_unchecked_t fscache_n_object_alloc;
46387+extern atomic_unchecked_t fscache_n_object_no_alloc;
46388+extern atomic_unchecked_t fscache_n_object_lookups;
46389+extern atomic_unchecked_t fscache_n_object_lookups_negative;
46390+extern atomic_unchecked_t fscache_n_object_lookups_positive;
46391+extern atomic_unchecked_t fscache_n_object_lookups_timed_out;
46392+extern atomic_unchecked_t fscache_n_object_created;
46393+extern atomic_unchecked_t fscache_n_object_avail;
46394+extern atomic_unchecked_t fscache_n_object_dead;
46395+
46396+extern atomic_unchecked_t fscache_n_checkaux_none;
46397+extern atomic_unchecked_t fscache_n_checkaux_okay;
46398+extern atomic_unchecked_t fscache_n_checkaux_update;
46399+extern atomic_unchecked_t fscache_n_checkaux_obsolete;
46400
46401 extern atomic_t fscache_n_cop_alloc_object;
46402 extern atomic_t fscache_n_cop_lookup_object;
46403@@ -255,6 +255,11 @@ static inline void fscache_stat(atomic_t
46404 atomic_inc(stat);
46405 }
46406
46407+static inline void fscache_stat_unchecked(atomic_unchecked_t *stat)
46408+{
46409+ atomic_inc_unchecked(stat);
46410+}
46411+
46412 static inline void fscache_stat_d(atomic_t *stat)
46413 {
46414 atomic_dec(stat);
46415@@ -267,6 +272,7 @@ extern const struct file_operations fsca
46416
46417 #define __fscache_stat(stat) (NULL)
46418 #define fscache_stat(stat) do {} while (0)
46419+#define fscache_stat_unchecked(stat) do {} while (0)
46420 #define fscache_stat_d(stat) do {} while (0)
46421 #endif
46422
46423diff -urNp linux-2.6.39/fs/fscache/object.c linux-2.6.39/fs/fscache/object.c
46424--- linux-2.6.39/fs/fscache/object.c 2011-05-19 00:06:34.000000000 -0400
46425+++ linux-2.6.39/fs/fscache/object.c 2011-05-22 19:36:32.000000000 -0400
46426@@ -128,7 +128,7 @@ static void fscache_object_state_machine
46427 /* update the object metadata on disk */
46428 case FSCACHE_OBJECT_UPDATING:
46429 clear_bit(FSCACHE_OBJECT_EV_UPDATE, &object->events);
46430- fscache_stat(&fscache_n_updates_run);
46431+ fscache_stat_unchecked(&fscache_n_updates_run);
46432 fscache_stat(&fscache_n_cop_update_object);
46433 object->cache->ops->update_object(object);
46434 fscache_stat_d(&fscache_n_cop_update_object);
46435@@ -217,7 +217,7 @@ static void fscache_object_state_machine
46436 spin_lock(&object->lock);
46437 object->state = FSCACHE_OBJECT_DEAD;
46438 spin_unlock(&object->lock);
46439- fscache_stat(&fscache_n_object_dead);
46440+ fscache_stat_unchecked(&fscache_n_object_dead);
46441 goto terminal_transit;
46442
46443 /* handle the parent cache of this object being withdrawn from
46444@@ -232,7 +232,7 @@ static void fscache_object_state_machine
46445 spin_lock(&object->lock);
46446 object->state = FSCACHE_OBJECT_DEAD;
46447 spin_unlock(&object->lock);
46448- fscache_stat(&fscache_n_object_dead);
46449+ fscache_stat_unchecked(&fscache_n_object_dead);
46450 goto terminal_transit;
46451
46452 /* complain about the object being woken up once it is
46453@@ -461,7 +461,7 @@ static void fscache_lookup_object(struct
46454 parent->cookie->def->name, cookie->def->name,
46455 object->cache->tag->name);
46456
46457- fscache_stat(&fscache_n_object_lookups);
46458+ fscache_stat_unchecked(&fscache_n_object_lookups);
46459 fscache_stat(&fscache_n_cop_lookup_object);
46460 ret = object->cache->ops->lookup_object(object);
46461 fscache_stat_d(&fscache_n_cop_lookup_object);
46462@@ -472,7 +472,7 @@ static void fscache_lookup_object(struct
46463 if (ret == -ETIMEDOUT) {
46464 /* probably stuck behind another object, so move this one to
46465 * the back of the queue */
46466- fscache_stat(&fscache_n_object_lookups_timed_out);
46467+ fscache_stat_unchecked(&fscache_n_object_lookups_timed_out);
46468 set_bit(FSCACHE_OBJECT_EV_REQUEUE, &object->events);
46469 }
46470
46471@@ -495,7 +495,7 @@ void fscache_object_lookup_negative(stru
46472
46473 spin_lock(&object->lock);
46474 if (object->state == FSCACHE_OBJECT_LOOKING_UP) {
46475- fscache_stat(&fscache_n_object_lookups_negative);
46476+ fscache_stat_unchecked(&fscache_n_object_lookups_negative);
46477
46478 /* transit here to allow write requests to begin stacking up
46479 * and read requests to begin returning ENODATA */
46480@@ -541,7 +541,7 @@ void fscache_obtained_object(struct fsca
46481 * result, in which case there may be data available */
46482 spin_lock(&object->lock);
46483 if (object->state == FSCACHE_OBJECT_LOOKING_UP) {
46484- fscache_stat(&fscache_n_object_lookups_positive);
46485+ fscache_stat_unchecked(&fscache_n_object_lookups_positive);
46486
46487 clear_bit(FSCACHE_COOKIE_NO_DATA_YET, &cookie->flags);
46488
46489@@ -555,7 +555,7 @@ void fscache_obtained_object(struct fsca
46490 set_bit(FSCACHE_OBJECT_EV_REQUEUE, &object->events);
46491 } else {
46492 ASSERTCMP(object->state, ==, FSCACHE_OBJECT_CREATING);
46493- fscache_stat(&fscache_n_object_created);
46494+ fscache_stat_unchecked(&fscache_n_object_created);
46495
46496 object->state = FSCACHE_OBJECT_AVAILABLE;
46497 spin_unlock(&object->lock);
46498@@ -602,7 +602,7 @@ static void fscache_object_available(str
46499 fscache_enqueue_dependents(object);
46500
46501 fscache_hist(fscache_obj_instantiate_histogram, object->lookup_jif);
46502- fscache_stat(&fscache_n_object_avail);
46503+ fscache_stat_unchecked(&fscache_n_object_avail);
46504
46505 _leave("");
46506 }
46507@@ -861,7 +861,7 @@ enum fscache_checkaux fscache_check_aux(
46508 enum fscache_checkaux result;
46509
46510 if (!object->cookie->def->check_aux) {
46511- fscache_stat(&fscache_n_checkaux_none);
46512+ fscache_stat_unchecked(&fscache_n_checkaux_none);
46513 return FSCACHE_CHECKAUX_OKAY;
46514 }
46515
46516@@ -870,17 +870,17 @@ enum fscache_checkaux fscache_check_aux(
46517 switch (result) {
46518 /* entry okay as is */
46519 case FSCACHE_CHECKAUX_OKAY:
46520- fscache_stat(&fscache_n_checkaux_okay);
46521+ fscache_stat_unchecked(&fscache_n_checkaux_okay);
46522 break;
46523
46524 /* entry requires update */
46525 case FSCACHE_CHECKAUX_NEEDS_UPDATE:
46526- fscache_stat(&fscache_n_checkaux_update);
46527+ fscache_stat_unchecked(&fscache_n_checkaux_update);
46528 break;
46529
46530 /* entry requires deletion */
46531 case FSCACHE_CHECKAUX_OBSOLETE:
46532- fscache_stat(&fscache_n_checkaux_obsolete);
46533+ fscache_stat_unchecked(&fscache_n_checkaux_obsolete);
46534 break;
46535
46536 default:
46537diff -urNp linux-2.6.39/fs/fscache/operation.c linux-2.6.39/fs/fscache/operation.c
46538--- linux-2.6.39/fs/fscache/operation.c 2011-05-19 00:06:34.000000000 -0400
46539+++ linux-2.6.39/fs/fscache/operation.c 2011-05-22 19:36:32.000000000 -0400
46540@@ -17,7 +17,7 @@
46541 #include <linux/slab.h>
46542 #include "internal.h"
46543
46544-atomic_t fscache_op_debug_id;
46545+atomic_unchecked_t fscache_op_debug_id;
46546 EXPORT_SYMBOL(fscache_op_debug_id);
46547
46548 /**
46549@@ -40,7 +40,7 @@ void fscache_enqueue_operation(struct fs
46550 ASSERTCMP(op->object->state, >=, FSCACHE_OBJECT_AVAILABLE);
46551 ASSERTCMP(atomic_read(&op->usage), >, 0);
46552
46553- fscache_stat(&fscache_n_op_enqueue);
46554+ fscache_stat_unchecked(&fscache_n_op_enqueue);
46555 switch (op->flags & FSCACHE_OP_TYPE) {
46556 case FSCACHE_OP_ASYNC:
46557 _debug("queue async");
46558@@ -73,7 +73,7 @@ static void fscache_run_op(struct fscach
46559 wake_up_bit(&op->flags, FSCACHE_OP_WAITING);
46560 if (op->processor)
46561 fscache_enqueue_operation(op);
46562- fscache_stat(&fscache_n_op_run);
46563+ fscache_stat_unchecked(&fscache_n_op_run);
46564 }
46565
46566 /*
46567@@ -104,11 +104,11 @@ int fscache_submit_exclusive_op(struct f
46568 if (object->n_ops > 1) {
46569 atomic_inc(&op->usage);
46570 list_add_tail(&op->pend_link, &object->pending_ops);
46571- fscache_stat(&fscache_n_op_pend);
46572+ fscache_stat_unchecked(&fscache_n_op_pend);
46573 } else if (!list_empty(&object->pending_ops)) {
46574 atomic_inc(&op->usage);
46575 list_add_tail(&op->pend_link, &object->pending_ops);
46576- fscache_stat(&fscache_n_op_pend);
46577+ fscache_stat_unchecked(&fscache_n_op_pend);
46578 fscache_start_operations(object);
46579 } else {
46580 ASSERTCMP(object->n_in_progress, ==, 0);
46581@@ -124,7 +124,7 @@ int fscache_submit_exclusive_op(struct f
46582 object->n_exclusive++; /* reads and writes must wait */
46583 atomic_inc(&op->usage);
46584 list_add_tail(&op->pend_link, &object->pending_ops);
46585- fscache_stat(&fscache_n_op_pend);
46586+ fscache_stat_unchecked(&fscache_n_op_pend);
46587 ret = 0;
46588 } else {
46589 /* not allowed to submit ops in any other state */
46590@@ -211,11 +211,11 @@ int fscache_submit_op(struct fscache_obj
46591 if (object->n_exclusive > 0) {
46592 atomic_inc(&op->usage);
46593 list_add_tail(&op->pend_link, &object->pending_ops);
46594- fscache_stat(&fscache_n_op_pend);
46595+ fscache_stat_unchecked(&fscache_n_op_pend);
46596 } else if (!list_empty(&object->pending_ops)) {
46597 atomic_inc(&op->usage);
46598 list_add_tail(&op->pend_link, &object->pending_ops);
46599- fscache_stat(&fscache_n_op_pend);
46600+ fscache_stat_unchecked(&fscache_n_op_pend);
46601 fscache_start_operations(object);
46602 } else {
46603 ASSERTCMP(object->n_exclusive, ==, 0);
46604@@ -227,12 +227,12 @@ int fscache_submit_op(struct fscache_obj
46605 object->n_ops++;
46606 atomic_inc(&op->usage);
46607 list_add_tail(&op->pend_link, &object->pending_ops);
46608- fscache_stat(&fscache_n_op_pend);
46609+ fscache_stat_unchecked(&fscache_n_op_pend);
46610 ret = 0;
46611 } else if (object->state == FSCACHE_OBJECT_DYING ||
46612 object->state == FSCACHE_OBJECT_LC_DYING ||
46613 object->state == FSCACHE_OBJECT_WITHDRAWING) {
46614- fscache_stat(&fscache_n_op_rejected);
46615+ fscache_stat_unchecked(&fscache_n_op_rejected);
46616 ret = -ENOBUFS;
46617 } else if (!test_bit(FSCACHE_IOERROR, &object->cache->flags)) {
46618 fscache_report_unexpected_submission(object, op, ostate);
46619@@ -302,7 +302,7 @@ int fscache_cancel_op(struct fscache_ope
46620
46621 ret = -EBUSY;
46622 if (!list_empty(&op->pend_link)) {
46623- fscache_stat(&fscache_n_op_cancelled);
46624+ fscache_stat_unchecked(&fscache_n_op_cancelled);
46625 list_del_init(&op->pend_link);
46626 object->n_ops--;
46627 if (test_bit(FSCACHE_OP_EXCLUSIVE, &op->flags))
46628@@ -341,7 +341,7 @@ void fscache_put_operation(struct fscach
46629 if (test_and_set_bit(FSCACHE_OP_DEAD, &op->flags))
46630 BUG();
46631
46632- fscache_stat(&fscache_n_op_release);
46633+ fscache_stat_unchecked(&fscache_n_op_release);
46634
46635 if (op->release) {
46636 op->release(op);
46637@@ -358,7 +358,7 @@ void fscache_put_operation(struct fscach
46638 * lock, and defer it otherwise */
46639 if (!spin_trylock(&object->lock)) {
46640 _debug("defer put");
46641- fscache_stat(&fscache_n_op_deferred_release);
46642+ fscache_stat_unchecked(&fscache_n_op_deferred_release);
46643
46644 cache = object->cache;
46645 spin_lock(&cache->op_gc_list_lock);
46646@@ -420,7 +420,7 @@ void fscache_operation_gc(struct work_st
46647
46648 _debug("GC DEFERRED REL OBJ%x OP%x",
46649 object->debug_id, op->debug_id);
46650- fscache_stat(&fscache_n_op_gc);
46651+ fscache_stat_unchecked(&fscache_n_op_gc);
46652
46653 ASSERTCMP(atomic_read(&op->usage), ==, 0);
46654
46655diff -urNp linux-2.6.39/fs/fscache/page.c linux-2.6.39/fs/fscache/page.c
46656--- linux-2.6.39/fs/fscache/page.c 2011-05-19 00:06:34.000000000 -0400
46657+++ linux-2.6.39/fs/fscache/page.c 2011-05-22 19:36:32.000000000 -0400
46658@@ -60,7 +60,7 @@ bool __fscache_maybe_release_page(struct
46659 val = radix_tree_lookup(&cookie->stores, page->index);
46660 if (!val) {
46661 rcu_read_unlock();
46662- fscache_stat(&fscache_n_store_vmscan_not_storing);
46663+ fscache_stat_unchecked(&fscache_n_store_vmscan_not_storing);
46664 __fscache_uncache_page(cookie, page);
46665 return true;
46666 }
46667@@ -90,11 +90,11 @@ bool __fscache_maybe_release_page(struct
46668 spin_unlock(&cookie->stores_lock);
46669
46670 if (xpage) {
46671- fscache_stat(&fscache_n_store_vmscan_cancelled);
46672- fscache_stat(&fscache_n_store_radix_deletes);
46673+ fscache_stat_unchecked(&fscache_n_store_vmscan_cancelled);
46674+ fscache_stat_unchecked(&fscache_n_store_radix_deletes);
46675 ASSERTCMP(xpage, ==, page);
46676 } else {
46677- fscache_stat(&fscache_n_store_vmscan_gone);
46678+ fscache_stat_unchecked(&fscache_n_store_vmscan_gone);
46679 }
46680
46681 wake_up_bit(&cookie->flags, 0);
46682@@ -107,7 +107,7 @@ page_busy:
46683 /* we might want to wait here, but that could deadlock the allocator as
46684 * the work threads writing to the cache may all end up sleeping
46685 * on memory allocation */
46686- fscache_stat(&fscache_n_store_vmscan_busy);
46687+ fscache_stat_unchecked(&fscache_n_store_vmscan_busy);
46688 return false;
46689 }
46690 EXPORT_SYMBOL(__fscache_maybe_release_page);
46691@@ -131,7 +131,7 @@ static void fscache_end_page_write(struc
46692 FSCACHE_COOKIE_STORING_TAG);
46693 if (!radix_tree_tag_get(&cookie->stores, page->index,
46694 FSCACHE_COOKIE_PENDING_TAG)) {
46695- fscache_stat(&fscache_n_store_radix_deletes);
46696+ fscache_stat_unchecked(&fscache_n_store_radix_deletes);
46697 xpage = radix_tree_delete(&cookie->stores, page->index);
46698 }
46699 spin_unlock(&cookie->stores_lock);
46700@@ -152,7 +152,7 @@ static void fscache_attr_changed_op(stru
46701
46702 _enter("{OBJ%x OP%x}", object->debug_id, op->debug_id);
46703
46704- fscache_stat(&fscache_n_attr_changed_calls);
46705+ fscache_stat_unchecked(&fscache_n_attr_changed_calls);
46706
46707 if (fscache_object_is_active(object)) {
46708 fscache_set_op_state(op, "CallFS");
46709@@ -179,11 +179,11 @@ int __fscache_attr_changed(struct fscach
46710
46711 ASSERTCMP(cookie->def->type, !=, FSCACHE_COOKIE_TYPE_INDEX);
46712
46713- fscache_stat(&fscache_n_attr_changed);
46714+ fscache_stat_unchecked(&fscache_n_attr_changed);
46715
46716 op = kzalloc(sizeof(*op), GFP_KERNEL);
46717 if (!op) {
46718- fscache_stat(&fscache_n_attr_changed_nomem);
46719+ fscache_stat_unchecked(&fscache_n_attr_changed_nomem);
46720 _leave(" = -ENOMEM");
46721 return -ENOMEM;
46722 }
46723@@ -202,7 +202,7 @@ int __fscache_attr_changed(struct fscach
46724 if (fscache_submit_exclusive_op(object, op) < 0)
46725 goto nobufs;
46726 spin_unlock(&cookie->lock);
46727- fscache_stat(&fscache_n_attr_changed_ok);
46728+ fscache_stat_unchecked(&fscache_n_attr_changed_ok);
46729 fscache_put_operation(op);
46730 _leave(" = 0");
46731 return 0;
46732@@ -210,7 +210,7 @@ int __fscache_attr_changed(struct fscach
46733 nobufs:
46734 spin_unlock(&cookie->lock);
46735 kfree(op);
46736- fscache_stat(&fscache_n_attr_changed_nobufs);
46737+ fscache_stat_unchecked(&fscache_n_attr_changed_nobufs);
46738 _leave(" = %d", -ENOBUFS);
46739 return -ENOBUFS;
46740 }
46741@@ -246,7 +246,7 @@ static struct fscache_retrieval *fscache
46742 /* allocate a retrieval operation and attempt to submit it */
46743 op = kzalloc(sizeof(*op), GFP_NOIO);
46744 if (!op) {
46745- fscache_stat(&fscache_n_retrievals_nomem);
46746+ fscache_stat_unchecked(&fscache_n_retrievals_nomem);
46747 return NULL;
46748 }
46749
46750@@ -275,13 +275,13 @@ static int fscache_wait_for_deferred_loo
46751 return 0;
46752 }
46753
46754- fscache_stat(&fscache_n_retrievals_wait);
46755+ fscache_stat_unchecked(&fscache_n_retrievals_wait);
46756
46757 jif = jiffies;
46758 if (wait_on_bit(&cookie->flags, FSCACHE_COOKIE_LOOKING_UP,
46759 fscache_wait_bit_interruptible,
46760 TASK_INTERRUPTIBLE) != 0) {
46761- fscache_stat(&fscache_n_retrievals_intr);
46762+ fscache_stat_unchecked(&fscache_n_retrievals_intr);
46763 _leave(" = -ERESTARTSYS");
46764 return -ERESTARTSYS;
46765 }
46766@@ -299,8 +299,8 @@ static int fscache_wait_for_deferred_loo
46767 */
46768 static int fscache_wait_for_retrieval_activation(struct fscache_object *object,
46769 struct fscache_retrieval *op,
46770- atomic_t *stat_op_waits,
46771- atomic_t *stat_object_dead)
46772+ atomic_unchecked_t *stat_op_waits,
46773+ atomic_unchecked_t *stat_object_dead)
46774 {
46775 int ret;
46776
46777@@ -308,7 +308,7 @@ static int fscache_wait_for_retrieval_ac
46778 goto check_if_dead;
46779
46780 _debug(">>> WT");
46781- fscache_stat(stat_op_waits);
46782+ fscache_stat_unchecked(stat_op_waits);
46783 if (wait_on_bit(&op->op.flags, FSCACHE_OP_WAITING,
46784 fscache_wait_bit_interruptible,
46785 TASK_INTERRUPTIBLE) < 0) {
46786@@ -325,7 +325,7 @@ static int fscache_wait_for_retrieval_ac
46787
46788 check_if_dead:
46789 if (unlikely(fscache_object_is_dead(object))) {
46790- fscache_stat(stat_object_dead);
46791+ fscache_stat_unchecked(stat_object_dead);
46792 return -ENOBUFS;
46793 }
46794 return 0;
46795@@ -352,7 +352,7 @@ int __fscache_read_or_alloc_page(struct
46796
46797 _enter("%p,%p,,,", cookie, page);
46798
46799- fscache_stat(&fscache_n_retrievals);
46800+ fscache_stat_unchecked(&fscache_n_retrievals);
46801
46802 if (hlist_empty(&cookie->backing_objects))
46803 goto nobufs;
46804@@ -386,7 +386,7 @@ int __fscache_read_or_alloc_page(struct
46805 goto nobufs_unlock;
46806 spin_unlock(&cookie->lock);
46807
46808- fscache_stat(&fscache_n_retrieval_ops);
46809+ fscache_stat_unchecked(&fscache_n_retrieval_ops);
46810
46811 /* pin the netfs read context in case we need to do the actual netfs
46812 * read because we've encountered a cache read failure */
46813@@ -416,15 +416,15 @@ int __fscache_read_or_alloc_page(struct
46814
46815 error:
46816 if (ret == -ENOMEM)
46817- fscache_stat(&fscache_n_retrievals_nomem);
46818+ fscache_stat_unchecked(&fscache_n_retrievals_nomem);
46819 else if (ret == -ERESTARTSYS)
46820- fscache_stat(&fscache_n_retrievals_intr);
46821+ fscache_stat_unchecked(&fscache_n_retrievals_intr);
46822 else if (ret == -ENODATA)
46823- fscache_stat(&fscache_n_retrievals_nodata);
46824+ fscache_stat_unchecked(&fscache_n_retrievals_nodata);
46825 else if (ret < 0)
46826- fscache_stat(&fscache_n_retrievals_nobufs);
46827+ fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
46828 else
46829- fscache_stat(&fscache_n_retrievals_ok);
46830+ fscache_stat_unchecked(&fscache_n_retrievals_ok);
46831
46832 fscache_put_retrieval(op);
46833 _leave(" = %d", ret);
46834@@ -434,7 +434,7 @@ nobufs_unlock:
46835 spin_unlock(&cookie->lock);
46836 kfree(op);
46837 nobufs:
46838- fscache_stat(&fscache_n_retrievals_nobufs);
46839+ fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
46840 _leave(" = -ENOBUFS");
46841 return -ENOBUFS;
46842 }
46843@@ -472,7 +472,7 @@ int __fscache_read_or_alloc_pages(struct
46844
46845 _enter("%p,,%d,,,", cookie, *nr_pages);
46846
46847- fscache_stat(&fscache_n_retrievals);
46848+ fscache_stat_unchecked(&fscache_n_retrievals);
46849
46850 if (hlist_empty(&cookie->backing_objects))
46851 goto nobufs;
46852@@ -503,7 +503,7 @@ int __fscache_read_or_alloc_pages(struct
46853 goto nobufs_unlock;
46854 spin_unlock(&cookie->lock);
46855
46856- fscache_stat(&fscache_n_retrieval_ops);
46857+ fscache_stat_unchecked(&fscache_n_retrieval_ops);
46858
46859 /* pin the netfs read context in case we need to do the actual netfs
46860 * read because we've encountered a cache read failure */
46861@@ -533,15 +533,15 @@ int __fscache_read_or_alloc_pages(struct
46862
46863 error:
46864 if (ret == -ENOMEM)
46865- fscache_stat(&fscache_n_retrievals_nomem);
46866+ fscache_stat_unchecked(&fscache_n_retrievals_nomem);
46867 else if (ret == -ERESTARTSYS)
46868- fscache_stat(&fscache_n_retrievals_intr);
46869+ fscache_stat_unchecked(&fscache_n_retrievals_intr);
46870 else if (ret == -ENODATA)
46871- fscache_stat(&fscache_n_retrievals_nodata);
46872+ fscache_stat_unchecked(&fscache_n_retrievals_nodata);
46873 else if (ret < 0)
46874- fscache_stat(&fscache_n_retrievals_nobufs);
46875+ fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
46876 else
46877- fscache_stat(&fscache_n_retrievals_ok);
46878+ fscache_stat_unchecked(&fscache_n_retrievals_ok);
46879
46880 fscache_put_retrieval(op);
46881 _leave(" = %d", ret);
46882@@ -551,7 +551,7 @@ nobufs_unlock:
46883 spin_unlock(&cookie->lock);
46884 kfree(op);
46885 nobufs:
46886- fscache_stat(&fscache_n_retrievals_nobufs);
46887+ fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
46888 _leave(" = -ENOBUFS");
46889 return -ENOBUFS;
46890 }
46891@@ -575,7 +575,7 @@ int __fscache_alloc_page(struct fscache_
46892
46893 _enter("%p,%p,,,", cookie, page);
46894
46895- fscache_stat(&fscache_n_allocs);
46896+ fscache_stat_unchecked(&fscache_n_allocs);
46897
46898 if (hlist_empty(&cookie->backing_objects))
46899 goto nobufs;
46900@@ -602,7 +602,7 @@ int __fscache_alloc_page(struct fscache_
46901 goto nobufs_unlock;
46902 spin_unlock(&cookie->lock);
46903
46904- fscache_stat(&fscache_n_alloc_ops);
46905+ fscache_stat_unchecked(&fscache_n_alloc_ops);
46906
46907 ret = fscache_wait_for_retrieval_activation(
46908 object, op,
46909@@ -618,11 +618,11 @@ int __fscache_alloc_page(struct fscache_
46910
46911 error:
46912 if (ret == -ERESTARTSYS)
46913- fscache_stat(&fscache_n_allocs_intr);
46914+ fscache_stat_unchecked(&fscache_n_allocs_intr);
46915 else if (ret < 0)
46916- fscache_stat(&fscache_n_allocs_nobufs);
46917+ fscache_stat_unchecked(&fscache_n_allocs_nobufs);
46918 else
46919- fscache_stat(&fscache_n_allocs_ok);
46920+ fscache_stat_unchecked(&fscache_n_allocs_ok);
46921
46922 fscache_put_retrieval(op);
46923 _leave(" = %d", ret);
46924@@ -632,7 +632,7 @@ nobufs_unlock:
46925 spin_unlock(&cookie->lock);
46926 kfree(op);
46927 nobufs:
46928- fscache_stat(&fscache_n_allocs_nobufs);
46929+ fscache_stat_unchecked(&fscache_n_allocs_nobufs);
46930 _leave(" = -ENOBUFS");
46931 return -ENOBUFS;
46932 }
46933@@ -675,7 +675,7 @@ static void fscache_write_op(struct fsca
46934
46935 spin_lock(&cookie->stores_lock);
46936
46937- fscache_stat(&fscache_n_store_calls);
46938+ fscache_stat_unchecked(&fscache_n_store_calls);
46939
46940 /* find a page to store */
46941 page = NULL;
46942@@ -686,7 +686,7 @@ static void fscache_write_op(struct fsca
46943 page = results[0];
46944 _debug("gang %d [%lx]", n, page->index);
46945 if (page->index > op->store_limit) {
46946- fscache_stat(&fscache_n_store_pages_over_limit);
46947+ fscache_stat_unchecked(&fscache_n_store_pages_over_limit);
46948 goto superseded;
46949 }
46950
46951@@ -699,7 +699,7 @@ static void fscache_write_op(struct fsca
46952 spin_unlock(&object->lock);
46953
46954 fscache_set_op_state(&op->op, "Store");
46955- fscache_stat(&fscache_n_store_pages);
46956+ fscache_stat_unchecked(&fscache_n_store_pages);
46957 fscache_stat(&fscache_n_cop_write_page);
46958 ret = object->cache->ops->write_page(op, page);
46959 fscache_stat_d(&fscache_n_cop_write_page);
46960@@ -769,7 +769,7 @@ int __fscache_write_page(struct fscache_
46961 ASSERTCMP(cookie->def->type, !=, FSCACHE_COOKIE_TYPE_INDEX);
46962 ASSERT(PageFsCache(page));
46963
46964- fscache_stat(&fscache_n_stores);
46965+ fscache_stat_unchecked(&fscache_n_stores);
46966
46967 op = kzalloc(sizeof(*op), GFP_NOIO);
46968 if (!op)
46969@@ -821,7 +821,7 @@ int __fscache_write_page(struct fscache_
46970 spin_unlock(&cookie->stores_lock);
46971 spin_unlock(&object->lock);
46972
46973- op->op.debug_id = atomic_inc_return(&fscache_op_debug_id);
46974+ op->op.debug_id = atomic_inc_return_unchecked(&fscache_op_debug_id);
46975 op->store_limit = object->store_limit;
46976
46977 if (fscache_submit_op(object, &op->op) < 0)
46978@@ -829,8 +829,8 @@ int __fscache_write_page(struct fscache_
46979
46980 spin_unlock(&cookie->lock);
46981 radix_tree_preload_end();
46982- fscache_stat(&fscache_n_store_ops);
46983- fscache_stat(&fscache_n_stores_ok);
46984+ fscache_stat_unchecked(&fscache_n_store_ops);
46985+ fscache_stat_unchecked(&fscache_n_stores_ok);
46986
46987 /* the work queue now carries its own ref on the object */
46988 fscache_put_operation(&op->op);
46989@@ -838,14 +838,14 @@ int __fscache_write_page(struct fscache_
46990 return 0;
46991
46992 already_queued:
46993- fscache_stat(&fscache_n_stores_again);
46994+ fscache_stat_unchecked(&fscache_n_stores_again);
46995 already_pending:
46996 spin_unlock(&cookie->stores_lock);
46997 spin_unlock(&object->lock);
46998 spin_unlock(&cookie->lock);
46999 radix_tree_preload_end();
47000 kfree(op);
47001- fscache_stat(&fscache_n_stores_ok);
47002+ fscache_stat_unchecked(&fscache_n_stores_ok);
47003 _leave(" = 0");
47004 return 0;
47005
47006@@ -864,14 +864,14 @@ nobufs:
47007 spin_unlock(&cookie->lock);
47008 radix_tree_preload_end();
47009 kfree(op);
47010- fscache_stat(&fscache_n_stores_nobufs);
47011+ fscache_stat_unchecked(&fscache_n_stores_nobufs);
47012 _leave(" = -ENOBUFS");
47013 return -ENOBUFS;
47014
47015 nomem_free:
47016 kfree(op);
47017 nomem:
47018- fscache_stat(&fscache_n_stores_oom);
47019+ fscache_stat_unchecked(&fscache_n_stores_oom);
47020 _leave(" = -ENOMEM");
47021 return -ENOMEM;
47022 }
47023@@ -889,7 +889,7 @@ void __fscache_uncache_page(struct fscac
47024 ASSERTCMP(cookie->def->type, !=, FSCACHE_COOKIE_TYPE_INDEX);
47025 ASSERTCMP(page, !=, NULL);
47026
47027- fscache_stat(&fscache_n_uncaches);
47028+ fscache_stat_unchecked(&fscache_n_uncaches);
47029
47030 /* cache withdrawal may beat us to it */
47031 if (!PageFsCache(page))
47032@@ -942,7 +942,7 @@ void fscache_mark_pages_cached(struct fs
47033 unsigned long loop;
47034
47035 #ifdef CONFIG_FSCACHE_STATS
47036- atomic_add(pagevec->nr, &fscache_n_marks);
47037+ atomic_add_unchecked(pagevec->nr, &fscache_n_marks);
47038 #endif
47039
47040 for (loop = 0; loop < pagevec->nr; loop++) {
47041diff -urNp linux-2.6.39/fs/fscache/stats.c linux-2.6.39/fs/fscache/stats.c
47042--- linux-2.6.39/fs/fscache/stats.c 2011-05-19 00:06:34.000000000 -0400
47043+++ linux-2.6.39/fs/fscache/stats.c 2011-05-22 19:36:32.000000000 -0400
47044@@ -18,95 +18,95 @@
47045 /*
47046 * operation counters
47047 */
47048-atomic_t fscache_n_op_pend;
47049-atomic_t fscache_n_op_run;
47050-atomic_t fscache_n_op_enqueue;
47051-atomic_t fscache_n_op_requeue;
47052-atomic_t fscache_n_op_deferred_release;
47053-atomic_t fscache_n_op_release;
47054-atomic_t fscache_n_op_gc;
47055-atomic_t fscache_n_op_cancelled;
47056-atomic_t fscache_n_op_rejected;
47057-
47058-atomic_t fscache_n_attr_changed;
47059-atomic_t fscache_n_attr_changed_ok;
47060-atomic_t fscache_n_attr_changed_nobufs;
47061-atomic_t fscache_n_attr_changed_nomem;
47062-atomic_t fscache_n_attr_changed_calls;
47063-
47064-atomic_t fscache_n_allocs;
47065-atomic_t fscache_n_allocs_ok;
47066-atomic_t fscache_n_allocs_wait;
47067-atomic_t fscache_n_allocs_nobufs;
47068-atomic_t fscache_n_allocs_intr;
47069-atomic_t fscache_n_allocs_object_dead;
47070-atomic_t fscache_n_alloc_ops;
47071-atomic_t fscache_n_alloc_op_waits;
47072-
47073-atomic_t fscache_n_retrievals;
47074-atomic_t fscache_n_retrievals_ok;
47075-atomic_t fscache_n_retrievals_wait;
47076-atomic_t fscache_n_retrievals_nodata;
47077-atomic_t fscache_n_retrievals_nobufs;
47078-atomic_t fscache_n_retrievals_intr;
47079-atomic_t fscache_n_retrievals_nomem;
47080-atomic_t fscache_n_retrievals_object_dead;
47081-atomic_t fscache_n_retrieval_ops;
47082-atomic_t fscache_n_retrieval_op_waits;
47083-
47084-atomic_t fscache_n_stores;
47085-atomic_t fscache_n_stores_ok;
47086-atomic_t fscache_n_stores_again;
47087-atomic_t fscache_n_stores_nobufs;
47088-atomic_t fscache_n_stores_oom;
47089-atomic_t fscache_n_store_ops;
47090-atomic_t fscache_n_store_calls;
47091-atomic_t fscache_n_store_pages;
47092-atomic_t fscache_n_store_radix_deletes;
47093-atomic_t fscache_n_store_pages_over_limit;
47094-
47095-atomic_t fscache_n_store_vmscan_not_storing;
47096-atomic_t fscache_n_store_vmscan_gone;
47097-atomic_t fscache_n_store_vmscan_busy;
47098-atomic_t fscache_n_store_vmscan_cancelled;
47099-
47100-atomic_t fscache_n_marks;
47101-atomic_t fscache_n_uncaches;
47102-
47103-atomic_t fscache_n_acquires;
47104-atomic_t fscache_n_acquires_null;
47105-atomic_t fscache_n_acquires_no_cache;
47106-atomic_t fscache_n_acquires_ok;
47107-atomic_t fscache_n_acquires_nobufs;
47108-atomic_t fscache_n_acquires_oom;
47109-
47110-atomic_t fscache_n_updates;
47111-atomic_t fscache_n_updates_null;
47112-atomic_t fscache_n_updates_run;
47113-
47114-atomic_t fscache_n_relinquishes;
47115-atomic_t fscache_n_relinquishes_null;
47116-atomic_t fscache_n_relinquishes_waitcrt;
47117-atomic_t fscache_n_relinquishes_retire;
47118-
47119-atomic_t fscache_n_cookie_index;
47120-atomic_t fscache_n_cookie_data;
47121-atomic_t fscache_n_cookie_special;
47122-
47123-atomic_t fscache_n_object_alloc;
47124-atomic_t fscache_n_object_no_alloc;
47125-atomic_t fscache_n_object_lookups;
47126-atomic_t fscache_n_object_lookups_negative;
47127-atomic_t fscache_n_object_lookups_positive;
47128-atomic_t fscache_n_object_lookups_timed_out;
47129-atomic_t fscache_n_object_created;
47130-atomic_t fscache_n_object_avail;
47131-atomic_t fscache_n_object_dead;
47132-
47133-atomic_t fscache_n_checkaux_none;
47134-atomic_t fscache_n_checkaux_okay;
47135-atomic_t fscache_n_checkaux_update;
47136-atomic_t fscache_n_checkaux_obsolete;
47137+atomic_unchecked_t fscache_n_op_pend;
47138+atomic_unchecked_t fscache_n_op_run;
47139+atomic_unchecked_t fscache_n_op_enqueue;
47140+atomic_unchecked_t fscache_n_op_requeue;
47141+atomic_unchecked_t fscache_n_op_deferred_release;
47142+atomic_unchecked_t fscache_n_op_release;
47143+atomic_unchecked_t fscache_n_op_gc;
47144+atomic_unchecked_t fscache_n_op_cancelled;
47145+atomic_unchecked_t fscache_n_op_rejected;
47146+
47147+atomic_unchecked_t fscache_n_attr_changed;
47148+atomic_unchecked_t fscache_n_attr_changed_ok;
47149+atomic_unchecked_t fscache_n_attr_changed_nobufs;
47150+atomic_unchecked_t fscache_n_attr_changed_nomem;
47151+atomic_unchecked_t fscache_n_attr_changed_calls;
47152+
47153+atomic_unchecked_t fscache_n_allocs;
47154+atomic_unchecked_t fscache_n_allocs_ok;
47155+atomic_unchecked_t fscache_n_allocs_wait;
47156+atomic_unchecked_t fscache_n_allocs_nobufs;
47157+atomic_unchecked_t fscache_n_allocs_intr;
47158+atomic_unchecked_t fscache_n_allocs_object_dead;
47159+atomic_unchecked_t fscache_n_alloc_ops;
47160+atomic_unchecked_t fscache_n_alloc_op_waits;
47161+
47162+atomic_unchecked_t fscache_n_retrievals;
47163+atomic_unchecked_t fscache_n_retrievals_ok;
47164+atomic_unchecked_t fscache_n_retrievals_wait;
47165+atomic_unchecked_t fscache_n_retrievals_nodata;
47166+atomic_unchecked_t fscache_n_retrievals_nobufs;
47167+atomic_unchecked_t fscache_n_retrievals_intr;
47168+atomic_unchecked_t fscache_n_retrievals_nomem;
47169+atomic_unchecked_t fscache_n_retrievals_object_dead;
47170+atomic_unchecked_t fscache_n_retrieval_ops;
47171+atomic_unchecked_t fscache_n_retrieval_op_waits;
47172+
47173+atomic_unchecked_t fscache_n_stores;
47174+atomic_unchecked_t fscache_n_stores_ok;
47175+atomic_unchecked_t fscache_n_stores_again;
47176+atomic_unchecked_t fscache_n_stores_nobufs;
47177+atomic_unchecked_t fscache_n_stores_oom;
47178+atomic_unchecked_t fscache_n_store_ops;
47179+atomic_unchecked_t fscache_n_store_calls;
47180+atomic_unchecked_t fscache_n_store_pages;
47181+atomic_unchecked_t fscache_n_store_radix_deletes;
47182+atomic_unchecked_t fscache_n_store_pages_over_limit;
47183+
47184+atomic_unchecked_t fscache_n_store_vmscan_not_storing;
47185+atomic_unchecked_t fscache_n_store_vmscan_gone;
47186+atomic_unchecked_t fscache_n_store_vmscan_busy;
47187+atomic_unchecked_t fscache_n_store_vmscan_cancelled;
47188+
47189+atomic_unchecked_t fscache_n_marks;
47190+atomic_unchecked_t fscache_n_uncaches;
47191+
47192+atomic_unchecked_t fscache_n_acquires;
47193+atomic_unchecked_t fscache_n_acquires_null;
47194+atomic_unchecked_t fscache_n_acquires_no_cache;
47195+atomic_unchecked_t fscache_n_acquires_ok;
47196+atomic_unchecked_t fscache_n_acquires_nobufs;
47197+atomic_unchecked_t fscache_n_acquires_oom;
47198+
47199+atomic_unchecked_t fscache_n_updates;
47200+atomic_unchecked_t fscache_n_updates_null;
47201+atomic_unchecked_t fscache_n_updates_run;
47202+
47203+atomic_unchecked_t fscache_n_relinquishes;
47204+atomic_unchecked_t fscache_n_relinquishes_null;
47205+atomic_unchecked_t fscache_n_relinquishes_waitcrt;
47206+atomic_unchecked_t fscache_n_relinquishes_retire;
47207+
47208+atomic_unchecked_t fscache_n_cookie_index;
47209+atomic_unchecked_t fscache_n_cookie_data;
47210+atomic_unchecked_t fscache_n_cookie_special;
47211+
47212+atomic_unchecked_t fscache_n_object_alloc;
47213+atomic_unchecked_t fscache_n_object_no_alloc;
47214+atomic_unchecked_t fscache_n_object_lookups;
47215+atomic_unchecked_t fscache_n_object_lookups_negative;
47216+atomic_unchecked_t fscache_n_object_lookups_positive;
47217+atomic_unchecked_t fscache_n_object_lookups_timed_out;
47218+atomic_unchecked_t fscache_n_object_created;
47219+atomic_unchecked_t fscache_n_object_avail;
47220+atomic_unchecked_t fscache_n_object_dead;
47221+
47222+atomic_unchecked_t fscache_n_checkaux_none;
47223+atomic_unchecked_t fscache_n_checkaux_okay;
47224+atomic_unchecked_t fscache_n_checkaux_update;
47225+atomic_unchecked_t fscache_n_checkaux_obsolete;
47226
47227 atomic_t fscache_n_cop_alloc_object;
47228 atomic_t fscache_n_cop_lookup_object;
47229@@ -133,113 +133,113 @@ static int fscache_stats_show(struct seq
47230 seq_puts(m, "FS-Cache statistics\n");
47231
47232 seq_printf(m, "Cookies: idx=%u dat=%u spc=%u\n",
47233- atomic_read(&fscache_n_cookie_index),
47234- atomic_read(&fscache_n_cookie_data),
47235- atomic_read(&fscache_n_cookie_special));
47236+ atomic_read_unchecked(&fscache_n_cookie_index),
47237+ atomic_read_unchecked(&fscache_n_cookie_data),
47238+ atomic_read_unchecked(&fscache_n_cookie_special));
47239
47240 seq_printf(m, "Objects: alc=%u nal=%u avl=%u ded=%u\n",
47241- atomic_read(&fscache_n_object_alloc),
47242- atomic_read(&fscache_n_object_no_alloc),
47243- atomic_read(&fscache_n_object_avail),
47244- atomic_read(&fscache_n_object_dead));
47245+ atomic_read_unchecked(&fscache_n_object_alloc),
47246+ atomic_read_unchecked(&fscache_n_object_no_alloc),
47247+ atomic_read_unchecked(&fscache_n_object_avail),
47248+ atomic_read_unchecked(&fscache_n_object_dead));
47249 seq_printf(m, "ChkAux : non=%u ok=%u upd=%u obs=%u\n",
47250- atomic_read(&fscache_n_checkaux_none),
47251- atomic_read(&fscache_n_checkaux_okay),
47252- atomic_read(&fscache_n_checkaux_update),
47253- atomic_read(&fscache_n_checkaux_obsolete));
47254+ atomic_read_unchecked(&fscache_n_checkaux_none),
47255+ atomic_read_unchecked(&fscache_n_checkaux_okay),
47256+ atomic_read_unchecked(&fscache_n_checkaux_update),
47257+ atomic_read_unchecked(&fscache_n_checkaux_obsolete));
47258
47259 seq_printf(m, "Pages : mrk=%u unc=%u\n",
47260- atomic_read(&fscache_n_marks),
47261- atomic_read(&fscache_n_uncaches));
47262+ atomic_read_unchecked(&fscache_n_marks),
47263+ atomic_read_unchecked(&fscache_n_uncaches));
47264
47265 seq_printf(m, "Acquire: n=%u nul=%u noc=%u ok=%u nbf=%u"
47266 " oom=%u\n",
47267- atomic_read(&fscache_n_acquires),
47268- atomic_read(&fscache_n_acquires_null),
47269- atomic_read(&fscache_n_acquires_no_cache),
47270- atomic_read(&fscache_n_acquires_ok),
47271- atomic_read(&fscache_n_acquires_nobufs),
47272- atomic_read(&fscache_n_acquires_oom));
47273+ atomic_read_unchecked(&fscache_n_acquires),
47274+ atomic_read_unchecked(&fscache_n_acquires_null),
47275+ atomic_read_unchecked(&fscache_n_acquires_no_cache),
47276+ atomic_read_unchecked(&fscache_n_acquires_ok),
47277+ atomic_read_unchecked(&fscache_n_acquires_nobufs),
47278+ atomic_read_unchecked(&fscache_n_acquires_oom));
47279
47280 seq_printf(m, "Lookups: n=%u neg=%u pos=%u crt=%u tmo=%u\n",
47281- atomic_read(&fscache_n_object_lookups),
47282- atomic_read(&fscache_n_object_lookups_negative),
47283- atomic_read(&fscache_n_object_lookups_positive),
47284- atomic_read(&fscache_n_object_created),
47285- atomic_read(&fscache_n_object_lookups_timed_out));
47286+ atomic_read_unchecked(&fscache_n_object_lookups),
47287+ atomic_read_unchecked(&fscache_n_object_lookups_negative),
47288+ atomic_read_unchecked(&fscache_n_object_lookups_positive),
47289+ atomic_read_unchecked(&fscache_n_object_created),
47290+ atomic_read_unchecked(&fscache_n_object_lookups_timed_out));
47291
47292 seq_printf(m, "Updates: n=%u nul=%u run=%u\n",
47293- atomic_read(&fscache_n_updates),
47294- atomic_read(&fscache_n_updates_null),
47295- atomic_read(&fscache_n_updates_run));
47296+ atomic_read_unchecked(&fscache_n_updates),
47297+ atomic_read_unchecked(&fscache_n_updates_null),
47298+ atomic_read_unchecked(&fscache_n_updates_run));
47299
47300 seq_printf(m, "Relinqs: n=%u nul=%u wcr=%u rtr=%u\n",
47301- atomic_read(&fscache_n_relinquishes),
47302- atomic_read(&fscache_n_relinquishes_null),
47303- atomic_read(&fscache_n_relinquishes_waitcrt),
47304- atomic_read(&fscache_n_relinquishes_retire));
47305+ atomic_read_unchecked(&fscache_n_relinquishes),
47306+ atomic_read_unchecked(&fscache_n_relinquishes_null),
47307+ atomic_read_unchecked(&fscache_n_relinquishes_waitcrt),
47308+ atomic_read_unchecked(&fscache_n_relinquishes_retire));
47309
47310 seq_printf(m, "AttrChg: n=%u ok=%u nbf=%u oom=%u run=%u\n",
47311- atomic_read(&fscache_n_attr_changed),
47312- atomic_read(&fscache_n_attr_changed_ok),
47313- atomic_read(&fscache_n_attr_changed_nobufs),
47314- atomic_read(&fscache_n_attr_changed_nomem),
47315- atomic_read(&fscache_n_attr_changed_calls));
47316+ atomic_read_unchecked(&fscache_n_attr_changed),
47317+ atomic_read_unchecked(&fscache_n_attr_changed_ok),
47318+ atomic_read_unchecked(&fscache_n_attr_changed_nobufs),
47319+ atomic_read_unchecked(&fscache_n_attr_changed_nomem),
47320+ atomic_read_unchecked(&fscache_n_attr_changed_calls));
47321
47322 seq_printf(m, "Allocs : n=%u ok=%u wt=%u nbf=%u int=%u\n",
47323- atomic_read(&fscache_n_allocs),
47324- atomic_read(&fscache_n_allocs_ok),
47325- atomic_read(&fscache_n_allocs_wait),
47326- atomic_read(&fscache_n_allocs_nobufs),
47327- atomic_read(&fscache_n_allocs_intr));
47328+ atomic_read_unchecked(&fscache_n_allocs),
47329+ atomic_read_unchecked(&fscache_n_allocs_ok),
47330+ atomic_read_unchecked(&fscache_n_allocs_wait),
47331+ atomic_read_unchecked(&fscache_n_allocs_nobufs),
47332+ atomic_read_unchecked(&fscache_n_allocs_intr));
47333 seq_printf(m, "Allocs : ops=%u owt=%u abt=%u\n",
47334- atomic_read(&fscache_n_alloc_ops),
47335- atomic_read(&fscache_n_alloc_op_waits),
47336- atomic_read(&fscache_n_allocs_object_dead));
47337+ atomic_read_unchecked(&fscache_n_alloc_ops),
47338+ atomic_read_unchecked(&fscache_n_alloc_op_waits),
47339+ atomic_read_unchecked(&fscache_n_allocs_object_dead));
47340
47341 seq_printf(m, "Retrvls: n=%u ok=%u wt=%u nod=%u nbf=%u"
47342 " int=%u oom=%u\n",
47343- atomic_read(&fscache_n_retrievals),
47344- atomic_read(&fscache_n_retrievals_ok),
47345- atomic_read(&fscache_n_retrievals_wait),
47346- atomic_read(&fscache_n_retrievals_nodata),
47347- atomic_read(&fscache_n_retrievals_nobufs),
47348- atomic_read(&fscache_n_retrievals_intr),
47349- atomic_read(&fscache_n_retrievals_nomem));
47350+ atomic_read_unchecked(&fscache_n_retrievals),
47351+ atomic_read_unchecked(&fscache_n_retrievals_ok),
47352+ atomic_read_unchecked(&fscache_n_retrievals_wait),
47353+ atomic_read_unchecked(&fscache_n_retrievals_nodata),
47354+ atomic_read_unchecked(&fscache_n_retrievals_nobufs),
47355+ atomic_read_unchecked(&fscache_n_retrievals_intr),
47356+ atomic_read_unchecked(&fscache_n_retrievals_nomem));
47357 seq_printf(m, "Retrvls: ops=%u owt=%u abt=%u\n",
47358- atomic_read(&fscache_n_retrieval_ops),
47359- atomic_read(&fscache_n_retrieval_op_waits),
47360- atomic_read(&fscache_n_retrievals_object_dead));
47361+ atomic_read_unchecked(&fscache_n_retrieval_ops),
47362+ atomic_read_unchecked(&fscache_n_retrieval_op_waits),
47363+ atomic_read_unchecked(&fscache_n_retrievals_object_dead));
47364
47365 seq_printf(m, "Stores : n=%u ok=%u agn=%u nbf=%u oom=%u\n",
47366- atomic_read(&fscache_n_stores),
47367- atomic_read(&fscache_n_stores_ok),
47368- atomic_read(&fscache_n_stores_again),
47369- atomic_read(&fscache_n_stores_nobufs),
47370- atomic_read(&fscache_n_stores_oom));
47371+ atomic_read_unchecked(&fscache_n_stores),
47372+ atomic_read_unchecked(&fscache_n_stores_ok),
47373+ atomic_read_unchecked(&fscache_n_stores_again),
47374+ atomic_read_unchecked(&fscache_n_stores_nobufs),
47375+ atomic_read_unchecked(&fscache_n_stores_oom));
47376 seq_printf(m, "Stores : ops=%u run=%u pgs=%u rxd=%u olm=%u\n",
47377- atomic_read(&fscache_n_store_ops),
47378- atomic_read(&fscache_n_store_calls),
47379- atomic_read(&fscache_n_store_pages),
47380- atomic_read(&fscache_n_store_radix_deletes),
47381- atomic_read(&fscache_n_store_pages_over_limit));
47382+ atomic_read_unchecked(&fscache_n_store_ops),
47383+ atomic_read_unchecked(&fscache_n_store_calls),
47384+ atomic_read_unchecked(&fscache_n_store_pages),
47385+ atomic_read_unchecked(&fscache_n_store_radix_deletes),
47386+ atomic_read_unchecked(&fscache_n_store_pages_over_limit));
47387
47388 seq_printf(m, "VmScan : nos=%u gon=%u bsy=%u can=%u\n",
47389- atomic_read(&fscache_n_store_vmscan_not_storing),
47390- atomic_read(&fscache_n_store_vmscan_gone),
47391- atomic_read(&fscache_n_store_vmscan_busy),
47392- atomic_read(&fscache_n_store_vmscan_cancelled));
47393+ atomic_read_unchecked(&fscache_n_store_vmscan_not_storing),
47394+ atomic_read_unchecked(&fscache_n_store_vmscan_gone),
47395+ atomic_read_unchecked(&fscache_n_store_vmscan_busy),
47396+ atomic_read_unchecked(&fscache_n_store_vmscan_cancelled));
47397
47398 seq_printf(m, "Ops : pend=%u run=%u enq=%u can=%u rej=%u\n",
47399- atomic_read(&fscache_n_op_pend),
47400- atomic_read(&fscache_n_op_run),
47401- atomic_read(&fscache_n_op_enqueue),
47402- atomic_read(&fscache_n_op_cancelled),
47403- atomic_read(&fscache_n_op_rejected));
47404+ atomic_read_unchecked(&fscache_n_op_pend),
47405+ atomic_read_unchecked(&fscache_n_op_run),
47406+ atomic_read_unchecked(&fscache_n_op_enqueue),
47407+ atomic_read_unchecked(&fscache_n_op_cancelled),
47408+ atomic_read_unchecked(&fscache_n_op_rejected));
47409 seq_printf(m, "Ops : dfr=%u rel=%u gc=%u\n",
47410- atomic_read(&fscache_n_op_deferred_release),
47411- atomic_read(&fscache_n_op_release),
47412- atomic_read(&fscache_n_op_gc));
47413+ atomic_read_unchecked(&fscache_n_op_deferred_release),
47414+ atomic_read_unchecked(&fscache_n_op_release),
47415+ atomic_read_unchecked(&fscache_n_op_gc));
47416
47417 seq_printf(m, "CacheOp: alo=%d luo=%d luc=%d gro=%d\n",
47418 atomic_read(&fscache_n_cop_alloc_object),
47419diff -urNp linux-2.6.39/fs/fs_struct.c linux-2.6.39/fs/fs_struct.c
47420--- linux-2.6.39/fs/fs_struct.c 2011-05-19 00:06:34.000000000 -0400
47421+++ linux-2.6.39/fs/fs_struct.c 2011-05-22 19:41:37.000000000 -0400
47422@@ -4,6 +4,7 @@
47423 #include <linux/path.h>
47424 #include <linux/slab.h>
47425 #include <linux/fs_struct.h>
47426+#include <linux/grsecurity.h>
47427 #include "internal.h"
47428
47429 static inline void path_get_longterm(struct path *path)
47430@@ -31,6 +32,7 @@ void set_fs_root(struct fs_struct *fs, s
47431 old_root = fs->root;
47432 fs->root = *path;
47433 path_get_longterm(path);
47434+ gr_set_chroot_entries(current, path);
47435 write_seqcount_end(&fs->seq);
47436 spin_unlock(&fs->lock);
47437 if (old_root.dentry)
47438@@ -74,6 +76,7 @@ void chroot_fs_refs(struct path *old_roo
47439 && fs->root.mnt == old_root->mnt) {
47440 path_get_longterm(new_root);
47441 fs->root = *new_root;
47442+ gr_set_chroot_entries(p, new_root);
47443 count++;
47444 }
47445 if (fs->pwd.dentry == old_root->dentry
47446@@ -109,7 +112,8 @@ void exit_fs(struct task_struct *tsk)
47447 spin_lock(&fs->lock);
47448 write_seqcount_begin(&fs->seq);
47449 tsk->fs = NULL;
47450- kill = !--fs->users;
47451+ gr_clear_chroot_entries(tsk);
47452+ kill = !atomic_dec_return(&fs->users);
47453 write_seqcount_end(&fs->seq);
47454 spin_unlock(&fs->lock);
47455 task_unlock(tsk);
47456@@ -123,7 +127,7 @@ struct fs_struct *copy_fs_struct(struct
47457 struct fs_struct *fs = kmem_cache_alloc(fs_cachep, GFP_KERNEL);
47458 /* We don't need to lock fs - think why ;-) */
47459 if (fs) {
47460- fs->users = 1;
47461+ atomic_set(&fs->users, 1);
47462 fs->in_exec = 0;
47463 spin_lock_init(&fs->lock);
47464 seqcount_init(&fs->seq);
47465@@ -132,6 +136,9 @@ struct fs_struct *copy_fs_struct(struct
47466 spin_lock(&old->lock);
47467 fs->root = old->root;
47468 path_get_longterm(&fs->root);
47469+ /* instead of calling gr_set_chroot_entries here,
47470+ we call it from every caller of this function
47471+ */
47472 fs->pwd = old->pwd;
47473 path_get_longterm(&fs->pwd);
47474 spin_unlock(&old->lock);
47475@@ -150,8 +157,9 @@ int unshare_fs_struct(void)
47476
47477 task_lock(current);
47478 spin_lock(&fs->lock);
47479- kill = !--fs->users;
47480+ kill = !atomic_dec_return(&fs->users);
47481 current->fs = new_fs;
47482+ gr_set_chroot_entries(current, &new_fs->root);
47483 spin_unlock(&fs->lock);
47484 task_unlock(current);
47485
47486@@ -170,7 +178,7 @@ EXPORT_SYMBOL(current_umask);
47487
47488 /* to be mentioned only in INIT_TASK */
47489 struct fs_struct init_fs = {
47490- .users = 1,
47491+ .users = ATOMIC_INIT(1),
47492 .lock = __SPIN_LOCK_UNLOCKED(init_fs.lock),
47493 .seq = SEQCNT_ZERO,
47494 .umask = 0022,
47495@@ -186,12 +194,13 @@ void daemonize_fs_struct(void)
47496 task_lock(current);
47497
47498 spin_lock(&init_fs.lock);
47499- init_fs.users++;
47500+ atomic_inc(&init_fs.users);
47501 spin_unlock(&init_fs.lock);
47502
47503 spin_lock(&fs->lock);
47504 current->fs = &init_fs;
47505- kill = !--fs->users;
47506+ gr_set_chroot_entries(current, &current->fs->root);
47507+ kill = !atomic_dec_return(&fs->users);
47508 spin_unlock(&fs->lock);
47509
47510 task_unlock(current);
47511diff -urNp linux-2.6.39/fs/fuse/cuse.c linux-2.6.39/fs/fuse/cuse.c
47512--- linux-2.6.39/fs/fuse/cuse.c 2011-05-19 00:06:34.000000000 -0400
47513+++ linux-2.6.39/fs/fuse/cuse.c 2011-05-22 19:36:32.000000000 -0400
47514@@ -538,8 +538,18 @@ static int cuse_channel_release(struct i
47515 return rc;
47516 }
47517
47518-static struct file_operations cuse_channel_fops; /* initialized during init */
47519-
47520+static const struct file_operations cuse_channel_fops = { /* initialized during init */
47521+ .owner = THIS_MODULE,
47522+ .llseek = no_llseek,
47523+ .read = do_sync_read,
47524+ .aio_read = fuse_dev_read,
47525+ .write = do_sync_write,
47526+ .aio_write = fuse_dev_write,
47527+ .poll = fuse_dev_poll,
47528+ .open = cuse_channel_open,
47529+ .release = cuse_channel_release,
47530+ .fasync = fuse_dev_fasync,
47531+};
47532
47533 /**************************************************************************
47534 * Misc stuff and module initializatiion
47535@@ -585,12 +595,6 @@ static int __init cuse_init(void)
47536 for (i = 0; i < CUSE_CONNTBL_LEN; i++)
47537 INIT_LIST_HEAD(&cuse_conntbl[i]);
47538
47539- /* inherit and extend fuse_dev_operations */
47540- cuse_channel_fops = fuse_dev_operations;
47541- cuse_channel_fops.owner = THIS_MODULE;
47542- cuse_channel_fops.open = cuse_channel_open;
47543- cuse_channel_fops.release = cuse_channel_release;
47544-
47545 cuse_class = class_create(THIS_MODULE, "cuse");
47546 if (IS_ERR(cuse_class))
47547 return PTR_ERR(cuse_class);
47548diff -urNp linux-2.6.39/fs/fuse/dev.c linux-2.6.39/fs/fuse/dev.c
47549--- linux-2.6.39/fs/fuse/dev.c 2011-05-19 00:06:34.000000000 -0400
47550+++ linux-2.6.39/fs/fuse/dev.c 2011-05-22 19:36:32.000000000 -0400
47551@@ -1181,7 +1181,7 @@ static ssize_t fuse_dev_do_read(struct f
47552 return err;
47553 }
47554
47555-static ssize_t fuse_dev_read(struct kiocb *iocb, const struct iovec *iov,
47556+ssize_t fuse_dev_read(struct kiocb *iocb, const struct iovec *iov,
47557 unsigned long nr_segs, loff_t pos)
47558 {
47559 struct fuse_copy_state cs;
47560@@ -1195,6 +1195,8 @@ static ssize_t fuse_dev_read(struct kioc
47561 return fuse_dev_do_read(fc, file, &cs, iov_length(iov, nr_segs));
47562 }
47563
47564+EXPORT_SYMBOL_GPL(fuse_dev_read);
47565+
47566 static int fuse_dev_pipe_buf_steal(struct pipe_inode_info *pipe,
47567 struct pipe_buffer *buf)
47568 {
47569@@ -1238,7 +1240,7 @@ static ssize_t fuse_dev_splice_read(stru
47570 ret = 0;
47571 pipe_lock(pipe);
47572
47573- if (!pipe->readers) {
47574+ if (!atomic_read(&pipe->readers)) {
47575 send_sig(SIGPIPE, current, 0);
47576 if (!ret)
47577 ret = -EPIPE;
47578@@ -1731,7 +1733,7 @@ static ssize_t fuse_dev_do_write(struct
47579 return err;
47580 }
47581
47582-static ssize_t fuse_dev_write(struct kiocb *iocb, const struct iovec *iov,
47583+ssize_t fuse_dev_write(struct kiocb *iocb, const struct iovec *iov,
47584 unsigned long nr_segs, loff_t pos)
47585 {
47586 struct fuse_copy_state cs;
47587@@ -1744,6 +1746,8 @@ static ssize_t fuse_dev_write(struct kio
47588 return fuse_dev_do_write(fc, &cs, iov_length(iov, nr_segs));
47589 }
47590
47591+EXPORT_SYMBOL_GPL(fuse_dev_write);
47592+
47593 static ssize_t fuse_dev_splice_write(struct pipe_inode_info *pipe,
47594 struct file *out, loff_t *ppos,
47595 size_t len, unsigned int flags)
47596@@ -1822,7 +1826,7 @@ out:
47597 return ret;
47598 }
47599
47600-static unsigned fuse_dev_poll(struct file *file, poll_table *wait)
47601+unsigned fuse_dev_poll(struct file *file, poll_table *wait)
47602 {
47603 unsigned mask = POLLOUT | POLLWRNORM;
47604 struct fuse_conn *fc = fuse_get_conn(file);
47605@@ -1841,6 +1845,8 @@ static unsigned fuse_dev_poll(struct fil
47606 return mask;
47607 }
47608
47609+EXPORT_SYMBOL_GPL(fuse_dev_poll);
47610+
47611 /*
47612 * Abort all requests on the given list (pending or processing)
47613 *
47614@@ -1977,7 +1983,7 @@ int fuse_dev_release(struct inode *inode
47615 }
47616 EXPORT_SYMBOL_GPL(fuse_dev_release);
47617
47618-static int fuse_dev_fasync(int fd, struct file *file, int on)
47619+int fuse_dev_fasync(int fd, struct file *file, int on)
47620 {
47621 struct fuse_conn *fc = fuse_get_conn(file);
47622 if (!fc)
47623@@ -1987,6 +1993,8 @@ static int fuse_dev_fasync(int fd, struc
47624 return fasync_helper(fd, file, on, &fc->fasync);
47625 }
47626
47627+EXPORT_SYMBOL_GPL(fuse_dev_fasync);
47628+
47629 const struct file_operations fuse_dev_operations = {
47630 .owner = THIS_MODULE,
47631 .llseek = no_llseek,
47632diff -urNp linux-2.6.39/fs/fuse/dir.c linux-2.6.39/fs/fuse/dir.c
47633--- linux-2.6.39/fs/fuse/dir.c 2011-05-19 00:06:34.000000000 -0400
47634+++ linux-2.6.39/fs/fuse/dir.c 2011-05-22 19:36:32.000000000 -0400
47635@@ -1147,7 +1147,7 @@ static char *read_link(struct dentry *de
47636 return link;
47637 }
47638
47639-static void free_link(char *link)
47640+static void free_link(const char *link)
47641 {
47642 if (!IS_ERR(link))
47643 free_page((unsigned long) link);
47644diff -urNp linux-2.6.39/fs/fuse/fuse_i.h linux-2.6.39/fs/fuse/fuse_i.h
47645--- linux-2.6.39/fs/fuse/fuse_i.h 2011-05-19 00:06:34.000000000 -0400
47646+++ linux-2.6.39/fs/fuse/fuse_i.h 2011-05-22 19:36:32.000000000 -0400
47647@@ -540,6 +540,16 @@ extern const struct file_operations fuse
47648
47649 extern const struct dentry_operations fuse_dentry_operations;
47650
47651+extern ssize_t fuse_dev_read(struct kiocb *iocb, const struct iovec *iov,
47652+ unsigned long nr_segs, loff_t pos);
47653+
47654+extern ssize_t fuse_dev_write(struct kiocb *iocb, const struct iovec *iov,
47655+ unsigned long nr_segs, loff_t pos);
47656+
47657+extern unsigned fuse_dev_poll(struct file *file, poll_table *wait);
47658+
47659+extern int fuse_dev_fasync(int fd, struct file *file, int on);
47660+
47661 /**
47662 * Inode to nodeid comparison.
47663 */
47664diff -urNp linux-2.6.39/fs/gfs2/ops_inode.c linux-2.6.39/fs/gfs2/ops_inode.c
47665--- linux-2.6.39/fs/gfs2/ops_inode.c 2011-05-19 00:06:34.000000000 -0400
47666+++ linux-2.6.39/fs/gfs2/ops_inode.c 2011-05-22 19:36:32.000000000 -0400
47667@@ -740,6 +740,8 @@ static int gfs2_rename(struct inode *odi
47668 unsigned int x;
47669 int error;
47670
47671+ pax_track_stack();
47672+
47673 if (ndentry->d_inode) {
47674 nip = GFS2_I(ndentry->d_inode);
47675 if (ip == nip)
47676@@ -1019,7 +1021,7 @@ out:
47677
47678 static void gfs2_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
47679 {
47680- char *s = nd_get_link(nd);
47681+ const char *s = nd_get_link(nd);
47682 if (!IS_ERR(s))
47683 kfree(s);
47684 }
47685diff -urNp linux-2.6.39/fs/hfsplus/catalog.c linux-2.6.39/fs/hfsplus/catalog.c
47686--- linux-2.6.39/fs/hfsplus/catalog.c 2011-05-19 00:06:34.000000000 -0400
47687+++ linux-2.6.39/fs/hfsplus/catalog.c 2011-05-22 19:36:32.000000000 -0400
47688@@ -179,6 +179,8 @@ int hfsplus_find_cat(struct super_block
47689 int err;
47690 u16 type;
47691
47692+ pax_track_stack();
47693+
47694 hfsplus_cat_build_key(sb, fd->search_key, cnid, NULL);
47695 err = hfs_brec_read(fd, &tmp, sizeof(hfsplus_cat_entry));
47696 if (err)
47697@@ -210,6 +212,8 @@ int hfsplus_create_cat(u32 cnid, struct
47698 int entry_size;
47699 int err;
47700
47701+ pax_track_stack();
47702+
47703 dprint(DBG_CAT_MOD, "create_cat: %s,%u(%d)\n",
47704 str->name, cnid, inode->i_nlink);
47705 hfs_find_init(HFSPLUS_SB(sb)->cat_tree, &fd);
47706@@ -349,6 +353,8 @@ int hfsplus_rename_cat(u32 cnid,
47707 int entry_size, type;
47708 int err = 0;
47709
47710+ pax_track_stack();
47711+
47712 dprint(DBG_CAT_MOD, "rename_cat: %u - %lu,%s - %lu,%s\n",
47713 cnid, src_dir->i_ino, src_name->name,
47714 dst_dir->i_ino, dst_name->name);
47715diff -urNp linux-2.6.39/fs/hfsplus/dir.c linux-2.6.39/fs/hfsplus/dir.c
47716--- linux-2.6.39/fs/hfsplus/dir.c 2011-05-19 00:06:34.000000000 -0400
47717+++ linux-2.6.39/fs/hfsplus/dir.c 2011-05-22 19:36:32.000000000 -0400
47718@@ -129,6 +129,8 @@ static int hfsplus_readdir(struct file *
47719 struct hfsplus_readdir_data *rd;
47720 u16 type;
47721
47722+ pax_track_stack();
47723+
47724 if (filp->f_pos >= inode->i_size)
47725 return 0;
47726
47727diff -urNp linux-2.6.39/fs/hfsplus/inode.c linux-2.6.39/fs/hfsplus/inode.c
47728--- linux-2.6.39/fs/hfsplus/inode.c 2011-05-19 00:06:34.000000000 -0400
47729+++ linux-2.6.39/fs/hfsplus/inode.c 2011-05-22 19:36:32.000000000 -0400
47730@@ -489,6 +489,8 @@ int hfsplus_cat_read_inode(struct inode
47731 int res = 0;
47732 u16 type;
47733
47734+ pax_track_stack();
47735+
47736 type = hfs_bnode_read_u16(fd->bnode, fd->entryoffset);
47737
47738 HFSPLUS_I(inode)->linkid = 0;
47739@@ -552,6 +554,8 @@ int hfsplus_cat_write_inode(struct inode
47740 struct hfs_find_data fd;
47741 hfsplus_cat_entry entry;
47742
47743+ pax_track_stack();
47744+
47745 if (HFSPLUS_IS_RSRC(inode))
47746 main_inode = HFSPLUS_I(inode)->rsrc_inode;
47747
47748diff -urNp linux-2.6.39/fs/hfsplus/ioctl.c linux-2.6.39/fs/hfsplus/ioctl.c
47749--- linux-2.6.39/fs/hfsplus/ioctl.c 2011-05-19 00:06:34.000000000 -0400
47750+++ linux-2.6.39/fs/hfsplus/ioctl.c 2011-05-22 19:36:32.000000000 -0400
47751@@ -122,6 +122,8 @@ int hfsplus_setxattr(struct dentry *dent
47752 struct hfsplus_cat_file *file;
47753 int res;
47754
47755+ pax_track_stack();
47756+
47757 if (!S_ISREG(inode->i_mode) || HFSPLUS_IS_RSRC(inode))
47758 return -EOPNOTSUPP;
47759
47760@@ -166,6 +168,8 @@ ssize_t hfsplus_getxattr(struct dentry *
47761 struct hfsplus_cat_file *file;
47762 ssize_t res = 0;
47763
47764+ pax_track_stack();
47765+
47766 if (!S_ISREG(inode->i_mode) || HFSPLUS_IS_RSRC(inode))
47767 return -EOPNOTSUPP;
47768
47769diff -urNp linux-2.6.39/fs/hfsplus/super.c linux-2.6.39/fs/hfsplus/super.c
47770--- linux-2.6.39/fs/hfsplus/super.c 2011-05-19 00:06:34.000000000 -0400
47771+++ linux-2.6.39/fs/hfsplus/super.c 2011-05-22 19:36:32.000000000 -0400
47772@@ -340,6 +340,8 @@ static int hfsplus_fill_super(struct sup
47773 struct nls_table *nls = NULL;
47774 int err;
47775
47776+ pax_track_stack();
47777+
47778 err = -EINVAL;
47779 sbi = kzalloc(sizeof(*sbi), GFP_KERNEL);
47780 if (!sbi)
47781diff -urNp linux-2.6.39/fs/hugetlbfs/inode.c linux-2.6.39/fs/hugetlbfs/inode.c
47782--- linux-2.6.39/fs/hugetlbfs/inode.c 2011-05-19 00:06:34.000000000 -0400
47783+++ linux-2.6.39/fs/hugetlbfs/inode.c 2011-05-22 19:41:37.000000000 -0400
47784@@ -914,7 +914,7 @@ static struct file_system_type hugetlbfs
47785 .kill_sb = kill_litter_super,
47786 };
47787
47788-static struct vfsmount *hugetlbfs_vfsmount;
47789+struct vfsmount *hugetlbfs_vfsmount;
47790
47791 static int can_do_hugetlb_shm(void)
47792 {
47793diff -urNp linux-2.6.39/fs/inode.c linux-2.6.39/fs/inode.c
47794--- linux-2.6.39/fs/inode.c 2011-05-19 00:06:34.000000000 -0400
47795+++ linux-2.6.39/fs/inode.c 2011-05-22 19:36:32.000000000 -0400
47796@@ -862,8 +862,8 @@ unsigned int get_next_ino(void)
47797
47798 #ifdef CONFIG_SMP
47799 if (unlikely((res & (LAST_INO_BATCH-1)) == 0)) {
47800- static atomic_t shared_last_ino;
47801- int next = atomic_add_return(LAST_INO_BATCH, &shared_last_ino);
47802+ static atomic_unchecked_t shared_last_ino;
47803+ int next = atomic_add_return_unchecked(LAST_INO_BATCH, &shared_last_ino);
47804
47805 res = next - LAST_INO_BATCH;
47806 }
47807diff -urNp linux-2.6.39/fs/jbd/checkpoint.c linux-2.6.39/fs/jbd/checkpoint.c
47808--- linux-2.6.39/fs/jbd/checkpoint.c 2011-05-19 00:06:34.000000000 -0400
47809+++ linux-2.6.39/fs/jbd/checkpoint.c 2011-05-22 19:36:32.000000000 -0400
47810@@ -350,6 +350,8 @@ int log_do_checkpoint(journal_t *journal
47811 tid_t this_tid;
47812 int result;
47813
47814+ pax_track_stack();
47815+
47816 jbd_debug(1, "Start checkpoint\n");
47817
47818 /*
47819diff -urNp linux-2.6.39/fs/jffs2/compr_rtime.c linux-2.6.39/fs/jffs2/compr_rtime.c
47820--- linux-2.6.39/fs/jffs2/compr_rtime.c 2011-05-19 00:06:34.000000000 -0400
47821+++ linux-2.6.39/fs/jffs2/compr_rtime.c 2011-05-22 19:36:32.000000000 -0400
47822@@ -37,6 +37,8 @@ static int jffs2_rtime_compress(unsigned
47823 int outpos = 0;
47824 int pos=0;
47825
47826+ pax_track_stack();
47827+
47828 memset(positions,0,sizeof(positions));
47829
47830 while (pos < (*sourcelen) && outpos <= (*dstlen)-2) {
47831@@ -78,6 +80,8 @@ static int jffs2_rtime_decompress(unsign
47832 int outpos = 0;
47833 int pos=0;
47834
47835+ pax_track_stack();
47836+
47837 memset(positions,0,sizeof(positions));
47838
47839 while (outpos<destlen) {
47840diff -urNp linux-2.6.39/fs/jffs2/compr_rubin.c linux-2.6.39/fs/jffs2/compr_rubin.c
47841--- linux-2.6.39/fs/jffs2/compr_rubin.c 2011-05-19 00:06:34.000000000 -0400
47842+++ linux-2.6.39/fs/jffs2/compr_rubin.c 2011-05-22 19:36:32.000000000 -0400
47843@@ -314,6 +314,8 @@ static int jffs2_dynrubin_compress(unsig
47844 int ret;
47845 uint32_t mysrclen, mydstlen;
47846
47847+ pax_track_stack();
47848+
47849 mysrclen = *sourcelen;
47850 mydstlen = *dstlen - 8;
47851
47852diff -urNp linux-2.6.39/fs/jffs2/erase.c linux-2.6.39/fs/jffs2/erase.c
47853--- linux-2.6.39/fs/jffs2/erase.c 2011-05-19 00:06:34.000000000 -0400
47854+++ linux-2.6.39/fs/jffs2/erase.c 2011-05-22 19:36:32.000000000 -0400
47855@@ -439,7 +439,8 @@ static void jffs2_mark_erased_block(stru
47856 struct jffs2_unknown_node marker = {
47857 .magic = cpu_to_je16(JFFS2_MAGIC_BITMASK),
47858 .nodetype = cpu_to_je16(JFFS2_NODETYPE_CLEANMARKER),
47859- .totlen = cpu_to_je32(c->cleanmarker_size)
47860+ .totlen = cpu_to_je32(c->cleanmarker_size),
47861+ .hdr_crc = cpu_to_je32(0)
47862 };
47863
47864 jffs2_prealloc_raw_node_refs(c, jeb, 1);
47865diff -urNp linux-2.6.39/fs/jffs2/wbuf.c linux-2.6.39/fs/jffs2/wbuf.c
47866--- linux-2.6.39/fs/jffs2/wbuf.c 2011-05-19 00:06:34.000000000 -0400
47867+++ linux-2.6.39/fs/jffs2/wbuf.c 2011-05-22 19:36:32.000000000 -0400
47868@@ -1012,7 +1012,8 @@ static const struct jffs2_unknown_node o
47869 {
47870 .magic = constant_cpu_to_je16(JFFS2_MAGIC_BITMASK),
47871 .nodetype = constant_cpu_to_je16(JFFS2_NODETYPE_CLEANMARKER),
47872- .totlen = constant_cpu_to_je32(8)
47873+ .totlen = constant_cpu_to_je32(8),
47874+ .hdr_crc = constant_cpu_to_je32(0)
47875 };
47876
47877 /*
47878diff -urNp linux-2.6.39/fs/jffs2/xattr.c linux-2.6.39/fs/jffs2/xattr.c
47879--- linux-2.6.39/fs/jffs2/xattr.c 2011-05-19 00:06:34.000000000 -0400
47880+++ linux-2.6.39/fs/jffs2/xattr.c 2011-05-22 19:36:32.000000000 -0400
47881@@ -773,6 +773,8 @@ void jffs2_build_xattr_subsystem(struct
47882
47883 BUG_ON(!(c->flags & JFFS2_SB_FLAG_BUILDING));
47884
47885+ pax_track_stack();
47886+
47887 /* Phase.1 : Merge same xref */
47888 for (i=0; i < XREF_TMPHASH_SIZE; i++)
47889 xref_tmphash[i] = NULL;
47890diff -urNp linux-2.6.39/fs/Kconfig.binfmt linux-2.6.39/fs/Kconfig.binfmt
47891--- linux-2.6.39/fs/Kconfig.binfmt 2011-05-19 00:06:34.000000000 -0400
47892+++ linux-2.6.39/fs/Kconfig.binfmt 2011-05-22 19:36:32.000000000 -0400
47893@@ -86,7 +86,7 @@ config HAVE_AOUT
47894
47895 config BINFMT_AOUT
47896 tristate "Kernel support for a.out and ECOFF binaries"
47897- depends on HAVE_AOUT
47898+ depends on HAVE_AOUT && BROKEN
47899 ---help---
47900 A.out (Assembler.OUTput) is a set of formats for libraries and
47901 executables used in the earliest versions of UNIX. Linux used
47902diff -urNp linux-2.6.39/fs/libfs.c linux-2.6.39/fs/libfs.c
47903--- linux-2.6.39/fs/libfs.c 2011-05-19 00:06:34.000000000 -0400
47904+++ linux-2.6.39/fs/libfs.c 2011-05-22 19:36:32.000000000 -0400
47905@@ -163,6 +163,9 @@ int dcache_readdir(struct file * filp, v
47906
47907 for (p=q->next; p != &dentry->d_subdirs; p=p->next) {
47908 struct dentry *next;
47909+ char d_name[sizeof(next->d_iname)];
47910+ const unsigned char *name;
47911+
47912 next = list_entry(p, struct dentry, d_u.d_child);
47913 spin_lock_nested(&next->d_lock, DENTRY_D_LOCK_NESTED);
47914 if (!simple_positive(next)) {
47915@@ -172,7 +175,12 @@ int dcache_readdir(struct file * filp, v
47916
47917 spin_unlock(&next->d_lock);
47918 spin_unlock(&dentry->d_lock);
47919- if (filldir(dirent, next->d_name.name,
47920+ name = next->d_name.name;
47921+ if (name == next->d_iname) {
47922+ memcpy(d_name, name, next->d_name.len);
47923+ name = d_name;
47924+ }
47925+ if (filldir(dirent, name,
47926 next->d_name.len, filp->f_pos,
47927 next->d_inode->i_ino,
47928 dt_type(next->d_inode)) < 0)
47929diff -urNp linux-2.6.39/fs/lockd/clntproc.c linux-2.6.39/fs/lockd/clntproc.c
47930--- linux-2.6.39/fs/lockd/clntproc.c 2011-05-19 00:06:34.000000000 -0400
47931+++ linux-2.6.39/fs/lockd/clntproc.c 2011-05-22 19:36:32.000000000 -0400
47932@@ -36,11 +36,11 @@ static const struct rpc_call_ops nlmclnt
47933 /*
47934 * Cookie counter for NLM requests
47935 */
47936-static atomic_t nlm_cookie = ATOMIC_INIT(0x1234);
47937+static atomic_unchecked_t nlm_cookie = ATOMIC_INIT(0x1234);
47938
47939 void nlmclnt_next_cookie(struct nlm_cookie *c)
47940 {
47941- u32 cookie = atomic_inc_return(&nlm_cookie);
47942+ u32 cookie = atomic_inc_return_unchecked(&nlm_cookie);
47943
47944 memcpy(c->data, &cookie, 4);
47945 c->len=4;
47946@@ -620,6 +620,8 @@ nlmclnt_reclaim(struct nlm_host *host, s
47947 struct nlm_rqst reqst, *req;
47948 int status;
47949
47950+ pax_track_stack();
47951+
47952 req = &reqst;
47953 memset(req, 0, sizeof(*req));
47954 locks_init_lock(&req->a_args.lock.fl);
47955diff -urNp linux-2.6.39/fs/lockd/svc.c linux-2.6.39/fs/lockd/svc.c
47956--- linux-2.6.39/fs/lockd/svc.c 2011-05-19 00:06:34.000000000 -0400
47957+++ linux-2.6.39/fs/lockd/svc.c 2011-05-22 19:36:32.000000000 -0400
47958@@ -41,7 +41,7 @@
47959
47960 static struct svc_program nlmsvc_program;
47961
47962-struct nlmsvc_binding * nlmsvc_ops;
47963+const struct nlmsvc_binding * nlmsvc_ops;
47964 EXPORT_SYMBOL_GPL(nlmsvc_ops);
47965
47966 static DEFINE_MUTEX(nlmsvc_mutex);
47967diff -urNp linux-2.6.39/fs/locks.c linux-2.6.39/fs/locks.c
47968--- linux-2.6.39/fs/locks.c 2011-05-19 00:06:34.000000000 -0400
47969+++ linux-2.6.39/fs/locks.c 2011-05-22 19:36:32.000000000 -0400
47970@@ -2033,16 +2033,16 @@ void locks_remove_flock(struct file *fil
47971 return;
47972
47973 if (filp->f_op && filp->f_op->flock) {
47974- struct file_lock fl = {
47975+ struct file_lock flock = {
47976 .fl_pid = current->tgid,
47977 .fl_file = filp,
47978 .fl_flags = FL_FLOCK,
47979 .fl_type = F_UNLCK,
47980 .fl_end = OFFSET_MAX,
47981 };
47982- filp->f_op->flock(filp, F_SETLKW, &fl);
47983- if (fl.fl_ops && fl.fl_ops->fl_release_private)
47984- fl.fl_ops->fl_release_private(&fl);
47985+ filp->f_op->flock(filp, F_SETLKW, &flock);
47986+ if (flock.fl_ops && flock.fl_ops->fl_release_private)
47987+ flock.fl_ops->fl_release_private(&flock);
47988 }
47989
47990 lock_flocks();
47991diff -urNp linux-2.6.39/fs/logfs/super.c linux-2.6.39/fs/logfs/super.c
47992--- linux-2.6.39/fs/logfs/super.c 2011-05-19 00:06:34.000000000 -0400
47993+++ linux-2.6.39/fs/logfs/super.c 2011-05-22 19:36:32.000000000 -0400
47994@@ -266,6 +266,8 @@ static int logfs_recover_sb(struct super
47995 struct logfs_disk_super _ds1, *ds1 = &_ds1;
47996 int err, valid0, valid1;
47997
47998+ pax_track_stack();
47999+
48000 /* read first superblock */
48001 err = wbuf_read(sb, super->s_sb_ofs[0], sizeof(*ds0), ds0);
48002 if (err)
48003diff -urNp linux-2.6.39/fs/namei.c linux-2.6.39/fs/namei.c
48004--- linux-2.6.39/fs/namei.c 2011-05-19 00:06:34.000000000 -0400
48005+++ linux-2.6.39/fs/namei.c 2011-05-23 18:21:41.000000000 -0400
48006@@ -237,20 +237,30 @@ int generic_permission(struct inode *ino
48007 return ret;
48008
48009 /*
48010- * Read/write DACs are always overridable.
48011- * Executable DACs are overridable if at least one exec bit is set.
48012+ * Searching includes executable on directories, else just read.
48013 */
48014- if (!(mask & MAY_EXEC) || execute_ok(inode))
48015- if (ns_capable(inode_userns(inode), CAP_DAC_OVERRIDE))
48016+ mask &= MAY_READ | MAY_WRITE | MAY_EXEC;
48017+ if (mask == MAY_READ || (S_ISDIR(inode->i_mode) && !(mask & MAY_WRITE))) {
48018+#ifdef CONFIG_GRKERNSEC
48019+ if (flags & IPERM_FLAG_RCU)
48020+ return -ECHILD;
48021+#endif
48022+ if (ns_capable(inode_userns(inode), CAP_DAC_READ_SEARCH))
48023 return 0;
48024+ }
48025
48026 /*
48027- * Searching includes executable on directories, else just read.
48028+ * Read/write DACs are always overridable.
48029+ * Executable DACs are overridable if at least one exec bit is set.
48030 */
48031- mask &= MAY_READ | MAY_WRITE | MAY_EXEC;
48032- if (mask == MAY_READ || (S_ISDIR(inode->i_mode) && !(mask & MAY_WRITE)))
48033- if (ns_capable(inode_userns(inode), CAP_DAC_READ_SEARCH))
48034+ if (!(mask & MAY_EXEC) || execute_ok(inode)) {
48035+#ifdef CONFIG_GRKERNSEC
48036+ if (flags & IPERM_FLAG_RCU)
48037+ return -ECHILD;
48038+#endif
48039+ if (ns_capable(inode_userns(inode), CAP_DAC_OVERRIDE))
48040 return 0;
48041+ }
48042
48043 return -EACCES;
48044 }
48045@@ -626,6 +636,9 @@ static inline int handle_reval_path(stru
48046 struct dentry *dentry = nd->path.dentry;
48047 int status;
48048
48049+ if (!(nd->flags & LOOKUP_PARENT) && !gr_acl_handle_hidden_file(nd->path.dentry, nd->path.mnt))
48050+ return -ENOENT;
48051+
48052 if (likely(!(nd->flags & LOOKUP_JUMPED)))
48053 return 0;
48054
48055@@ -671,9 +684,16 @@ static inline int exec_permission(struct
48056 if (ret == -ECHILD)
48057 return ret;
48058
48059- if (ns_capable(ns, CAP_DAC_OVERRIDE) ||
48060- ns_capable(ns, CAP_DAC_READ_SEARCH))
48061+ if (ns_capable_nolog(ns, CAP_DAC_OVERRIDE))
48062 goto ok;
48063+ else {
48064+#ifdef CONFIG_GRKERNSEC
48065+ if (flags & IPERM_FLAG_RCU)
48066+ return -ECHILD;
48067+#endif
48068+ if (ns_capable(ns, CAP_DAC_READ_SEARCH) || ns_capable(ns, CAP_DAC_OVERRIDE))
48069+ goto ok;
48070+ }
48071
48072 return ret;
48073 ok:
48074@@ -781,11 +801,19 @@ follow_link(struct path *link, struct na
48075 return error;
48076 }
48077
48078+ if (gr_handle_follow_link(dentry->d_parent->d_inode,
48079+ dentry->d_inode, dentry, nd->path.mnt)) {
48080+ error = -EACCES;
48081+ *p = ERR_PTR(error); /* no ->put_link(), please */
48082+ path_put(&nd->path);
48083+ return error;
48084+ }
48085+
48086 nd->last_type = LAST_BIND;
48087 *p = dentry->d_inode->i_op->follow_link(dentry, nd);
48088 error = PTR_ERR(*p);
48089 if (!IS_ERR(*p)) {
48090- char *s = nd_get_link(nd);
48091+ const char *s = nd_get_link(nd);
48092 error = 0;
48093 if (s)
48094 error = __vfs_follow_link(nd, s);
48095@@ -1697,6 +1725,9 @@ static int do_path_lookup(int dfd, const
48096 retval = path_lookupat(dfd, name, flags | LOOKUP_REVAL, nd);
48097
48098 if (likely(!retval)) {
48099+ if (*name != '/' && nd->path.dentry && nd->inode && !gr_chroot_fchdir(nd->path.dentry, nd->path.mnt))
48100+ return -ENOENT;
48101+
48102 if (unlikely(!audit_dummy_context())) {
48103 if (nd->path.dentry && nd->inode)
48104 audit_inode(name, nd->path.dentry);
48105@@ -2007,6 +2038,30 @@ int vfs_create(struct inode *dir, struct
48106 return error;
48107 }
48108
48109+/*
48110+ * Note that while the flag value (low two bits) for sys_open means:
48111+ * 00 - read-only
48112+ * 01 - write-only
48113+ * 10 - read-write
48114+ * 11 - special
48115+ * it is changed into
48116+ * 00 - no permissions needed
48117+ * 01 - read-permission
48118+ * 10 - write-permission
48119+ * 11 - read-write
48120+ * for the internal routines (ie open_namei()/follow_link() etc)
48121+ * This is more logical, and also allows the 00 "no perm needed"
48122+ * to be used for symlinks (where the permissions are checked
48123+ * later).
48124+ *
48125+*/
48126+static inline int open_to_namei_flags(int flag)
48127+{
48128+ if ((flag+1) & O_ACCMODE)
48129+ flag++;
48130+ return flag;
48131+}
48132+
48133 static int may_open(struct path *path, int acc_mode, int flag)
48134 {
48135 struct dentry *dentry = path->dentry;
48136@@ -2059,7 +2114,27 @@ static int may_open(struct path *path, i
48137 /*
48138 * Ensure there are no outstanding leases on the file.
48139 */
48140- return break_lease(inode, flag);
48141+ error = break_lease(inode, flag);
48142+
48143+ if (error)
48144+ return error;
48145+
48146+ if (gr_handle_rofs_blockwrite(dentry, path->mnt, acc_mode)) {
48147+ error = -EPERM;
48148+ goto exit;
48149+ }
48150+
48151+ if (gr_handle_rawio(inode)) {
48152+ error = -EPERM;
48153+ goto exit;
48154+ }
48155+
48156+ if (!gr_acl_handle_open(dentry, path->mnt, open_to_namei_flags(flag))) {
48157+ error = -EACCES;
48158+ goto exit;
48159+ }
48160+exit:
48161+ return error;
48162 }
48163
48164 static int handle_truncate(struct file *filp)
48165@@ -2085,30 +2160,6 @@ static int handle_truncate(struct file *
48166 }
48167
48168 /*
48169- * Note that while the flag value (low two bits) for sys_open means:
48170- * 00 - read-only
48171- * 01 - write-only
48172- * 10 - read-write
48173- * 11 - special
48174- * it is changed into
48175- * 00 - no permissions needed
48176- * 01 - read-permission
48177- * 10 - write-permission
48178- * 11 - read-write
48179- * for the internal routines (ie open_namei()/follow_link() etc)
48180- * This is more logical, and also allows the 00 "no perm needed"
48181- * to be used for symlinks (where the permissions are checked
48182- * later).
48183- *
48184-*/
48185-static inline int open_to_namei_flags(int flag)
48186-{
48187- if ((flag+1) & O_ACCMODE)
48188- flag++;
48189- return flag;
48190-}
48191-
48192-/*
48193 * Handle the last step of open()
48194 */
48195 static struct file *do_last(struct nameidata *nd, struct path *path,
48196@@ -2117,6 +2168,7 @@ static struct file *do_last(struct namei
48197 struct dentry *dir = nd->path.dentry;
48198 struct dentry *dentry;
48199 int open_flag = op->open_flag;
48200+ int flag = open_to_namei_flags(open_flag);
48201 int will_truncate = open_flag & O_TRUNC;
48202 int want_write = 0;
48203 int acc_mode = op->acc_mode;
48204@@ -2212,6 +2264,12 @@ static struct file *do_last(struct namei
48205 /* Negative dentry, just create the file */
48206 if (!dentry->d_inode) {
48207 int mode = op->mode;
48208+
48209+ if (!gr_acl_handle_creat(path->dentry, nd->path.dentry, path->mnt, flag, mode)) {
48210+ error = -EACCES;
48211+ goto exit_mutex_unlock;
48212+ }
48213+
48214 if (!IS_POSIXACL(dir->d_inode))
48215 mode &= ~current_umask();
48216 /*
48217@@ -2235,6 +2293,8 @@ static struct file *do_last(struct namei
48218 error = vfs_create(dir->d_inode, dentry, mode, nd);
48219 if (error)
48220 goto exit_mutex_unlock;
48221+ else
48222+ gr_handle_create(path->dentry, path->mnt);
48223 mutex_unlock(&dir->d_inode->i_mutex);
48224 dput(nd->path.dentry);
48225 nd->path.dentry = dentry;
48226@@ -2244,6 +2304,14 @@ static struct file *do_last(struct namei
48227 /*
48228 * It already exists.
48229 */
48230+
48231+ /* only check if O_CREAT is specified, all other checks need to go
48232+ into may_open */
48233+ if (gr_handle_fifo(path->dentry, path->mnt, dir, flag, acc_mode)) {
48234+ error = -EACCES;
48235+ goto exit_mutex_unlock;
48236+ }
48237+
48238 mutex_unlock(&dir->d_inode->i_mutex);
48239 audit_inode(pathname, path->dentry);
48240
48241@@ -2530,6 +2598,17 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const
48242 error = may_mknod(mode);
48243 if (error)
48244 goto out_dput;
48245+
48246+ if (gr_handle_chroot_mknod(dentry, nd.path.mnt, mode)) {
48247+ error = -EPERM;
48248+ goto out_dput;
48249+ }
48250+
48251+ if (!gr_acl_handle_mknod(dentry, nd.path.dentry, nd.path.mnt, mode)) {
48252+ error = -EACCES;
48253+ goto out_dput;
48254+ }
48255+
48256 error = mnt_want_write(nd.path.mnt);
48257 if (error)
48258 goto out_dput;
48259@@ -2550,6 +2629,9 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const
48260 }
48261 out_drop_write:
48262 mnt_drop_write(nd.path.mnt);
48263+
48264+ if (!error)
48265+ gr_handle_create(dentry, nd.path.mnt);
48266 out_dput:
48267 dput(dentry);
48268 out_unlock:
48269@@ -2602,6 +2684,11 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const
48270 if (IS_ERR(dentry))
48271 goto out_unlock;
48272
48273+ if (!gr_acl_handle_mkdir(dentry, nd.path.dentry, nd.path.mnt)) {
48274+ error = -EACCES;
48275+ goto out_dput;
48276+ }
48277+
48278 if (!IS_POSIXACL(nd.path.dentry->d_inode))
48279 mode &= ~current_umask();
48280 error = mnt_want_write(nd.path.mnt);
48281@@ -2613,6 +2700,10 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const
48282 error = vfs_mkdir(nd.path.dentry->d_inode, dentry, mode);
48283 out_drop_write:
48284 mnt_drop_write(nd.path.mnt);
48285+
48286+ if (!error)
48287+ gr_handle_create(dentry, nd.path.mnt);
48288+
48289 out_dput:
48290 dput(dentry);
48291 out_unlock:
48292@@ -2692,6 +2783,8 @@ static long do_rmdir(int dfd, const char
48293 char * name;
48294 struct dentry *dentry;
48295 struct nameidata nd;
48296+ ino_t saved_ino = 0;
48297+ dev_t saved_dev = 0;
48298
48299 error = user_path_parent(dfd, pathname, &nd, &name);
48300 if (error)
48301@@ -2716,6 +2809,19 @@ static long do_rmdir(int dfd, const char
48302 error = PTR_ERR(dentry);
48303 if (IS_ERR(dentry))
48304 goto exit2;
48305+
48306+ if (dentry->d_inode != NULL) {
48307+ if (dentry->d_inode->i_nlink <= 1) {
48308+ saved_ino = dentry->d_inode->i_ino;
48309+ saved_dev = gr_get_dev_from_dentry(dentry);
48310+ }
48311+
48312+ if (!gr_acl_handle_rmdir(dentry, nd.path.mnt)) {
48313+ error = -EACCES;
48314+ goto exit3;
48315+ }
48316+ }
48317+
48318 error = mnt_want_write(nd.path.mnt);
48319 if (error)
48320 goto exit3;
48321@@ -2723,6 +2829,8 @@ static long do_rmdir(int dfd, const char
48322 if (error)
48323 goto exit4;
48324 error = vfs_rmdir(nd.path.dentry->d_inode, dentry);
48325+ if (!error && (saved_dev || saved_ino))
48326+ gr_handle_delete(saved_ino, saved_dev);
48327 exit4:
48328 mnt_drop_write(nd.path.mnt);
48329 exit3:
48330@@ -2785,6 +2893,8 @@ static long do_unlinkat(int dfd, const c
48331 struct dentry *dentry;
48332 struct nameidata nd;
48333 struct inode *inode = NULL;
48334+ ino_t saved_ino = 0;
48335+ dev_t saved_dev = 0;
48336
48337 error = user_path_parent(dfd, pathname, &nd, &name);
48338 if (error)
48339@@ -2804,8 +2914,17 @@ static long do_unlinkat(int dfd, const c
48340 if (nd.last.name[nd.last.len])
48341 goto slashes;
48342 inode = dentry->d_inode;
48343- if (inode)
48344+ if (inode) {
48345 ihold(inode);
48346+ if (inode->i_nlink <= 1) {
48347+ saved_ino = inode->i_ino;
48348+ saved_dev = gr_get_dev_from_dentry(dentry);
48349+ }
48350+ if (!gr_acl_handle_unlink(dentry, nd.path.mnt)) {
48351+ error = -EACCES;
48352+ goto exit2;
48353+ }
48354+ }
48355 error = mnt_want_write(nd.path.mnt);
48356 if (error)
48357 goto exit2;
48358@@ -2813,6 +2932,8 @@ static long do_unlinkat(int dfd, const c
48359 if (error)
48360 goto exit3;
48361 error = vfs_unlink(nd.path.dentry->d_inode, dentry);
48362+ if (!error && (saved_ino || saved_dev))
48363+ gr_handle_delete(saved_ino, saved_dev);
48364 exit3:
48365 mnt_drop_write(nd.path.mnt);
48366 exit2:
48367@@ -2890,6 +3011,11 @@ SYSCALL_DEFINE3(symlinkat, const char __
48368 if (IS_ERR(dentry))
48369 goto out_unlock;
48370
48371+ if (!gr_acl_handle_symlink(dentry, nd.path.dentry, nd.path.mnt, from)) {
48372+ error = -EACCES;
48373+ goto out_dput;
48374+ }
48375+
48376 error = mnt_want_write(nd.path.mnt);
48377 if (error)
48378 goto out_dput;
48379@@ -2897,6 +3023,8 @@ SYSCALL_DEFINE3(symlinkat, const char __
48380 if (error)
48381 goto out_drop_write;
48382 error = vfs_symlink(nd.path.dentry->d_inode, dentry, from);
48383+ if (!error)
48384+ gr_handle_create(dentry, nd.path.mnt);
48385 out_drop_write:
48386 mnt_drop_write(nd.path.mnt);
48387 out_dput:
48388@@ -3005,6 +3133,20 @@ SYSCALL_DEFINE5(linkat, int, olddfd, con
48389 error = PTR_ERR(new_dentry);
48390 if (IS_ERR(new_dentry))
48391 goto out_unlock;
48392+
48393+ if (gr_handle_hardlink(old_path.dentry, old_path.mnt,
48394+ old_path.dentry->d_inode,
48395+ old_path.dentry->d_inode->i_mode, to)) {
48396+ error = -EACCES;
48397+ goto out_dput;
48398+ }
48399+
48400+ if (!gr_acl_handle_link(new_dentry, nd.path.dentry, nd.path.mnt,
48401+ old_path.dentry, old_path.mnt, to)) {
48402+ error = -EACCES;
48403+ goto out_dput;
48404+ }
48405+
48406 error = mnt_want_write(nd.path.mnt);
48407 if (error)
48408 goto out_dput;
48409@@ -3012,6 +3154,8 @@ SYSCALL_DEFINE5(linkat, int, olddfd, con
48410 if (error)
48411 goto out_drop_write;
48412 error = vfs_link(old_path.dentry, nd.path.dentry->d_inode, new_dentry);
48413+ if (!error)
48414+ gr_handle_create(new_dentry, nd.path.mnt);
48415 out_drop_write:
48416 mnt_drop_write(nd.path.mnt);
48417 out_dput:
48418@@ -3189,6 +3333,8 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c
48419 char *to;
48420 int error;
48421
48422+ pax_track_stack();
48423+
48424 error = user_path_parent(olddfd, oldname, &oldnd, &from);
48425 if (error)
48426 goto exit;
48427@@ -3245,6 +3391,12 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c
48428 if (new_dentry == trap)
48429 goto exit5;
48430
48431+ error = gr_acl_handle_rename(new_dentry, new_dir, newnd.path.mnt,
48432+ old_dentry, old_dir->d_inode, oldnd.path.mnt,
48433+ to);
48434+ if (error)
48435+ goto exit5;
48436+
48437 error = mnt_want_write(oldnd.path.mnt);
48438 if (error)
48439 goto exit5;
48440@@ -3254,6 +3406,9 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c
48441 goto exit6;
48442 error = vfs_rename(old_dir->d_inode, old_dentry,
48443 new_dir->d_inode, new_dentry);
48444+ if (!error)
48445+ gr_handle_rename(old_dir->d_inode, new_dir->d_inode, old_dentry,
48446+ new_dentry, oldnd.path.mnt, new_dentry->d_inode ? 1 : 0);
48447 exit6:
48448 mnt_drop_write(oldnd.path.mnt);
48449 exit5:
48450@@ -3279,6 +3434,8 @@ SYSCALL_DEFINE2(rename, const char __use
48451
48452 int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen, const char *link)
48453 {
48454+ char tmpbuf[64];
48455+ const char *newlink;
48456 int len;
48457
48458 len = PTR_ERR(link);
48459@@ -3288,7 +3445,14 @@ int vfs_readlink(struct dentry *dentry,
48460 len = strlen(link);
48461 if (len > (unsigned) buflen)
48462 len = buflen;
48463- if (copy_to_user(buffer, link, len))
48464+
48465+ if (len < sizeof(tmpbuf)) {
48466+ memcpy(tmpbuf, link, len);
48467+ newlink = tmpbuf;
48468+ } else
48469+ newlink = link;
48470+
48471+ if (copy_to_user(buffer, newlink, len))
48472 len = -EFAULT;
48473 out:
48474 return len;
48475diff -urNp linux-2.6.39/fs/namespace.c linux-2.6.39/fs/namespace.c
48476--- linux-2.6.39/fs/namespace.c 2011-05-19 00:06:34.000000000 -0400
48477+++ linux-2.6.39/fs/namespace.c 2011-05-22 20:43:58.000000000 -0400
48478@@ -1328,6 +1328,9 @@ static int do_umount(struct vfsmount *mn
48479 if (!(sb->s_flags & MS_RDONLY))
48480 retval = do_remount_sb(sb, MS_RDONLY, NULL, 0);
48481 up_write(&sb->s_umount);
48482+
48483+ gr_log_remount(mnt->mnt_devname, retval);
48484+
48485 return retval;
48486 }
48487
48488@@ -1347,6 +1350,9 @@ static int do_umount(struct vfsmount *mn
48489 br_write_unlock(vfsmount_lock);
48490 up_write(&namespace_sem);
48491 release_mounts(&umount_list);
48492+
48493+ gr_log_unmount(mnt->mnt_devname, retval);
48494+
48495 return retval;
48496 }
48497
48498@@ -2338,6 +2344,16 @@ long do_mount(char *dev_name, char *dir_
48499 MS_NOATIME | MS_NODIRATIME | MS_RELATIME| MS_KERNMOUNT |
48500 MS_STRICTATIME);
48501
48502+ if (gr_handle_rofs_mount(path.dentry, path.mnt, mnt_flags)) {
48503+ retval = -EPERM;
48504+ goto dput_out;
48505+ }
48506+
48507+ if (gr_handle_chroot_mount(path.dentry, path.mnt, dev_name)) {
48508+ retval = -EPERM;
48509+ goto dput_out;
48510+ }
48511+
48512 if (flags & MS_REMOUNT)
48513 retval = do_remount(&path, flags & ~MS_REMOUNT, mnt_flags,
48514 data_page);
48515@@ -2352,6 +2368,9 @@ long do_mount(char *dev_name, char *dir_
48516 dev_name, data_page);
48517 dput_out:
48518 path_put(&path);
48519+
48520+ gr_log_mount(dev_name, dir_name, retval);
48521+
48522 return retval;
48523 }
48524
48525@@ -2575,6 +2594,11 @@ SYSCALL_DEFINE2(pivot_root, const char _
48526 if (error)
48527 goto out2;
48528
48529+ if (gr_handle_chroot_pivot()) {
48530+ error = -EPERM;
48531+ goto out2;
48532+ }
48533+
48534 get_fs_root(current->fs, &root);
48535 error = lock_mount(&old);
48536 if (error)
48537diff -urNp linux-2.6.39/fs/ncpfs/dir.c linux-2.6.39/fs/ncpfs/dir.c
48538--- linux-2.6.39/fs/ncpfs/dir.c 2011-05-19 00:06:34.000000000 -0400
48539+++ linux-2.6.39/fs/ncpfs/dir.c 2011-05-22 19:36:32.000000000 -0400
48540@@ -299,6 +299,8 @@ ncp_lookup_validate(struct dentry *dentr
48541 int res, val = 0, len;
48542 __u8 __name[NCP_MAXPATHLEN + 1];
48543
48544+ pax_track_stack();
48545+
48546 if (dentry == dentry->d_sb->s_root)
48547 return 1;
48548
48549@@ -844,6 +846,8 @@ static struct dentry *ncp_lookup(struct
48550 int error, res, len;
48551 __u8 __name[NCP_MAXPATHLEN + 1];
48552
48553+ pax_track_stack();
48554+
48555 error = -EIO;
48556 if (!ncp_conn_valid(server))
48557 goto finished;
48558@@ -931,6 +935,8 @@ int ncp_create_new(struct inode *dir, st
48559 PPRINTK("ncp_create_new: creating %s/%s, mode=%x\n",
48560 dentry->d_parent->d_name.name, dentry->d_name.name, mode);
48561
48562+ pax_track_stack();
48563+
48564 ncp_age_dentry(server, dentry);
48565 len = sizeof(__name);
48566 error = ncp_io2vol(server, __name, &len, dentry->d_name.name,
48567@@ -992,6 +998,8 @@ static int ncp_mkdir(struct inode *dir,
48568 int error, len;
48569 __u8 __name[NCP_MAXPATHLEN + 1];
48570
48571+ pax_track_stack();
48572+
48573 DPRINTK("ncp_mkdir: making %s/%s\n",
48574 dentry->d_parent->d_name.name, dentry->d_name.name);
48575
48576@@ -1135,6 +1143,8 @@ static int ncp_rename(struct inode *old_
48577 int old_len, new_len;
48578 __u8 __old_name[NCP_MAXPATHLEN + 1], __new_name[NCP_MAXPATHLEN + 1];
48579
48580+ pax_track_stack();
48581+
48582 DPRINTK("ncp_rename: %s/%s to %s/%s\n",
48583 old_dentry->d_parent->d_name.name, old_dentry->d_name.name,
48584 new_dentry->d_parent->d_name.name, new_dentry->d_name.name);
48585diff -urNp linux-2.6.39/fs/ncpfs/inode.c linux-2.6.39/fs/ncpfs/inode.c
48586--- linux-2.6.39/fs/ncpfs/inode.c 2011-05-19 00:06:34.000000000 -0400
48587+++ linux-2.6.39/fs/ncpfs/inode.c 2011-05-22 19:36:32.000000000 -0400
48588@@ -461,6 +461,8 @@ static int ncp_fill_super(struct super_b
48589 #endif
48590 struct ncp_entry_info finfo;
48591
48592+ pax_track_stack();
48593+
48594 data.wdog_pid = NULL;
48595 server = kzalloc(sizeof(struct ncp_server), GFP_KERNEL);
48596 if (!server)
48597diff -urNp linux-2.6.39/fs/nfs/inode.c linux-2.6.39/fs/nfs/inode.c
48598--- linux-2.6.39/fs/nfs/inode.c 2011-05-19 00:06:34.000000000 -0400
48599+++ linux-2.6.39/fs/nfs/inode.c 2011-05-22 19:36:32.000000000 -0400
48600@@ -999,16 +999,16 @@ static int nfs_size_need_update(const st
48601 return nfs_size_to_loff_t(fattr->size) > i_size_read(inode);
48602 }
48603
48604-static atomic_long_t nfs_attr_generation_counter;
48605+static atomic_long_unchecked_t nfs_attr_generation_counter;
48606
48607 static unsigned long nfs_read_attr_generation_counter(void)
48608 {
48609- return atomic_long_read(&nfs_attr_generation_counter);
48610+ return atomic_long_read_unchecked(&nfs_attr_generation_counter);
48611 }
48612
48613 unsigned long nfs_inc_attr_generation_counter(void)
48614 {
48615- return atomic_long_inc_return(&nfs_attr_generation_counter);
48616+ return atomic_long_inc_return_unchecked(&nfs_attr_generation_counter);
48617 }
48618
48619 void nfs_fattr_init(struct nfs_fattr *fattr)
48620diff -urNp linux-2.6.39/fs/nfs/nfs4proc.c linux-2.6.39/fs/nfs/nfs4proc.c
48621--- linux-2.6.39/fs/nfs/nfs4proc.c 2011-05-19 00:06:34.000000000 -0400
48622+++ linux-2.6.39/fs/nfs/nfs4proc.c 2011-05-22 19:36:32.000000000 -0400
48623@@ -5840,14 +5840,14 @@ struct nfs4_state_recovery_ops nfs41_nog
48624 };
48625 #endif /* CONFIG_NFS_V4_1 */
48626
48627-struct nfs4_state_maintenance_ops nfs40_state_renewal_ops = {
48628+const struct nfs4_state_maintenance_ops nfs40_state_renewal_ops = {
48629 .sched_state_renewal = nfs4_proc_async_renew,
48630 .get_state_renewal_cred_locked = nfs4_get_renew_cred_locked,
48631 .renew_lease = nfs4_proc_renew,
48632 };
48633
48634 #if defined(CONFIG_NFS_V4_1)
48635-struct nfs4_state_maintenance_ops nfs41_state_renewal_ops = {
48636+const struct nfs4_state_maintenance_ops nfs41_state_renewal_ops = {
48637 .sched_state_renewal = nfs41_proc_async_sequence,
48638 .get_state_renewal_cred_locked = nfs4_get_machine_cred_locked,
48639 .renew_lease = nfs4_proc_sequence,
48640diff -urNp linux-2.6.39/fs/nfsd/lockd.c linux-2.6.39/fs/nfsd/lockd.c
48641--- linux-2.6.39/fs/nfsd/lockd.c 2011-05-19 00:06:34.000000000 -0400
48642+++ linux-2.6.39/fs/nfsd/lockd.c 2011-05-22 19:36:32.000000000 -0400
48643@@ -60,7 +60,7 @@ nlm_fclose(struct file *filp)
48644 fput(filp);
48645 }
48646
48647-static struct nlmsvc_binding nfsd_nlm_ops = {
48648+static const struct nlmsvc_binding nfsd_nlm_ops = {
48649 .fopen = nlm_fopen, /* open file for locking */
48650 .fclose = nlm_fclose, /* close file */
48651 };
48652diff -urNp linux-2.6.39/fs/nfsd/nfs4state.c linux-2.6.39/fs/nfsd/nfs4state.c
48653--- linux-2.6.39/fs/nfsd/nfs4state.c 2011-05-19 00:06:34.000000000 -0400
48654+++ linux-2.6.39/fs/nfsd/nfs4state.c 2011-05-22 19:36:32.000000000 -0400
48655@@ -3784,6 +3784,8 @@ nfsd4_lock(struct svc_rqst *rqstp, struc
48656 unsigned int strhashval;
48657 int err;
48658
48659+ pax_track_stack();
48660+
48661 dprintk("NFSD: nfsd4_lock: start=%Ld length=%Ld\n",
48662 (long long) lock->lk_offset,
48663 (long long) lock->lk_length);
48664diff -urNp linux-2.6.39/fs/nfsd/nfs4xdr.c linux-2.6.39/fs/nfsd/nfs4xdr.c
48665--- linux-2.6.39/fs/nfsd/nfs4xdr.c 2011-05-19 00:06:34.000000000 -0400
48666+++ linux-2.6.39/fs/nfsd/nfs4xdr.c 2011-05-22 19:36:32.000000000 -0400
48667@@ -1793,6 +1793,8 @@ nfsd4_encode_fattr(struct svc_fh *fhp, s
48668 .dentry = dentry,
48669 };
48670
48671+ pax_track_stack();
48672+
48673 BUG_ON(bmval1 & NFSD_WRITEONLY_ATTRS_WORD1);
48674 BUG_ON(bmval0 & ~nfsd_suppattrs0(minorversion));
48675 BUG_ON(bmval1 & ~nfsd_suppattrs1(minorversion));
48676diff -urNp linux-2.6.39/fs/nfsd/nfsctl.c linux-2.6.39/fs/nfsd/nfsctl.c
48677--- linux-2.6.39/fs/nfsd/nfsctl.c 2011-05-19 00:06:34.000000000 -0400
48678+++ linux-2.6.39/fs/nfsd/nfsctl.c 2011-05-22 19:36:32.000000000 -0400
48679@@ -182,7 +182,7 @@ static int export_features_open(struct i
48680 return single_open(file, export_features_show, NULL);
48681 }
48682
48683-static struct file_operations export_features_operations = {
48684+static const struct file_operations export_features_operations = {
48685 .open = export_features_open,
48686 .read = seq_read,
48687 .llseek = seq_lseek,
48688diff -urNp linux-2.6.39/fs/nfsd/vfs.c linux-2.6.39/fs/nfsd/vfs.c
48689--- linux-2.6.39/fs/nfsd/vfs.c 2011-05-19 00:06:34.000000000 -0400
48690+++ linux-2.6.39/fs/nfsd/vfs.c 2011-05-22 19:36:32.000000000 -0400
48691@@ -898,7 +898,7 @@ nfsd_vfs_read(struct svc_rqst *rqstp, st
48692 } else {
48693 oldfs = get_fs();
48694 set_fs(KERNEL_DS);
48695- host_err = vfs_readv(file, (struct iovec __user *)vec, vlen, &offset);
48696+ host_err = vfs_readv(file, (__force struct iovec __user *)vec, vlen, &offset);
48697 set_fs(oldfs);
48698 }
48699
48700@@ -1002,7 +1002,7 @@ nfsd_vfs_write(struct svc_rqst *rqstp, s
48701
48702 /* Write the data. */
48703 oldfs = get_fs(); set_fs(KERNEL_DS);
48704- host_err = vfs_writev(file, (struct iovec __user *)vec, vlen, &offset);
48705+ host_err = vfs_writev(file, (__force struct iovec __user *)vec, vlen, &offset);
48706 set_fs(oldfs);
48707 if (host_err < 0)
48708 goto out_nfserr;
48709@@ -1525,7 +1525,7 @@ nfsd_readlink(struct svc_rqst *rqstp, st
48710 */
48711
48712 oldfs = get_fs(); set_fs(KERNEL_DS);
48713- host_err = inode->i_op->readlink(dentry, buf, *lenp);
48714+ host_err = inode->i_op->readlink(dentry, (__force char __user *)buf, *lenp);
48715 set_fs(oldfs);
48716
48717 if (host_err < 0)
48718diff -urNp linux-2.6.39/fs/nilfs2/segment.c linux-2.6.39/fs/nilfs2/segment.c
48719--- linux-2.6.39/fs/nilfs2/segment.c 2011-05-19 00:06:34.000000000 -0400
48720+++ linux-2.6.39/fs/nilfs2/segment.c 2011-05-22 19:36:32.000000000 -0400
48721@@ -555,7 +555,7 @@ static void nilfs_write_file_node_binfo(
48722 *vblocknr = binfo->bi_v.bi_vblocknr;
48723 }
48724
48725-static struct nilfs_sc_operations nilfs_sc_file_ops = {
48726+static const struct nilfs_sc_operations nilfs_sc_file_ops = {
48727 .collect_data = nilfs_collect_file_data,
48728 .collect_node = nilfs_collect_file_node,
48729 .collect_bmap = nilfs_collect_file_bmap,
48730@@ -604,7 +604,7 @@ static void nilfs_write_dat_node_binfo(s
48731 *binfo_dat = binfo->bi_dat;
48732 }
48733
48734-static struct nilfs_sc_operations nilfs_sc_dat_ops = {
48735+static const struct nilfs_sc_operations nilfs_sc_dat_ops = {
48736 .collect_data = nilfs_collect_dat_data,
48737 .collect_node = nilfs_collect_file_node,
48738 .collect_bmap = nilfs_collect_dat_bmap,
48739@@ -612,7 +612,7 @@ static struct nilfs_sc_operations nilfs_
48740 .write_node_binfo = nilfs_write_dat_node_binfo,
48741 };
48742
48743-static struct nilfs_sc_operations nilfs_sc_dsync_ops = {
48744+static const struct nilfs_sc_operations nilfs_sc_dsync_ops = {
48745 .collect_data = nilfs_collect_file_data,
48746 .collect_node = NULL,
48747 .collect_bmap = NULL,
48748@@ -971,7 +971,7 @@ static size_t nilfs_segctor_buffer_rest(
48749
48750 static int nilfs_segctor_scan_file(struct nilfs_sc_info *sci,
48751 struct inode *inode,
48752- struct nilfs_sc_operations *sc_ops)
48753+ const struct nilfs_sc_operations *sc_ops)
48754 {
48755 LIST_HEAD(data_buffers);
48756 LIST_HEAD(node_buffers);
48757@@ -1475,7 +1475,7 @@ nilfs_segctor_update_payload_blocknr(str
48758 sector_t blocknr;
48759 unsigned long nfinfo = segbuf->sb_sum.nfinfo;
48760 unsigned long nblocks = 0, ndatablk = 0;
48761- struct nilfs_sc_operations *sc_op = NULL;
48762+ const struct nilfs_sc_operations *sc_op = NULL;
48763 struct nilfs_segsum_pointer ssp;
48764 struct nilfs_finfo *finfo = NULL;
48765 union nilfs_binfo binfo;
48766diff -urNp linux-2.6.39/fs/notify/dnotify/dnotify.c linux-2.6.39/fs/notify/dnotify/dnotify.c
48767--- linux-2.6.39/fs/notify/dnotify/dnotify.c 2011-05-19 00:06:34.000000000 -0400
48768+++ linux-2.6.39/fs/notify/dnotify/dnotify.c 2011-05-22 19:36:32.000000000 -0400
48769@@ -151,7 +151,7 @@ static void dnotify_free_mark(struct fsn
48770 kmem_cache_free(dnotify_mark_cache, dn_mark);
48771 }
48772
48773-static struct fsnotify_ops dnotify_fsnotify_ops = {
48774+static const struct fsnotify_ops dnotify_fsnotify_ops = {
48775 .handle_event = dnotify_handle_event,
48776 .should_send_event = dnotify_should_send_event,
48777 .free_group_priv = NULL,
48778diff -urNp linux-2.6.39/fs/notify/notification.c linux-2.6.39/fs/notify/notification.c
48779--- linux-2.6.39/fs/notify/notification.c 2011-05-19 00:06:34.000000000 -0400
48780+++ linux-2.6.39/fs/notify/notification.c 2011-05-22 19:36:32.000000000 -0400
48781@@ -57,7 +57,7 @@ static struct kmem_cache *fsnotify_event
48782 * get set to 0 so it will never get 'freed'
48783 */
48784 static struct fsnotify_event *q_overflow_event;
48785-static atomic_t fsnotify_sync_cookie = ATOMIC_INIT(0);
48786+static atomic_unchecked_t fsnotify_sync_cookie = ATOMIC_INIT(0);
48787
48788 /**
48789 * fsnotify_get_cookie - return a unique cookie for use in synchronizing events.
48790@@ -65,7 +65,7 @@ static atomic_t fsnotify_sync_cookie = A
48791 */
48792 u32 fsnotify_get_cookie(void)
48793 {
48794- return atomic_inc_return(&fsnotify_sync_cookie);
48795+ return atomic_inc_return_unchecked(&fsnotify_sync_cookie);
48796 }
48797 EXPORT_SYMBOL_GPL(fsnotify_get_cookie);
48798
48799diff -urNp linux-2.6.39/fs/ntfs/dir.c linux-2.6.39/fs/ntfs/dir.c
48800--- linux-2.6.39/fs/ntfs/dir.c 2011-05-19 00:06:34.000000000 -0400
48801+++ linux-2.6.39/fs/ntfs/dir.c 2011-05-22 19:36:32.000000000 -0400
48802@@ -1329,7 +1329,7 @@ find_next_index_buffer:
48803 ia = (INDEX_ALLOCATION*)(kaddr + (ia_pos & ~PAGE_CACHE_MASK &
48804 ~(s64)(ndir->itype.index.block_size - 1)));
48805 /* Bounds checks. */
48806- if (unlikely((u8*)ia < kaddr || (u8*)ia > kaddr + PAGE_CACHE_SIZE)) {
48807+ if (unlikely(!kaddr || (u8*)ia < kaddr || (u8*)ia > kaddr + PAGE_CACHE_SIZE)) {
48808 ntfs_error(sb, "Out of bounds check failed. Corrupt directory "
48809 "inode 0x%lx or driver bug.", vdir->i_ino);
48810 goto err_out;
48811diff -urNp linux-2.6.39/fs/ntfs/file.c linux-2.6.39/fs/ntfs/file.c
48812--- linux-2.6.39/fs/ntfs/file.c 2011-05-19 00:06:34.000000000 -0400
48813+++ linux-2.6.39/fs/ntfs/file.c 2011-05-22 19:36:32.000000000 -0400
48814@@ -2222,6 +2222,6 @@ const struct inode_operations ntfs_file_
48815 #endif /* NTFS_RW */
48816 };
48817
48818-const struct file_operations ntfs_empty_file_ops = {};
48819+const struct file_operations ntfs_empty_file_ops __read_only;
48820
48821-const struct inode_operations ntfs_empty_inode_ops = {};
48822+const struct inode_operations ntfs_empty_inode_ops __read_only;
48823diff -urNp linux-2.6.39/fs/ocfs2/cluster/heartbeat.c linux-2.6.39/fs/ocfs2/cluster/heartbeat.c
48824--- linux-2.6.39/fs/ocfs2/cluster/heartbeat.c 2011-05-19 00:06:34.000000000 -0400
48825+++ linux-2.6.39/fs/ocfs2/cluster/heartbeat.c 2011-05-22 19:36:32.000000000 -0400
48826@@ -2261,7 +2261,7 @@ static struct configfs_item_operations o
48827 .store_attribute = o2hb_heartbeat_group_store,
48828 };
48829
48830-static struct configfs_group_operations o2hb_heartbeat_group_group_ops = {
48831+static const struct configfs_group_operations o2hb_heartbeat_group_group_ops = {
48832 .make_item = o2hb_heartbeat_group_make_item,
48833 .drop_item = o2hb_heartbeat_group_drop_item,
48834 };
48835diff -urNp linux-2.6.39/fs/ocfs2/cluster/nodemanager.c linux-2.6.39/fs/ocfs2/cluster/nodemanager.c
48836--- linux-2.6.39/fs/ocfs2/cluster/nodemanager.c 2011-05-19 00:06:34.000000000 -0400
48837+++ linux-2.6.39/fs/ocfs2/cluster/nodemanager.c 2011-05-22 19:36:32.000000000 -0400
48838@@ -752,7 +752,7 @@ static void o2nm_node_group_drop_item(st
48839 config_item_put(item);
48840 }
48841
48842-static struct configfs_group_operations o2nm_node_group_group_ops = {
48843+static const struct configfs_group_operations o2nm_node_group_group_ops = {
48844 .make_item = o2nm_node_group_make_item,
48845 .drop_item = o2nm_node_group_drop_item,
48846 };
48847@@ -869,7 +869,7 @@ static void o2nm_cluster_group_drop_item
48848 config_item_put(item);
48849 }
48850
48851-static struct configfs_group_operations o2nm_cluster_group_group_ops = {
48852+static const struct configfs_group_operations o2nm_cluster_group_group_ops = {
48853 .make_group = o2nm_cluster_group_make_group,
48854 .drop_item = o2nm_cluster_group_drop_item,
48855 };
48856diff -urNp linux-2.6.39/fs/ocfs2/localalloc.c linux-2.6.39/fs/ocfs2/localalloc.c
48857--- linux-2.6.39/fs/ocfs2/localalloc.c 2011-05-19 00:06:34.000000000 -0400
48858+++ linux-2.6.39/fs/ocfs2/localalloc.c 2011-05-22 19:36:32.000000000 -0400
48859@@ -1283,7 +1283,7 @@ static int ocfs2_local_alloc_slide_windo
48860 goto bail;
48861 }
48862
48863- atomic_inc(&osb->alloc_stats.moves);
48864+ atomic_inc_unchecked(&osb->alloc_stats.moves);
48865
48866 bail:
48867 if (handle)
48868diff -urNp linux-2.6.39/fs/ocfs2/namei.c linux-2.6.39/fs/ocfs2/namei.c
48869--- linux-2.6.39/fs/ocfs2/namei.c 2011-05-19 00:06:34.000000000 -0400
48870+++ linux-2.6.39/fs/ocfs2/namei.c 2011-05-22 19:36:32.000000000 -0400
48871@@ -1063,6 +1063,8 @@ static int ocfs2_rename(struct inode *ol
48872 struct ocfs2_dir_lookup_result orphan_insert = { NULL, };
48873 struct ocfs2_dir_lookup_result target_insert = { NULL, };
48874
48875+ pax_track_stack();
48876+
48877 /* At some point it might be nice to break this function up a
48878 * bit. */
48879
48880diff -urNp linux-2.6.39/fs/ocfs2/ocfs2.h linux-2.6.39/fs/ocfs2/ocfs2.h
48881--- linux-2.6.39/fs/ocfs2/ocfs2.h 2011-05-19 00:06:34.000000000 -0400
48882+++ linux-2.6.39/fs/ocfs2/ocfs2.h 2011-05-22 19:36:32.000000000 -0400
48883@@ -235,11 +235,11 @@ enum ocfs2_vol_state
48884
48885 struct ocfs2_alloc_stats
48886 {
48887- atomic_t moves;
48888- atomic_t local_data;
48889- atomic_t bitmap_data;
48890- atomic_t bg_allocs;
48891- atomic_t bg_extends;
48892+ atomic_unchecked_t moves;
48893+ atomic_unchecked_t local_data;
48894+ atomic_unchecked_t bitmap_data;
48895+ atomic_unchecked_t bg_allocs;
48896+ atomic_unchecked_t bg_extends;
48897 };
48898
48899 enum ocfs2_local_alloc_state
48900diff -urNp linux-2.6.39/fs/ocfs2/stackglue.h linux-2.6.39/fs/ocfs2/stackglue.h
48901--- linux-2.6.39/fs/ocfs2/stackglue.h 2011-05-19 00:06:34.000000000 -0400
48902+++ linux-2.6.39/fs/ocfs2/stackglue.h 2011-05-22 19:36:32.000000000 -0400
48903@@ -221,13 +221,13 @@ struct ocfs2_stack_operations {
48904 };
48905
48906 /*
48907- * Each stack plugin must describe itself by registering a
48908+ * Each stack plugin must describe itself by registerin const g a
48909 * ocfs2_stack_plugin structure. This is only seen by stackglue and the
48910 * stack driver.
48911 */
48912 struct ocfs2_stack_plugin {
48913 char *sp_name;
48914- struct ocfs2_stack_operations *sp_ops;
48915+ const struct ocfs2_stack_operations *sp_ops;
48916 struct module *sp_owner;
48917
48918 /* These are managed by the stackglue code. */
48919diff -urNp linux-2.6.39/fs/ocfs2/stack_o2cb.c linux-2.6.39/fs/ocfs2/stack_o2cb.c
48920--- linux-2.6.39/fs/ocfs2/stack_o2cb.c 2011-05-19 00:06:34.000000000 -0400
48921+++ linux-2.6.39/fs/ocfs2/stack_o2cb.c 2011-05-22 19:36:32.000000000 -0400
48922@@ -358,7 +358,7 @@ static int o2cb_cluster_this_node(unsign
48923 return 0;
48924 }
48925
48926-static struct ocfs2_stack_operations o2cb_stack_ops = {
48927+static const struct ocfs2_stack_operations o2cb_stack_ops = {
48928 .connect = o2cb_cluster_connect,
48929 .disconnect = o2cb_cluster_disconnect,
48930 .this_node = o2cb_cluster_this_node,
48931@@ -369,7 +369,6 @@ static struct ocfs2_stack_operations o2c
48932 .lock_lvb = o2cb_dlm_lvb,
48933 .dump_lksb = o2cb_dump_lksb,
48934 };
48935-
48936 static struct ocfs2_stack_plugin o2cb_stack = {
48937 .sp_name = "o2cb",
48938 .sp_ops = &o2cb_stack_ops,
48939diff -urNp linux-2.6.39/fs/ocfs2/stack_user.c linux-2.6.39/fs/ocfs2/stack_user.c
48940--- linux-2.6.39/fs/ocfs2/stack_user.c 2011-05-19 00:06:34.000000000 -0400
48941+++ linux-2.6.39/fs/ocfs2/stack_user.c 2011-05-22 19:36:32.000000000 -0400
48942@@ -399,7 +399,7 @@ static int ocfs2_control_do_setversion_m
48943 long major, minor;
48944 char *ptr = NULL;
48945 struct ocfs2_control_private *p = file->private_data;
48946- struct ocfs2_protocol_version *max =
48947+ const struct ocfs2_protocol_version *max =
48948 &ocfs2_user_plugin.sp_max_proto;
48949
48950 if (ocfs2_control_get_handshake_state(file) !=
48951@@ -861,7 +861,7 @@ static int user_cluster_this_node(unsign
48952 return 0;
48953 }
48954
48955-static struct ocfs2_stack_operations ocfs2_user_plugin_ops = {
48956+static const struct ocfs2_stack_operations ocfs2_user_plugin_ops = {
48957 .connect = user_cluster_connect,
48958 .disconnect = user_cluster_disconnect,
48959 .this_node = user_cluster_this_node,
48960diff -urNp linux-2.6.39/fs/ocfs2/suballoc.c linux-2.6.39/fs/ocfs2/suballoc.c
48961--- linux-2.6.39/fs/ocfs2/suballoc.c 2011-05-19 00:06:34.000000000 -0400
48962+++ linux-2.6.39/fs/ocfs2/suballoc.c 2011-05-22 19:36:32.000000000 -0400
48963@@ -872,7 +872,7 @@ static int ocfs2_reserve_suballoc_bits(s
48964 mlog_errno(status);
48965 goto bail;
48966 }
48967- atomic_inc(&osb->alloc_stats.bg_extends);
48968+ atomic_inc_unchecked(&osb->alloc_stats.bg_extends);
48969
48970 /* You should never ask for this much metadata */
48971 BUG_ON(bits_wanted >
48972@@ -2008,7 +2008,7 @@ int ocfs2_claim_metadata(handle_t *handl
48973 mlog_errno(status);
48974 goto bail;
48975 }
48976- atomic_inc(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
48977+ atomic_inc_unchecked(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
48978
48979 *suballoc_loc = res.sr_bg_blkno;
48980 *suballoc_bit_start = res.sr_bit_offset;
48981@@ -2172,7 +2172,7 @@ int ocfs2_claim_new_inode_at_loc(handle_
48982 trace_ocfs2_claim_new_inode_at_loc((unsigned long long)di_blkno,
48983 res->sr_bits);
48984
48985- atomic_inc(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
48986+ atomic_inc_unchecked(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
48987
48988 BUG_ON(res->sr_bits != 1);
48989
48990@@ -2214,7 +2214,7 @@ int ocfs2_claim_new_inode(handle_t *hand
48991 mlog_errno(status);
48992 goto bail;
48993 }
48994- atomic_inc(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
48995+ atomic_inc_unchecked(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
48996
48997 BUG_ON(res.sr_bits != 1);
48998
48999@@ -2318,7 +2318,7 @@ int __ocfs2_claim_clusters(handle_t *han
49000 cluster_start,
49001 num_clusters);
49002 if (!status)
49003- atomic_inc(&osb->alloc_stats.local_data);
49004+ atomic_inc_unchecked(&osb->alloc_stats.local_data);
49005 } else {
49006 if (min_clusters > (osb->bitmap_cpg - 1)) {
49007 /* The only paths asking for contiguousness
49008@@ -2344,7 +2344,7 @@ int __ocfs2_claim_clusters(handle_t *han
49009 ocfs2_desc_bitmap_to_cluster_off(ac->ac_inode,
49010 res.sr_bg_blkno,
49011 res.sr_bit_offset);
49012- atomic_inc(&osb->alloc_stats.bitmap_data);
49013+ atomic_inc_unchecked(&osb->alloc_stats.bitmap_data);
49014 *num_clusters = res.sr_bits;
49015 }
49016 }
49017diff -urNp linux-2.6.39/fs/ocfs2/super.c linux-2.6.39/fs/ocfs2/super.c
49018--- linux-2.6.39/fs/ocfs2/super.c 2011-05-19 00:06:34.000000000 -0400
49019+++ linux-2.6.39/fs/ocfs2/super.c 2011-05-22 19:36:32.000000000 -0400
49020@@ -299,11 +299,11 @@ static int ocfs2_osb_dump(struct ocfs2_s
49021 "%10s => GlobalAllocs: %d LocalAllocs: %d "
49022 "SubAllocs: %d LAWinMoves: %d SAExtends: %d\n",
49023 "Stats",
49024- atomic_read(&osb->alloc_stats.bitmap_data),
49025- atomic_read(&osb->alloc_stats.local_data),
49026- atomic_read(&osb->alloc_stats.bg_allocs),
49027- atomic_read(&osb->alloc_stats.moves),
49028- atomic_read(&osb->alloc_stats.bg_extends));
49029+ atomic_read_unchecked(&osb->alloc_stats.bitmap_data),
49030+ atomic_read_unchecked(&osb->alloc_stats.local_data),
49031+ atomic_read_unchecked(&osb->alloc_stats.bg_allocs),
49032+ atomic_read_unchecked(&osb->alloc_stats.moves),
49033+ atomic_read_unchecked(&osb->alloc_stats.bg_extends));
49034
49035 out += snprintf(buf + out, len - out,
49036 "%10s => State: %u Descriptor: %llu Size: %u bits "
49037@@ -2111,11 +2111,11 @@ static int ocfs2_initialize_super(struct
49038 spin_lock_init(&osb->osb_xattr_lock);
49039 ocfs2_init_steal_slots(osb);
49040
49041- atomic_set(&osb->alloc_stats.moves, 0);
49042- atomic_set(&osb->alloc_stats.local_data, 0);
49043- atomic_set(&osb->alloc_stats.bitmap_data, 0);
49044- atomic_set(&osb->alloc_stats.bg_allocs, 0);
49045- atomic_set(&osb->alloc_stats.bg_extends, 0);
49046+ atomic_set_unchecked(&osb->alloc_stats.moves, 0);
49047+ atomic_set_unchecked(&osb->alloc_stats.local_data, 0);
49048+ atomic_set_unchecked(&osb->alloc_stats.bitmap_data, 0);
49049+ atomic_set_unchecked(&osb->alloc_stats.bg_allocs, 0);
49050+ atomic_set_unchecked(&osb->alloc_stats.bg_extends, 0);
49051
49052 /* Copy the blockcheck stats from the superblock probe */
49053 osb->osb_ecc_stats = *stats;
49054diff -urNp linux-2.6.39/fs/ocfs2/symlink.c linux-2.6.39/fs/ocfs2/symlink.c
49055--- linux-2.6.39/fs/ocfs2/symlink.c 2011-05-19 00:06:34.000000000 -0400
49056+++ linux-2.6.39/fs/ocfs2/symlink.c 2011-05-22 19:36:32.000000000 -0400
49057@@ -142,7 +142,7 @@ bail:
49058
49059 static void ocfs2_fast_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie)
49060 {
49061- char *link = nd_get_link(nd);
49062+ const char *link = nd_get_link(nd);
49063 if (!IS_ERR(link))
49064 kfree(link);
49065 }
49066diff -urNp linux-2.6.39/fs/open.c linux-2.6.39/fs/open.c
49067--- linux-2.6.39/fs/open.c 2011-05-19 00:06:34.000000000 -0400
49068+++ linux-2.6.39/fs/open.c 2011-05-22 20:46:51.000000000 -0400
49069@@ -112,6 +112,10 @@ static long do_sys_truncate(const char _
49070 error = locks_verify_truncate(inode, NULL, length);
49071 if (!error)
49072 error = security_path_truncate(&path);
49073+
49074+ if (!error && !gr_acl_handle_truncate(path.dentry, path.mnt))
49075+ error = -EACCES;
49076+
49077 if (!error)
49078 error = do_truncate(path.dentry, length, 0, NULL);
49079
49080@@ -358,6 +362,9 @@ SYSCALL_DEFINE3(faccessat, int, dfd, con
49081 if (__mnt_is_readonly(path.mnt))
49082 res = -EROFS;
49083
49084+ if (!res && !gr_acl_handle_access(path.dentry, path.mnt, mode))
49085+ res = -EACCES;
49086+
49087 out_path_release:
49088 path_put(&path);
49089 out:
49090@@ -384,6 +391,8 @@ SYSCALL_DEFINE1(chdir, const char __user
49091 if (error)
49092 goto dput_and_out;
49093
49094+ gr_log_chdir(path.dentry, path.mnt);
49095+
49096 set_fs_pwd(current->fs, &path);
49097
49098 dput_and_out:
49099@@ -410,6 +419,13 @@ SYSCALL_DEFINE1(fchdir, unsigned int, fd
49100 goto out_putf;
49101
49102 error = inode_permission(inode, MAY_EXEC | MAY_CHDIR);
49103+
49104+ if (!error && !gr_chroot_fchdir(file->f_path.dentry, file->f_path.mnt))
49105+ error = -EPERM;
49106+
49107+ if (!error)
49108+ gr_log_chdir(file->f_path.dentry, file->f_path.mnt);
49109+
49110 if (!error)
49111 set_fs_pwd(current->fs, &file->f_path);
49112 out_putf:
49113@@ -438,7 +454,18 @@ SYSCALL_DEFINE1(chroot, const char __use
49114 if (error)
49115 goto dput_and_out;
49116
49117+ if (gr_handle_chroot_chroot(path.dentry, path.mnt))
49118+ goto dput_and_out;
49119+
49120+ if (gr_handle_chroot_caps(&path)) {
49121+ error = -ENOMEM;
49122+ goto dput_and_out;
49123+ }
49124+
49125 set_fs_root(current->fs, &path);
49126+
49127+ gr_handle_chroot_chdir(&path);
49128+
49129 error = 0;
49130 dput_and_out:
49131 path_put(&path);
49132@@ -466,12 +493,25 @@ SYSCALL_DEFINE2(fchmod, unsigned int, fd
49133 err = mnt_want_write_file(file);
49134 if (err)
49135 goto out_putf;
49136+
49137 mutex_lock(&inode->i_mutex);
49138+
49139+ if (!gr_acl_handle_fchmod(dentry, file->f_vfsmnt, mode)) {
49140+ err = -EACCES;
49141+ goto out_unlock;
49142+ }
49143+
49144 err = security_path_chmod(dentry, file->f_vfsmnt, mode);
49145 if (err)
49146 goto out_unlock;
49147 if (mode == (mode_t) -1)
49148 mode = inode->i_mode;
49149+
49150+ if (gr_handle_chroot_chmod(dentry, file->f_vfsmnt, mode)) {
49151+ err = -EACCES;
49152+ goto out_unlock;
49153+ }
49154+
49155 newattrs.ia_mode = (mode & S_IALLUGO) | (inode->i_mode & ~S_IALLUGO);
49156 newattrs.ia_valid = ATTR_MODE | ATTR_CTIME;
49157 err = notify_change(dentry, &newattrs);
49158@@ -499,12 +539,25 @@ SYSCALL_DEFINE3(fchmodat, int, dfd, cons
49159 error = mnt_want_write(path.mnt);
49160 if (error)
49161 goto dput_and_out;
49162+
49163 mutex_lock(&inode->i_mutex);
49164+
49165+ if (!gr_acl_handle_chmod(path.dentry, path.mnt, mode)) {
49166+ error = -EACCES;
49167+ goto out_unlock;
49168+ }
49169+
49170 error = security_path_chmod(path.dentry, path.mnt, mode);
49171 if (error)
49172 goto out_unlock;
49173 if (mode == (mode_t) -1)
49174 mode = inode->i_mode;
49175+
49176+ if (gr_handle_chroot_chmod(path.dentry, path.mnt, mode)) {
49177+ error = -EACCES;
49178+ goto out_unlock;
49179+ }
49180+
49181 newattrs.ia_mode = (mode & S_IALLUGO) | (inode->i_mode & ~S_IALLUGO);
49182 newattrs.ia_valid = ATTR_MODE | ATTR_CTIME;
49183 error = notify_change(path.dentry, &newattrs);
49184@@ -528,6 +581,9 @@ static int chown_common(struct path *pat
49185 int error;
49186 struct iattr newattrs;
49187
49188+ if (!gr_acl_handle_chown(path->dentry, path->mnt))
49189+ return -EACCES;
49190+
49191 newattrs.ia_valid = ATTR_CTIME;
49192 if (user != (uid_t) -1) {
49193 newattrs.ia_valid |= ATTR_UID;
49194@@ -998,7 +1054,10 @@ long do_sys_open(int dfd, const char __u
49195 if (!IS_ERR(tmp)) {
49196 fd = get_unused_fd_flags(flags);
49197 if (fd >= 0) {
49198- struct file *f = do_filp_open(dfd, tmp, &op, lookup);
49199+ struct file *f;
49200+ /* don't allow to be set by userland */
49201+ flags &= ~FMODE_GREXEC;
49202+ f = do_filp_open(dfd, tmp, &op, lookup);
49203 if (IS_ERR(f)) {
49204 put_unused_fd(fd);
49205 fd = PTR_ERR(f);
49206diff -urNp linux-2.6.39/fs/partitions/ldm.c linux-2.6.39/fs/partitions/ldm.c
49207--- linux-2.6.39/fs/partitions/ldm.c 2011-05-19 00:06:34.000000000 -0400
49208+++ linux-2.6.39/fs/partitions/ldm.c 2011-05-22 19:41:37.000000000 -0400
49209@@ -1311,6 +1311,7 @@ static bool ldm_frag_add (const u8 *data
49210 ldm_error ("A VBLK claims to have %d parts.", num);
49211 return false;
49212 }
49213+
49214 if (rec >= num) {
49215 ldm_error("REC value (%d) exceeds NUM value (%d)", rec, num);
49216 return false;
49217@@ -1322,7 +1323,7 @@ static bool ldm_frag_add (const u8 *data
49218 goto found;
49219 }
49220
49221- f = kmalloc (sizeof (*f) + size*num, GFP_KERNEL);
49222+ f = kmalloc (size*num + sizeof (*f), GFP_KERNEL);
49223 if (!f) {
49224 ldm_crit ("Out of memory.");
49225 return false;
49226diff -urNp linux-2.6.39/fs/pipe.c linux-2.6.39/fs/pipe.c
49227--- linux-2.6.39/fs/pipe.c 2011-05-19 00:06:34.000000000 -0400
49228+++ linux-2.6.39/fs/pipe.c 2011-05-22 19:41:37.000000000 -0400
49229@@ -420,9 +420,9 @@ redo:
49230 }
49231 if (bufs) /* More to do? */
49232 continue;
49233- if (!pipe->writers)
49234+ if (!atomic_read(&pipe->writers))
49235 break;
49236- if (!pipe->waiting_writers) {
49237+ if (!atomic_read(&pipe->waiting_writers)) {
49238 /* syscall merging: Usually we must not sleep
49239 * if O_NONBLOCK is set, or if we got some data.
49240 * But if a writer sleeps in kernel space, then
49241@@ -481,7 +481,7 @@ pipe_write(struct kiocb *iocb, const str
49242 mutex_lock(&inode->i_mutex);
49243 pipe = inode->i_pipe;
49244
49245- if (!pipe->readers) {
49246+ if (!atomic_read(&pipe->readers)) {
49247 send_sig(SIGPIPE, current, 0);
49248 ret = -EPIPE;
49249 goto out;
49250@@ -530,7 +530,7 @@ redo1:
49251 for (;;) {
49252 int bufs;
49253
49254- if (!pipe->readers) {
49255+ if (!atomic_read(&pipe->readers)) {
49256 send_sig(SIGPIPE, current, 0);
49257 if (!ret)
49258 ret = -EPIPE;
49259@@ -616,9 +616,9 @@ redo2:
49260 kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
49261 do_wakeup = 0;
49262 }
49263- pipe->waiting_writers++;
49264+ atomic_inc(&pipe->waiting_writers);
49265 pipe_wait(pipe);
49266- pipe->waiting_writers--;
49267+ atomic_dec(&pipe->waiting_writers);
49268 }
49269 out:
49270 mutex_unlock(&inode->i_mutex);
49271@@ -685,7 +685,7 @@ pipe_poll(struct file *filp, poll_table
49272 mask = 0;
49273 if (filp->f_mode & FMODE_READ) {
49274 mask = (nrbufs > 0) ? POLLIN | POLLRDNORM : 0;
49275- if (!pipe->writers && filp->f_version != pipe->w_counter)
49276+ if (!atomic_read(&pipe->writers) && filp->f_version != pipe->w_counter)
49277 mask |= POLLHUP;
49278 }
49279
49280@@ -695,7 +695,7 @@ pipe_poll(struct file *filp, poll_table
49281 * Most Unices do not set POLLERR for FIFOs but on Linux they
49282 * behave exactly like pipes for poll().
49283 */
49284- if (!pipe->readers)
49285+ if (!atomic_read(&pipe->readers))
49286 mask |= POLLERR;
49287 }
49288
49289@@ -709,10 +709,10 @@ pipe_release(struct inode *inode, int de
49290
49291 mutex_lock(&inode->i_mutex);
49292 pipe = inode->i_pipe;
49293- pipe->readers -= decr;
49294- pipe->writers -= decw;
49295+ atomic_sub(decr, &pipe->readers);
49296+ atomic_sub(decw, &pipe->writers);
49297
49298- if (!pipe->readers && !pipe->writers) {
49299+ if (!atomic_read(&pipe->readers) && !atomic_read(&pipe->writers)) {
49300 free_pipe_info(inode);
49301 } else {
49302 wake_up_interruptible_sync_poll(&pipe->wait, POLLIN | POLLOUT | POLLRDNORM | POLLWRNORM | POLLERR | POLLHUP);
49303@@ -802,7 +802,7 @@ pipe_read_open(struct inode *inode, stru
49304
49305 if (inode->i_pipe) {
49306 ret = 0;
49307- inode->i_pipe->readers++;
49308+ atomic_inc(&inode->i_pipe->readers);
49309 }
49310
49311 mutex_unlock(&inode->i_mutex);
49312@@ -819,7 +819,7 @@ pipe_write_open(struct inode *inode, str
49313
49314 if (inode->i_pipe) {
49315 ret = 0;
49316- inode->i_pipe->writers++;
49317+ atomic_inc(&inode->i_pipe->writers);
49318 }
49319
49320 mutex_unlock(&inode->i_mutex);
49321@@ -837,9 +837,9 @@ pipe_rdwr_open(struct inode *inode, stru
49322 if (inode->i_pipe) {
49323 ret = 0;
49324 if (filp->f_mode & FMODE_READ)
49325- inode->i_pipe->readers++;
49326+ atomic_inc(&inode->i_pipe->readers);
49327 if (filp->f_mode & FMODE_WRITE)
49328- inode->i_pipe->writers++;
49329+ atomic_inc(&inode->i_pipe->writers);
49330 }
49331
49332 mutex_unlock(&inode->i_mutex);
49333@@ -931,7 +931,7 @@ void free_pipe_info(struct inode *inode)
49334 inode->i_pipe = NULL;
49335 }
49336
49337-static struct vfsmount *pipe_mnt __read_mostly;
49338+struct vfsmount *pipe_mnt __read_mostly;
49339
49340 /*
49341 * pipefs_dname() is called from d_path().
49342@@ -961,7 +961,8 @@ static struct inode * get_pipe_inode(voi
49343 goto fail_iput;
49344 inode->i_pipe = pipe;
49345
49346- pipe->readers = pipe->writers = 1;
49347+ atomic_set(&pipe->readers, 1);
49348+ atomic_set(&pipe->writers, 1);
49349 inode->i_fop = &rdwr_pipefifo_fops;
49350
49351 /*
49352diff -urNp linux-2.6.39/fs/proc/array.c linux-2.6.39/fs/proc/array.c
49353--- linux-2.6.39/fs/proc/array.c 2011-05-19 00:06:34.000000000 -0400
49354+++ linux-2.6.39/fs/proc/array.c 2011-05-22 19:41:37.000000000 -0400
49355@@ -60,6 +60,7 @@
49356 #include <linux/tty.h>
49357 #include <linux/string.h>
49358 #include <linux/mman.h>
49359+#include <linux/grsecurity.h>
49360 #include <linux/proc_fs.h>
49361 #include <linux/ioport.h>
49362 #include <linux/uaccess.h>
49363@@ -337,6 +338,21 @@ static void task_cpus_allowed(struct seq
49364 seq_putc(m, '\n');
49365 }
49366
49367+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
49368+static inline void task_pax(struct seq_file *m, struct task_struct *p)
49369+{
49370+ if (p->mm)
49371+ seq_printf(m, "PaX:\t%c%c%c%c%c\n",
49372+ p->mm->pax_flags & MF_PAX_PAGEEXEC ? 'P' : 'p',
49373+ p->mm->pax_flags & MF_PAX_EMUTRAMP ? 'E' : 'e',
49374+ p->mm->pax_flags & MF_PAX_MPROTECT ? 'M' : 'm',
49375+ p->mm->pax_flags & MF_PAX_RANDMMAP ? 'R' : 'r',
49376+ p->mm->pax_flags & MF_PAX_SEGMEXEC ? 'S' : 's');
49377+ else
49378+ seq_printf(m, "PaX:\t-----\n");
49379+}
49380+#endif
49381+
49382 int proc_pid_status(struct seq_file *m, struct pid_namespace *ns,
49383 struct pid *pid, struct task_struct *task)
49384 {
49385@@ -354,9 +370,24 @@ int proc_pid_status(struct seq_file *m,
49386 task_cpus_allowed(m, task);
49387 cpuset_task_status_allowed(m, task);
49388 task_context_switch_counts(m, task);
49389+
49390+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
49391+ task_pax(m, task);
49392+#endif
49393+
49394+#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
49395+ task_grsec_rbac(m, task);
49396+#endif
49397+
49398 return 0;
49399 }
49400
49401+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
49402+#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
49403+ (_mm->pax_flags & MF_PAX_RANDMMAP || \
49404+ _mm->pax_flags & MF_PAX_SEGMEXEC))
49405+#endif
49406+
49407 static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
49408 struct pid *pid, struct task_struct *task, int whole)
49409 {
49410@@ -375,9 +406,11 @@ static int do_task_stat(struct seq_file
49411 cputime_t cutime, cstime, utime, stime;
49412 cputime_t cgtime, gtime;
49413 unsigned long rsslim = 0;
49414- char tcomm[sizeof(task->comm)];
49415+ char tcomm[sizeof(task->comm)] = { 0 };
49416 unsigned long flags;
49417
49418+ pax_track_stack();
49419+
49420 state = *get_task_state(task);
49421 vsize = eip = esp = 0;
49422 permitted = ptrace_may_access(task, PTRACE_MODE_READ);
49423@@ -449,6 +482,19 @@ static int do_task_stat(struct seq_file
49424 gtime = task->gtime;
49425 }
49426
49427+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
49428+ if (PAX_RAND_FLAGS(mm)) {
49429+ eip = 0;
49430+ esp = 0;
49431+ wchan = 0;
49432+ }
49433+#endif
49434+#ifdef CONFIG_GRKERNSEC_HIDESYM
49435+ wchan = 0;
49436+ eip =0;
49437+ esp =0;
49438+#endif
49439+
49440 /* scale priority and nice values from timeslices to -20..20 */
49441 /* to make it look like a "normal" Unix priority/nice value */
49442 priority = task_prio(task);
49443@@ -489,9 +535,15 @@ static int do_task_stat(struct seq_file
49444 vsize,
49445 mm ? get_mm_rss(mm) : 0,
49446 rsslim,
49447+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
49448+ PAX_RAND_FLAGS(mm) ? 1 : (mm ? (permitted ? mm->start_code : 1) : 0),
49449+ PAX_RAND_FLAGS(mm) ? 1 : (mm ? (permitted ? mm->end_code : 1) : 0),
49450+ PAX_RAND_FLAGS(mm) ? 0 : ((permitted && mm) ? mm->start_stack : 0),
49451+#else
49452 mm ? (permitted ? mm->start_code : 1) : 0,
49453 mm ? (permitted ? mm->end_code : 1) : 0,
49454 (permitted && mm) ? mm->start_stack : 0,
49455+#endif
49456 esp,
49457 eip,
49458 /* The signal information here is obsolete.
49459@@ -544,3 +596,18 @@ int proc_pid_statm(struct seq_file *m, s
49460
49461 return 0;
49462 }
49463+
49464+#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
49465+int proc_pid_ipaddr(struct task_struct *task, char *buffer)
49466+{
49467+ u32 curr_ip = 0;
49468+ unsigned long flags;
49469+
49470+ if (lock_task_sighand(task, &flags)) {
49471+ curr_ip = task->signal->curr_ip;
49472+ unlock_task_sighand(task, &flags);
49473+ }
49474+
49475+ return sprintf(buffer, "%pI4\n", &curr_ip);
49476+}
49477+#endif
49478diff -urNp linux-2.6.39/fs/proc/base.c linux-2.6.39/fs/proc/base.c
49479--- linux-2.6.39/fs/proc/base.c 2011-05-19 00:06:34.000000000 -0400
49480+++ linux-2.6.39/fs/proc/base.c 2011-05-22 21:50:17.000000000 -0400
49481@@ -104,6 +104,22 @@ struct pid_entry {
49482 union proc_op op;
49483 };
49484
49485+struct getdents_callback {
49486+ struct linux_dirent __user * current_dir;
49487+ struct linux_dirent __user * previous;
49488+ struct file * file;
49489+ int count;
49490+ int error;
49491+};
49492+
49493+static int gr_fake_filldir(void * __buf, const char *name, int namlen,
49494+ loff_t offset, u64 ino, unsigned int d_type)
49495+{
49496+ struct getdents_callback * buf = (struct getdents_callback *) __buf;
49497+ buf->error = -EINVAL;
49498+ return 0;
49499+}
49500+
49501 #define NOD(NAME, MODE, IOP, FOP, OP) { \
49502 .name = (NAME), \
49503 .len = sizeof(NAME) - 1, \
49504@@ -206,6 +222,9 @@ static struct mm_struct *__check_mem_per
49505 if (task == current)
49506 return mm;
49507
49508+ if (gr_handle_proc_ptrace(task) || gr_acl_handle_procpidmem(task))
49509+ return ERR_PTR(-EPERM);
49510+
49511 /*
49512 * If current is actively ptrace'ing, and would also be
49513 * permitted to freshly attach with ptrace now, permit it.
49514@@ -279,6 +298,9 @@ static int proc_pid_cmdline(struct task_
49515 if (!mm->arg_end)
49516 goto out_mm; /* Shh! No looking before we're done */
49517
49518+ if (gr_acl_handle_procpidmem(task))
49519+ goto out_mm;
49520+
49521 len = mm->arg_end - mm->arg_start;
49522
49523 if (len > PAGE_SIZE)
49524@@ -306,12 +328,28 @@ out:
49525 return res;
49526 }
49527
49528+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
49529+#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
49530+ (_mm->pax_flags & MF_PAX_RANDMMAP || \
49531+ _mm->pax_flags & MF_PAX_SEGMEXEC))
49532+#endif
49533+
49534 static int proc_pid_auxv(struct task_struct *task, char *buffer)
49535 {
49536 struct mm_struct *mm = mm_for_maps(task);
49537 int res = PTR_ERR(mm);
49538 if (mm && !IS_ERR(mm)) {
49539 unsigned int nwords = 0;
49540+
49541+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
49542+ /* allow if we're currently ptracing this task */
49543+ if (PAX_RAND_FLAGS(mm) &&
49544+ (!(task->ptrace & PT_PTRACED) || (task->parent != current))) {
49545+ mmput(mm);
49546+ return res;
49547+ }
49548+#endif
49549+
49550 do {
49551 nwords += 2;
49552 } while (mm->saved_auxv[nwords - 2] != 0); /* AT_NULL */
49553@@ -325,7 +363,7 @@ static int proc_pid_auxv(struct task_str
49554 }
49555
49556
49557-#ifdef CONFIG_KALLSYMS
49558+#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
49559 /*
49560 * Provides a wchan file via kallsyms in a proper one-value-per-file format.
49561 * Returns the resolved symbol. If that fails, simply return the address.
49562@@ -364,7 +402,7 @@ static void unlock_trace(struct task_str
49563 mutex_unlock(&task->signal->cred_guard_mutex);
49564 }
49565
49566-#ifdef CONFIG_STACKTRACE
49567+#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
49568
49569 #define MAX_STACK_TRACE_DEPTH 64
49570
49571@@ -555,7 +593,7 @@ static int proc_pid_limits(struct task_s
49572 return count;
49573 }
49574
49575-#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
49576+#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
49577 static int proc_pid_syscall(struct task_struct *task, char *buffer)
49578 {
49579 long nr;
49580@@ -584,7 +622,7 @@ static int proc_pid_syscall(struct task_
49581 /************************************************************************/
49582
49583 /* permission checks */
49584-static int proc_fd_access_allowed(struct inode *inode)
49585+static int proc_fd_access_allowed(struct inode *inode, unsigned int log)
49586 {
49587 struct task_struct *task;
49588 int allowed = 0;
49589@@ -594,7 +632,10 @@ static int proc_fd_access_allowed(struct
49590 */
49591 task = get_proc_task(inode);
49592 if (task) {
49593- allowed = ptrace_may_access(task, PTRACE_MODE_READ);
49594+ if (log)
49595+ allowed = ptrace_may_access_log(task, PTRACE_MODE_READ);
49596+ else
49597+ allowed = ptrace_may_access(task, PTRACE_MODE_READ);
49598 put_task_struct(task);
49599 }
49600 return allowed;
49601@@ -973,6 +1014,9 @@ static ssize_t environ_read(struct file
49602 if (!task)
49603 goto out_no_task;
49604
49605+ if (gr_acl_handle_procpidmem(task))
49606+ goto out;
49607+
49608 ret = -ENOMEM;
49609 page = (char *)__get_free_page(GFP_TEMPORARY);
49610 if (!page)
49611@@ -1660,7 +1704,7 @@ static void *proc_pid_follow_link(struct
49612 path_put(&nd->path);
49613
49614 /* Are we allowed to snoop on the tasks file descriptors? */
49615- if (!proc_fd_access_allowed(inode))
49616+ if (!proc_fd_access_allowed(inode,0))
49617 goto out;
49618
49619 error = PROC_I(inode)->op.proc_get_link(inode, &nd->path);
49620@@ -1699,8 +1743,18 @@ static int proc_pid_readlink(struct dent
49621 struct path path;
49622
49623 /* Are we allowed to snoop on the tasks file descriptors? */
49624- if (!proc_fd_access_allowed(inode))
49625- goto out;
49626+ /* logging this is needed for learning on chromium to work properly,
49627+ but we don't want to flood the logs from 'ps' which does a readlink
49628+ on /proc/fd/2 of tasks in the listing, nor do we want 'ps' to learn
49629+ CAP_SYS_PTRACE as it's not necessary for its basic functionality
49630+ */
49631+ if (dentry->d_name.name[0] == '2' && dentry->d_name.name[1] == '\0') {
49632+ if (!proc_fd_access_allowed(inode,0))
49633+ goto out;
49634+ } else {
49635+ if (!proc_fd_access_allowed(inode,1))
49636+ goto out;
49637+ }
49638
49639 error = PROC_I(inode)->op.proc_get_link(inode, &path);
49640 if (error)
49641@@ -1766,7 +1820,11 @@ static struct inode *proc_pid_make_inode
49642 rcu_read_lock();
49643 cred = __task_cred(task);
49644 inode->i_uid = cred->euid;
49645+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
49646+ inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
49647+#else
49648 inode->i_gid = cred->egid;
49649+#endif
49650 rcu_read_unlock();
49651 }
49652 security_task_to_inode(task, inode);
49653@@ -1784,6 +1842,9 @@ static int pid_getattr(struct vfsmount *
49654 struct inode *inode = dentry->d_inode;
49655 struct task_struct *task;
49656 const struct cred *cred;
49657+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
49658+ const struct cred *tmpcred = current_cred();
49659+#endif
49660
49661 generic_fillattr(inode, stat);
49662
49663@@ -1791,12 +1852,34 @@ static int pid_getattr(struct vfsmount *
49664 stat->uid = 0;
49665 stat->gid = 0;
49666 task = pid_task(proc_pid(inode), PIDTYPE_PID);
49667+
49668+ if (task && (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))) {
49669+ rcu_read_unlock();
49670+ return -ENOENT;
49671+ }
49672+
49673 if (task) {
49674+ cred = __task_cred(task);
49675+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
49676+ if (!tmpcred->uid || (tmpcred->uid == cred->uid)
49677+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
49678+ || in_group_p(CONFIG_GRKERNSEC_PROC_GID)
49679+#endif
49680+ )
49681+#endif
49682 if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
49683+#ifdef CONFIG_GRKERNSEC_PROC_USER
49684+ (inode->i_mode == (S_IFDIR|S_IRUSR|S_IXUSR)) ||
49685+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
49686+ (inode->i_mode == (S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP)) ||
49687+#endif
49688 task_dumpable(task)) {
49689- cred = __task_cred(task);
49690 stat->uid = cred->euid;
49691+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
49692+ stat->gid = CONFIG_GRKERNSEC_PROC_GID;
49693+#else
49694 stat->gid = cred->egid;
49695+#endif
49696 }
49697 }
49698 rcu_read_unlock();
49699@@ -1834,11 +1917,20 @@ static int pid_revalidate(struct dentry
49700
49701 if (task) {
49702 if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
49703+#ifdef CONFIG_GRKERNSEC_PROC_USER
49704+ (inode->i_mode == (S_IFDIR|S_IRUSR|S_IXUSR)) ||
49705+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
49706+ (inode->i_mode == (S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP)) ||
49707+#endif
49708 task_dumpable(task)) {
49709 rcu_read_lock();
49710 cred = __task_cred(task);
49711 inode->i_uid = cred->euid;
49712+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
49713+ inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
49714+#else
49715 inode->i_gid = cred->egid;
49716+#endif
49717 rcu_read_unlock();
49718 } else {
49719 inode->i_uid = 0;
49720@@ -1959,7 +2051,8 @@ static int proc_fd_info(struct inode *in
49721 int fd = proc_fd(inode);
49722
49723 if (task) {
49724- files = get_files_struct(task);
49725+ if (!gr_acl_handle_procpidmem(task))
49726+ files = get_files_struct(task);
49727 put_task_struct(task);
49728 }
49729 if (files) {
49730@@ -2219,15 +2312,25 @@ static const struct file_operations proc
49731 */
49732 static int proc_fd_permission(struct inode *inode, int mask, unsigned int flags)
49733 {
49734+ struct task_struct *task;
49735 int rv;
49736
49737 if (flags & IPERM_FLAG_RCU)
49738 return -ECHILD;
49739 rv = generic_permission(inode, mask, flags, NULL);
49740- if (rv == 0)
49741- return 0;
49742+
49743 if (task_pid(current) == proc_pid(inode))
49744 rv = 0;
49745+
49746+ task = get_proc_task(inode);
49747+ if (task == NULL)
49748+ return rv;
49749+
49750+ if (gr_acl_handle_procpidmem(task))
49751+ rv = -EACCES;
49752+
49753+ put_task_struct(task);
49754+
49755 return rv;
49756 }
49757
49758@@ -2337,6 +2440,9 @@ static struct dentry *proc_pident_lookup
49759 if (!task)
49760 goto out_no_task;
49761
49762+ if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
49763+ goto out;
49764+
49765 /*
49766 * Yes, it does not scale. And it should not. Don't add
49767 * new entries into /proc/<tgid>/ without very good reasons.
49768@@ -2381,6 +2487,9 @@ static int proc_pident_readdir(struct fi
49769 if (!task)
49770 goto out_no_task;
49771
49772+ if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
49773+ goto out;
49774+
49775 ret = 0;
49776 i = filp->f_pos;
49777 switch (i) {
49778@@ -2651,7 +2760,7 @@ static void *proc_self_follow_link(struc
49779 static void proc_self_put_link(struct dentry *dentry, struct nameidata *nd,
49780 void *cookie)
49781 {
49782- char *s = nd_get_link(nd);
49783+ const char *s = nd_get_link(nd);
49784 if (!IS_ERR(s))
49785 __putname(s);
49786 }
49787@@ -2835,7 +2944,7 @@ static const struct pid_entry tgid_base_
49788 REG("autogroup", S_IRUGO|S_IWUSR, proc_pid_sched_autogroup_operations),
49789 #endif
49790 REG("comm", S_IRUGO|S_IWUSR, proc_pid_set_comm_operations),
49791-#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
49792+#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
49793 INF("syscall", S_IRUGO, proc_pid_syscall),
49794 #endif
49795 INF("cmdline", S_IRUGO, proc_pid_cmdline),
49796@@ -2860,10 +2969,10 @@ static const struct pid_entry tgid_base_
49797 #ifdef CONFIG_SECURITY
49798 DIR("attr", S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
49799 #endif
49800-#ifdef CONFIG_KALLSYMS
49801+#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
49802 INF("wchan", S_IRUGO, proc_pid_wchan),
49803 #endif
49804-#ifdef CONFIG_STACKTRACE
49805+#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
49806 ONE("stack", S_IRUGO, proc_pid_stack),
49807 #endif
49808 #ifdef CONFIG_SCHEDSTATS
49809@@ -2894,6 +3003,9 @@ static const struct pid_entry tgid_base_
49810 #ifdef CONFIG_TASK_IO_ACCOUNTING
49811 INF("io", S_IRUGO, proc_tgid_io_accounting),
49812 #endif
49813+#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
49814+ INF("ipaddr", S_IRUSR, proc_pid_ipaddr),
49815+#endif
49816 };
49817
49818 static int proc_tgid_base_readdir(struct file * filp,
49819@@ -3019,7 +3131,14 @@ static struct dentry *proc_pid_instantia
49820 if (!inode)
49821 goto out;
49822
49823+#ifdef CONFIG_GRKERNSEC_PROC_USER
49824+ inode->i_mode = S_IFDIR|S_IRUSR|S_IXUSR;
49825+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
49826+ inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
49827+ inode->i_mode = S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP;
49828+#else
49829 inode->i_mode = S_IFDIR|S_IRUGO|S_IXUGO;
49830+#endif
49831 inode->i_op = &proc_tgid_base_inode_operations;
49832 inode->i_fop = &proc_tgid_base_operations;
49833 inode->i_flags|=S_IMMUTABLE;
49834@@ -3061,7 +3180,11 @@ struct dentry *proc_pid_lookup(struct in
49835 if (!task)
49836 goto out;
49837
49838+ if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
49839+ goto out_put_task;
49840+
49841 result = proc_pid_instantiate(dir, dentry, task, NULL);
49842+out_put_task:
49843 put_task_struct(task);
49844 out:
49845 return result;
49846@@ -3126,6 +3249,11 @@ int proc_pid_readdir(struct file * filp,
49847 {
49848 unsigned int nr;
49849 struct task_struct *reaper;
49850+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
49851+ const struct cred *tmpcred = current_cred();
49852+ const struct cred *itercred;
49853+#endif
49854+ filldir_t __filldir = filldir;
49855 struct tgid_iter iter;
49856 struct pid_namespace *ns;
49857
49858@@ -3149,8 +3277,27 @@ int proc_pid_readdir(struct file * filp,
49859 for (iter = next_tgid(ns, iter);
49860 iter.task;
49861 iter.tgid += 1, iter = next_tgid(ns, iter)) {
49862+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
49863+ rcu_read_lock();
49864+ itercred = __task_cred(iter.task);
49865+#endif
49866+ if (gr_pid_is_chrooted(iter.task) || gr_check_hidden_task(iter.task)
49867+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
49868+ || (tmpcred->uid && (itercred->uid != tmpcred->uid)
49869+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
49870+ && !in_group_p(CONFIG_GRKERNSEC_PROC_GID)
49871+#endif
49872+ )
49873+#endif
49874+ )
49875+ __filldir = &gr_fake_filldir;
49876+ else
49877+ __filldir = filldir;
49878+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
49879+ rcu_read_unlock();
49880+#endif
49881 filp->f_pos = iter.tgid + TGID_OFFSET;
49882- if (proc_pid_fill_cache(filp, dirent, filldir, iter) < 0) {
49883+ if (proc_pid_fill_cache(filp, dirent, __filldir, iter) < 0) {
49884 put_task_struct(iter.task);
49885 goto out;
49886 }
49887@@ -3177,7 +3324,7 @@ static const struct pid_entry tid_base_s
49888 REG("sched", S_IRUGO|S_IWUSR, proc_pid_sched_operations),
49889 #endif
49890 REG("comm", S_IRUGO|S_IWUSR, proc_pid_set_comm_operations),
49891-#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
49892+#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
49893 INF("syscall", S_IRUGO, proc_pid_syscall),
49894 #endif
49895 INF("cmdline", S_IRUGO, proc_pid_cmdline),
49896@@ -3201,10 +3348,10 @@ static const struct pid_entry tid_base_s
49897 #ifdef CONFIG_SECURITY
49898 DIR("attr", S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
49899 #endif
49900-#ifdef CONFIG_KALLSYMS
49901+#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
49902 INF("wchan", S_IRUGO, proc_pid_wchan),
49903 #endif
49904-#ifdef CONFIG_STACKTRACE
49905+#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
49906 ONE("stack", S_IRUGO, proc_pid_stack),
49907 #endif
49908 #ifdef CONFIG_SCHEDSTATS
49909diff -urNp linux-2.6.39/fs/proc/cmdline.c linux-2.6.39/fs/proc/cmdline.c
49910--- linux-2.6.39/fs/proc/cmdline.c 2011-05-19 00:06:34.000000000 -0400
49911+++ linux-2.6.39/fs/proc/cmdline.c 2011-05-22 19:41:37.000000000 -0400
49912@@ -23,7 +23,11 @@ static const struct file_operations cmdl
49913
49914 static int __init proc_cmdline_init(void)
49915 {
49916+#ifdef CONFIG_GRKERNSEC_PROC_ADD
49917+ proc_create_grsec("cmdline", 0, NULL, &cmdline_proc_fops);
49918+#else
49919 proc_create("cmdline", 0, NULL, &cmdline_proc_fops);
49920+#endif
49921 return 0;
49922 }
49923 module_init(proc_cmdline_init);
49924diff -urNp linux-2.6.39/fs/proc/devices.c linux-2.6.39/fs/proc/devices.c
49925--- linux-2.6.39/fs/proc/devices.c 2011-05-19 00:06:34.000000000 -0400
49926+++ linux-2.6.39/fs/proc/devices.c 2011-05-22 19:41:37.000000000 -0400
49927@@ -64,7 +64,11 @@ static const struct file_operations proc
49928
49929 static int __init proc_devices_init(void)
49930 {
49931+#ifdef CONFIG_GRKERNSEC_PROC_ADD
49932+ proc_create_grsec("devices", 0, NULL, &proc_devinfo_operations);
49933+#else
49934 proc_create("devices", 0, NULL, &proc_devinfo_operations);
49935+#endif
49936 return 0;
49937 }
49938 module_init(proc_devices_init);
49939diff -urNp linux-2.6.39/fs/proc/inode.c linux-2.6.39/fs/proc/inode.c
49940--- linux-2.6.39/fs/proc/inode.c 2011-05-19 00:06:34.000000000 -0400
49941+++ linux-2.6.39/fs/proc/inode.c 2011-05-22 19:41:37.000000000 -0400
49942@@ -433,7 +433,11 @@ struct inode *proc_get_inode(struct supe
49943 if (de->mode) {
49944 inode->i_mode = de->mode;
49945 inode->i_uid = de->uid;
49946+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
49947+ inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
49948+#else
49949 inode->i_gid = de->gid;
49950+#endif
49951 }
49952 if (de->size)
49953 inode->i_size = de->size;
49954diff -urNp linux-2.6.39/fs/proc/internal.h linux-2.6.39/fs/proc/internal.h
49955--- linux-2.6.39/fs/proc/internal.h 2011-05-19 00:06:34.000000000 -0400
49956+++ linux-2.6.39/fs/proc/internal.h 2011-05-22 19:41:37.000000000 -0400
49957@@ -51,6 +51,9 @@ extern int proc_pid_status(struct seq_fi
49958 struct pid *pid, struct task_struct *task);
49959 extern int proc_pid_statm(struct seq_file *m, struct pid_namespace *ns,
49960 struct pid *pid, struct task_struct *task);
49961+#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
49962+extern int proc_pid_ipaddr(struct task_struct *task, char *buffer);
49963+#endif
49964 extern loff_t mem_lseek(struct file *file, loff_t offset, int orig);
49965
49966 extern const struct file_operations proc_maps_operations;
49967diff -urNp linux-2.6.39/fs/proc/Kconfig linux-2.6.39/fs/proc/Kconfig
49968--- linux-2.6.39/fs/proc/Kconfig 2011-05-19 00:06:34.000000000 -0400
49969+++ linux-2.6.39/fs/proc/Kconfig 2011-05-22 19:41:37.000000000 -0400
49970@@ -30,12 +30,12 @@ config PROC_FS
49971
49972 config PROC_KCORE
49973 bool "/proc/kcore support" if !ARM
49974- depends on PROC_FS && MMU
49975+ depends on PROC_FS && MMU && !GRKERNSEC_PROC_ADD
49976
49977 config PROC_VMCORE
49978 bool "/proc/vmcore support"
49979- depends on PROC_FS && CRASH_DUMP
49980- default y
49981+ depends on PROC_FS && CRASH_DUMP && !GRKERNSEC
49982+ default n
49983 help
49984 Exports the dump image of crashed kernel in ELF format.
49985
49986@@ -59,8 +59,8 @@ config PROC_SYSCTL
49987 limited in memory.
49988
49989 config PROC_PAGE_MONITOR
49990- default y
49991- depends on PROC_FS && MMU
49992+ default n
49993+ depends on PROC_FS && MMU && !GRKERNSEC
49994 bool "Enable /proc page monitoring" if EXPERT
49995 help
49996 Various /proc files exist to monitor process memory utilization:
49997diff -urNp linux-2.6.39/fs/proc/kcore.c linux-2.6.39/fs/proc/kcore.c
49998--- linux-2.6.39/fs/proc/kcore.c 2011-05-19 00:06:34.000000000 -0400
49999+++ linux-2.6.39/fs/proc/kcore.c 2011-05-22 19:41:37.000000000 -0400
50000@@ -321,6 +321,8 @@ static void elf_kcore_store_hdr(char *bu
50001 off_t offset = 0;
50002 struct kcore_list *m;
50003
50004+ pax_track_stack();
50005+
50006 /* setup ELF header */
50007 elf = (struct elfhdr *) bufp;
50008 bufp += sizeof(struct elfhdr);
50009@@ -478,9 +480,10 @@ read_kcore(struct file *file, char __use
50010 * the addresses in the elf_phdr on our list.
50011 */
50012 start = kc_offset_to_vaddr(*fpos - elf_buflen);
50013- if ((tsz = (PAGE_SIZE - (start & ~PAGE_MASK))) > buflen)
50014+ tsz = PAGE_SIZE - (start & ~PAGE_MASK);
50015+ if (tsz > buflen)
50016 tsz = buflen;
50017-
50018+
50019 while (buflen) {
50020 struct kcore_list *m;
50021
50022@@ -509,20 +512,23 @@ read_kcore(struct file *file, char __use
50023 kfree(elf_buf);
50024 } else {
50025 if (kern_addr_valid(start)) {
50026- unsigned long n;
50027+ char *elf_buf;
50028+ mm_segment_t oldfs;
50029
50030- n = copy_to_user(buffer, (char *)start, tsz);
50031- /*
50032- * We cannot distingush between fault on source
50033- * and fault on destination. When this happens
50034- * we clear too and hope it will trigger the
50035- * EFAULT again.
50036- */
50037- if (n) {
50038- if (clear_user(buffer + tsz - n,
50039- n))
50040+ elf_buf = kmalloc(tsz, GFP_KERNEL);
50041+ if (!elf_buf)
50042+ return -ENOMEM;
50043+ oldfs = get_fs();
50044+ set_fs(KERNEL_DS);
50045+ if (!__copy_from_user(elf_buf, (const void __user *)start, tsz)) {
50046+ set_fs(oldfs);
50047+ if (copy_to_user(buffer, elf_buf, tsz)) {
50048+ kfree(elf_buf);
50049 return -EFAULT;
50050+ }
50051 }
50052+ set_fs(oldfs);
50053+ kfree(elf_buf);
50054 } else {
50055 if (clear_user(buffer, tsz))
50056 return -EFAULT;
50057@@ -542,6 +548,9 @@ read_kcore(struct file *file, char __use
50058
50059 static int open_kcore(struct inode *inode, struct file *filp)
50060 {
50061+#if defined(CONFIG_GRKERNSEC_PROC_ADD) || defined(CONFIG_GRKERNSEC_HIDESYM)
50062+ return -EPERM;
50063+#endif
50064 if (!capable(CAP_SYS_RAWIO))
50065 return -EPERM;
50066 if (kcore_need_update)
50067diff -urNp linux-2.6.39/fs/proc/meminfo.c linux-2.6.39/fs/proc/meminfo.c
50068--- linux-2.6.39/fs/proc/meminfo.c 2011-05-19 00:06:34.000000000 -0400
50069+++ linux-2.6.39/fs/proc/meminfo.c 2011-05-22 19:36:32.000000000 -0400
50070@@ -29,6 +29,8 @@ static int meminfo_proc_show(struct seq_
50071 unsigned long pages[NR_LRU_LISTS];
50072 int lru;
50073
50074+ pax_track_stack();
50075+
50076 /*
50077 * display in kilobytes.
50078 */
50079@@ -157,7 +159,7 @@ static int meminfo_proc_show(struct seq_
50080 vmi.used >> 10,
50081 vmi.largest_chunk >> 10
50082 #ifdef CONFIG_MEMORY_FAILURE
50083- ,atomic_long_read(&mce_bad_pages) << (PAGE_SHIFT - 10)
50084+ ,atomic_long_read_unchecked(&mce_bad_pages) << (PAGE_SHIFT - 10)
50085 #endif
50086 #ifdef CONFIG_TRANSPARENT_HUGEPAGE
50087 ,K(global_page_state(NR_ANON_TRANSPARENT_HUGEPAGES) *
50088diff -urNp linux-2.6.39/fs/proc/nommu.c linux-2.6.39/fs/proc/nommu.c
50089--- linux-2.6.39/fs/proc/nommu.c 2011-05-19 00:06:34.000000000 -0400
50090+++ linux-2.6.39/fs/proc/nommu.c 2011-05-22 19:36:32.000000000 -0400
50091@@ -66,7 +66,7 @@ static int nommu_region_show(struct seq_
50092 if (len < 1)
50093 len = 1;
50094 seq_printf(m, "%*c", len, ' ');
50095- seq_path(m, &file->f_path, "");
50096+ seq_path(m, &file->f_path, "\n\\");
50097 }
50098
50099 seq_putc(m, '\n');
50100diff -urNp linux-2.6.39/fs/proc/proc_net.c linux-2.6.39/fs/proc/proc_net.c
50101--- linux-2.6.39/fs/proc/proc_net.c 2011-05-19 00:06:34.000000000 -0400
50102+++ linux-2.6.39/fs/proc/proc_net.c 2011-05-22 19:41:37.000000000 -0400
50103@@ -105,6 +105,17 @@ static struct net *get_proc_task_net(str
50104 struct task_struct *task;
50105 struct nsproxy *ns;
50106 struct net *net = NULL;
50107+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
50108+ const struct cred *cred = current_cred();
50109+#endif
50110+
50111+#ifdef CONFIG_GRKERNSEC_PROC_USER
50112+ if (cred->fsuid)
50113+ return net;
50114+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
50115+ if (cred->fsuid && !in_group_p(CONFIG_GRKERNSEC_PROC_GID))
50116+ return net;
50117+#endif
50118
50119 rcu_read_lock();
50120 task = pid_task(proc_pid(dir), PIDTYPE_PID);
50121diff -urNp linux-2.6.39/fs/proc/proc_sysctl.c linux-2.6.39/fs/proc/proc_sysctl.c
50122--- linux-2.6.39/fs/proc/proc_sysctl.c 2011-05-19 00:06:34.000000000 -0400
50123+++ linux-2.6.39/fs/proc/proc_sysctl.c 2011-05-22 19:41:37.000000000 -0400
50124@@ -8,6 +8,8 @@
50125 #include <linux/namei.h>
50126 #include "internal.h"
50127
50128+extern __u32 gr_handle_sysctl(const struct ctl_table *table, const int op);
50129+
50130 static const struct dentry_operations proc_sys_dentry_operations;
50131 static const struct file_operations proc_sys_file_operations;
50132 static const struct inode_operations proc_sys_inode_operations;
50133@@ -111,6 +113,9 @@ static struct dentry *proc_sys_lookup(st
50134 if (!p)
50135 goto out;
50136
50137+ if (gr_handle_sysctl(p, MAY_EXEC))
50138+ goto out;
50139+
50140 err = ERR_PTR(-ENOMEM);
50141 inode = proc_sys_make_inode(dir->i_sb, h ? h : head, p);
50142 if (h)
50143@@ -230,6 +235,9 @@ static int scan(struct ctl_table_header
50144 if (*pos < file->f_pos)
50145 continue;
50146
50147+ if (gr_handle_sysctl(table, 0))
50148+ continue;
50149+
50150 res = proc_sys_fill_cache(file, dirent, filldir, head, table);
50151 if (res)
50152 return res;
50153@@ -358,6 +366,9 @@ static int proc_sys_getattr(struct vfsmo
50154 if (IS_ERR(head))
50155 return PTR_ERR(head);
50156
50157+ if (table && gr_handle_sysctl(table, MAY_EXEC))
50158+ return -ENOENT;
50159+
50160 generic_fillattr(inode, stat);
50161 if (table)
50162 stat->mode = (stat->mode & S_IFMT) | table->mode;
50163diff -urNp linux-2.6.39/fs/proc/root.c linux-2.6.39/fs/proc/root.c
50164--- linux-2.6.39/fs/proc/root.c 2011-05-19 00:06:34.000000000 -0400
50165+++ linux-2.6.39/fs/proc/root.c 2011-05-22 19:41:37.000000000 -0400
50166@@ -122,7 +122,15 @@ void __init proc_root_init(void)
50167 #ifdef CONFIG_PROC_DEVICETREE
50168 proc_device_tree_init();
50169 #endif
50170+#ifdef CONFIG_GRKERNSEC_PROC_ADD
50171+#ifdef CONFIG_GRKERNSEC_PROC_USER
50172+ proc_mkdir_mode("bus", S_IRUSR | S_IXUSR, NULL);
50173+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
50174+ proc_mkdir_mode("bus", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
50175+#endif
50176+#else
50177 proc_mkdir("bus", NULL);
50178+#endif
50179 proc_sys_init();
50180 }
50181
50182diff -urNp linux-2.6.39/fs/proc/task_mmu.c linux-2.6.39/fs/proc/task_mmu.c
50183--- linux-2.6.39/fs/proc/task_mmu.c 2011-05-19 00:06:34.000000000 -0400
50184+++ linux-2.6.39/fs/proc/task_mmu.c 2011-05-22 22:43:29.000000000 -0400
50185@@ -51,8 +51,13 @@ void task_mem(struct seq_file *m, struct
50186 "VmExe:\t%8lu kB\n"
50187 "VmLib:\t%8lu kB\n"
50188 "VmPTE:\t%8lu kB\n"
50189- "VmSwap:\t%8lu kB\n",
50190- hiwater_vm << (PAGE_SHIFT-10),
50191+ "VmSwap:\t%8lu kB\n"
50192+
50193+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
50194+ "CsBase:\t%8lx\nCsLim:\t%8lx\n"
50195+#endif
50196+
50197+ ,hiwater_vm << (PAGE_SHIFT-10),
50198 (total_vm - mm->reserved_vm) << (PAGE_SHIFT-10),
50199 mm->locked_vm << (PAGE_SHIFT-10),
50200 hiwater_rss << (PAGE_SHIFT-10),
50201@@ -60,7 +65,13 @@ void task_mem(struct seq_file *m, struct
50202 data << (PAGE_SHIFT-10),
50203 mm->stack_vm << (PAGE_SHIFT-10), text, lib,
50204 (PTRS_PER_PTE*sizeof(pte_t)*mm->nr_ptes) >> 10,
50205- swap << (PAGE_SHIFT-10));
50206+ swap << (PAGE_SHIFT-10)
50207+
50208+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
50209+ , mm->context.user_cs_base, mm->context.user_cs_limit
50210+#endif
50211+
50212+ );
50213 }
50214
50215 unsigned long task_vsize(struct mm_struct *mm)
50216@@ -207,6 +218,12 @@ static int do_maps_open(struct inode *in
50217 return ret;
50218 }
50219
50220+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
50221+#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
50222+ (_mm->pax_flags & MF_PAX_RANDMMAP || \
50223+ _mm->pax_flags & MF_PAX_SEGMEXEC))
50224+#endif
50225+
50226 static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
50227 {
50228 struct mm_struct *mm = vma->vm_mm;
50229@@ -225,13 +242,13 @@ static void show_map_vma(struct seq_file
50230 pgoff = ((loff_t)vma->vm_pgoff) << PAGE_SHIFT;
50231 }
50232
50233- /* We don't show the stack guard page in /proc/maps */
50234+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
50235+ start = PAX_RAND_FLAGS(mm) ? 0UL : vma->vm_start;
50236+ end = PAX_RAND_FLAGS(mm) ? 0UL : vma->vm_end;
50237+#else
50238 start = vma->vm_start;
50239- if (stack_guard_page_start(vma, start))
50240- start += PAGE_SIZE;
50241 end = vma->vm_end;
50242- if (stack_guard_page_end(vma, end))
50243- end -= PAGE_SIZE;
50244+#endif
50245
50246 seq_printf(m, "%08lx-%08lx %c%c%c%c %08llx %02x:%02x %lu %n",
50247 start,
50248@@ -240,7 +257,11 @@ static void show_map_vma(struct seq_file
50249 flags & VM_WRITE ? 'w' : '-',
50250 flags & VM_EXEC ? 'x' : '-',
50251 flags & VM_MAYSHARE ? 's' : 'p',
50252+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
50253+ PAX_RAND_FLAGS(mm) ? 0UL : pgoff,
50254+#else
50255 pgoff,
50256+#endif
50257 MAJOR(dev), MINOR(dev), ino, &len);
50258
50259 /*
50260@@ -249,7 +270,7 @@ static void show_map_vma(struct seq_file
50261 */
50262 if (file) {
50263 pad_len_spaces(m, len);
50264- seq_path(m, &file->f_path, "\n");
50265+ seq_path(m, &file->f_path, "\n\\");
50266 } else {
50267 const char *name = arch_vma_name(vma);
50268 if (!name) {
50269@@ -257,8 +278,9 @@ static void show_map_vma(struct seq_file
50270 if (vma->vm_start <= mm->brk &&
50271 vma->vm_end >= mm->start_brk) {
50272 name = "[heap]";
50273- } else if (vma->vm_start <= mm->start_stack &&
50274- vma->vm_end >= mm->start_stack) {
50275+ } else if ((vma->vm_flags & (VM_GROWSDOWN | VM_GROWSUP)) ||
50276+ (vma->vm_start <= mm->start_stack &&
50277+ vma->vm_end >= mm->start_stack)) {
50278 name = "[stack]";
50279 }
50280 } else {
50281@@ -433,11 +455,16 @@ static int show_smap(struct seq_file *m,
50282 };
50283
50284 memset(&mss, 0, sizeof mss);
50285- mss.vma = vma;
50286- /* mmap_sem is held in m_start */
50287- if (vma->vm_mm && !is_vm_hugetlb_page(vma))
50288- walk_page_range(vma->vm_start, vma->vm_end, &smaps_walk);
50289-
50290+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
50291+ if (!PAX_RAND_FLAGS(vma->vm_mm)) {
50292+#endif
50293+ mss.vma = vma;
50294+ /* mmap_sem is held in m_start */
50295+ if (vma->vm_mm && !is_vm_hugetlb_page(vma))
50296+ walk_page_range(vma->vm_start, vma->vm_end, &smaps_walk);
50297+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
50298+ }
50299+#endif
50300 show_map_vma(m, vma);
50301
50302 seq_printf(m,
50303@@ -455,7 +482,11 @@ static int show_smap(struct seq_file *m,
50304 "KernelPageSize: %8lu kB\n"
50305 "MMUPageSize: %8lu kB\n"
50306 "Locked: %8lu kB\n",
50307+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
50308+ PAX_RAND_FLAGS(vma->vm_mm) ? 0UL : (vma->vm_end - vma->vm_start) >> 10,
50309+#else
50310 (vma->vm_end - vma->vm_start) >> 10,
50311+#endif
50312 mss.resident >> 10,
50313 (unsigned long)(mss.pss >> (10 + PSS_SHIFT)),
50314 mss.shared_clean >> 10,
50315diff -urNp linux-2.6.39/fs/proc/task_nommu.c linux-2.6.39/fs/proc/task_nommu.c
50316--- linux-2.6.39/fs/proc/task_nommu.c 2011-05-19 00:06:34.000000000 -0400
50317+++ linux-2.6.39/fs/proc/task_nommu.c 2011-05-22 19:36:32.000000000 -0400
50318@@ -51,7 +51,7 @@ void task_mem(struct seq_file *m, struct
50319 else
50320 bytes += kobjsize(mm);
50321
50322- if (current->fs && current->fs->users > 1)
50323+ if (current->fs && atomic_read(&current->fs->users) > 1)
50324 sbytes += kobjsize(current->fs);
50325 else
50326 bytes += kobjsize(current->fs);
50327@@ -166,7 +166,7 @@ static int nommu_vma_show(struct seq_fil
50328
50329 if (file) {
50330 pad_len_spaces(m, len);
50331- seq_path(m, &file->f_path, "");
50332+ seq_path(m, &file->f_path, "\n\\");
50333 } else if (mm) {
50334 if (vma->vm_start <= mm->start_stack &&
50335 vma->vm_end >= mm->start_stack) {
50336diff -urNp linux-2.6.39/fs/quota/netlink.c linux-2.6.39/fs/quota/netlink.c
50337--- linux-2.6.39/fs/quota/netlink.c 2011-05-19 00:06:34.000000000 -0400
50338+++ linux-2.6.39/fs/quota/netlink.c 2011-05-22 19:36:32.000000000 -0400
50339@@ -33,7 +33,7 @@ static struct genl_family quota_genl_fam
50340 void quota_send_warning(short type, unsigned int id, dev_t dev,
50341 const char warntype)
50342 {
50343- static atomic_t seq;
50344+ static atomic_unchecked_t seq;
50345 struct sk_buff *skb;
50346 void *msg_head;
50347 int ret;
50348@@ -49,7 +49,7 @@ void quota_send_warning(short type, unsi
50349 "VFS: Not enough memory to send quota warning.\n");
50350 return;
50351 }
50352- msg_head = genlmsg_put(skb, 0, atomic_add_return(1, &seq),
50353+ msg_head = genlmsg_put(skb, 0, atomic_add_return_unchecked(1, &seq),
50354 &quota_genl_family, 0, QUOTA_NL_C_WARNING);
50355 if (!msg_head) {
50356 printk(KERN_ERR
50357diff -urNp linux-2.6.39/fs/readdir.c linux-2.6.39/fs/readdir.c
50358--- linux-2.6.39/fs/readdir.c 2011-05-19 00:06:34.000000000 -0400
50359+++ linux-2.6.39/fs/readdir.c 2011-05-22 19:41:42.000000000 -0400
50360@@ -17,6 +17,7 @@
50361 #include <linux/security.h>
50362 #include <linux/syscalls.h>
50363 #include <linux/unistd.h>
50364+#include <linux/namei.h>
50365
50366 #include <asm/uaccess.h>
50367
50368@@ -67,6 +68,7 @@ struct old_linux_dirent {
50369
50370 struct readdir_callback {
50371 struct old_linux_dirent __user * dirent;
50372+ struct file * file;
50373 int result;
50374 };
50375
50376@@ -84,6 +86,10 @@ static int fillonedir(void * __buf, cons
50377 buf->result = -EOVERFLOW;
50378 return -EOVERFLOW;
50379 }
50380+
50381+ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
50382+ return 0;
50383+
50384 buf->result++;
50385 dirent = buf->dirent;
50386 if (!access_ok(VERIFY_WRITE, dirent,
50387@@ -116,6 +122,7 @@ SYSCALL_DEFINE3(old_readdir, unsigned in
50388
50389 buf.result = 0;
50390 buf.dirent = dirent;
50391+ buf.file = file;
50392
50393 error = vfs_readdir(file, fillonedir, &buf);
50394 if (buf.result)
50395@@ -142,6 +149,7 @@ struct linux_dirent {
50396 struct getdents_callback {
50397 struct linux_dirent __user * current_dir;
50398 struct linux_dirent __user * previous;
50399+ struct file * file;
50400 int count;
50401 int error;
50402 };
50403@@ -163,6 +171,10 @@ static int filldir(void * __buf, const c
50404 buf->error = -EOVERFLOW;
50405 return -EOVERFLOW;
50406 }
50407+
50408+ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
50409+ return 0;
50410+
50411 dirent = buf->previous;
50412 if (dirent) {
50413 if (__put_user(offset, &dirent->d_off))
50414@@ -210,6 +222,7 @@ SYSCALL_DEFINE3(getdents, unsigned int,
50415 buf.previous = NULL;
50416 buf.count = count;
50417 buf.error = 0;
50418+ buf.file = file;
50419
50420 error = vfs_readdir(file, filldir, &buf);
50421 if (error >= 0)
50422@@ -229,6 +242,7 @@ out:
50423 struct getdents_callback64 {
50424 struct linux_dirent64 __user * current_dir;
50425 struct linux_dirent64 __user * previous;
50426+ struct file *file;
50427 int count;
50428 int error;
50429 };
50430@@ -244,6 +258,10 @@ static int filldir64(void * __buf, const
50431 buf->error = -EINVAL; /* only used if we fail.. */
50432 if (reclen > buf->count)
50433 return -EINVAL;
50434+
50435+ if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
50436+ return 0;
50437+
50438 dirent = buf->previous;
50439 if (dirent) {
50440 if (__put_user(offset, &dirent->d_off))
50441@@ -291,6 +309,7 @@ SYSCALL_DEFINE3(getdents64, unsigned int
50442
50443 buf.current_dir = dirent;
50444 buf.previous = NULL;
50445+ buf.file = file;
50446 buf.count = count;
50447 buf.error = 0;
50448
50449diff -urNp linux-2.6.39/fs/reiserfs/dir.c linux-2.6.39/fs/reiserfs/dir.c
50450--- linux-2.6.39/fs/reiserfs/dir.c 2011-05-19 00:06:34.000000000 -0400
50451+++ linux-2.6.39/fs/reiserfs/dir.c 2011-05-22 19:36:32.000000000 -0400
50452@@ -66,6 +66,8 @@ int reiserfs_readdir_dentry(struct dentr
50453 struct reiserfs_dir_entry de;
50454 int ret = 0;
50455
50456+ pax_track_stack();
50457+
50458 reiserfs_write_lock(inode->i_sb);
50459
50460 reiserfs_check_lock_depth(inode->i_sb, "readdir");
50461diff -urNp linux-2.6.39/fs/reiserfs/do_balan.c linux-2.6.39/fs/reiserfs/do_balan.c
50462--- linux-2.6.39/fs/reiserfs/do_balan.c 2011-05-19 00:06:34.000000000 -0400
50463+++ linux-2.6.39/fs/reiserfs/do_balan.c 2011-05-22 19:36:32.000000000 -0400
50464@@ -2051,7 +2051,7 @@ void do_balance(struct tree_balance *tb,
50465 return;
50466 }
50467
50468- atomic_inc(&(fs_generation(tb->tb_sb)));
50469+ atomic_inc_unchecked(&(fs_generation(tb->tb_sb)));
50470 do_balance_starts(tb);
50471
50472 /* balance leaf returns 0 except if combining L R and S into
50473diff -urNp linux-2.6.39/fs/reiserfs/item_ops.c linux-2.6.39/fs/reiserfs/item_ops.c
50474--- linux-2.6.39/fs/reiserfs/item_ops.c 2011-05-19 00:06:34.000000000 -0400
50475+++ linux-2.6.39/fs/reiserfs/item_ops.c 2011-05-22 19:36:32.000000000 -0400
50476@@ -102,7 +102,7 @@ static void sd_print_vi(struct virtual_i
50477 vi->vi_index, vi->vi_type, vi->vi_ih);
50478 }
50479
50480-static struct item_operations stat_data_ops = {
50481+static const struct item_operations stat_data_ops = {
50482 .bytes_number = sd_bytes_number,
50483 .decrement_key = sd_decrement_key,
50484 .is_left_mergeable = sd_is_left_mergeable,
50485@@ -196,7 +196,7 @@ static void direct_print_vi(struct virtu
50486 vi->vi_index, vi->vi_type, vi->vi_ih);
50487 }
50488
50489-static struct item_operations direct_ops = {
50490+static const struct item_operations direct_ops = {
50491 .bytes_number = direct_bytes_number,
50492 .decrement_key = direct_decrement_key,
50493 .is_left_mergeable = direct_is_left_mergeable,
50494@@ -341,7 +341,7 @@ static void indirect_print_vi(struct vir
50495 vi->vi_index, vi->vi_type, vi->vi_ih);
50496 }
50497
50498-static struct item_operations indirect_ops = {
50499+static const struct item_operations indirect_ops = {
50500 .bytes_number = indirect_bytes_number,
50501 .decrement_key = indirect_decrement_key,
50502 .is_left_mergeable = indirect_is_left_mergeable,
50503@@ -628,7 +628,7 @@ static void direntry_print_vi(struct vir
50504 printk("\n");
50505 }
50506
50507-static struct item_operations direntry_ops = {
50508+static const struct item_operations direntry_ops = {
50509 .bytes_number = direntry_bytes_number,
50510 .decrement_key = direntry_decrement_key,
50511 .is_left_mergeable = direntry_is_left_mergeable,
50512@@ -724,7 +724,7 @@ static void errcatch_print_vi(struct vir
50513 "Invalid item type observed, run fsck ASAP");
50514 }
50515
50516-static struct item_operations errcatch_ops = {
50517+static const struct item_operations errcatch_ops = {
50518 errcatch_bytes_number,
50519 errcatch_decrement_key,
50520 errcatch_is_left_mergeable,
50521@@ -746,7 +746,7 @@ static struct item_operations errcatch_o
50522 #error Item types must use disk-format assigned values.
50523 #endif
50524
50525-struct item_operations *item_ops[TYPE_ANY + 1] = {
50526+const struct item_operations * const item_ops[TYPE_ANY + 1] = {
50527 &stat_data_ops,
50528 &indirect_ops,
50529 &direct_ops,
50530diff -urNp linux-2.6.39/fs/reiserfs/journal.c linux-2.6.39/fs/reiserfs/journal.c
50531--- linux-2.6.39/fs/reiserfs/journal.c 2011-05-19 00:06:34.000000000 -0400
50532+++ linux-2.6.39/fs/reiserfs/journal.c 2011-05-22 19:36:32.000000000 -0400
50533@@ -2299,6 +2299,8 @@ static struct buffer_head *reiserfs_brea
50534 struct buffer_head *bh;
50535 int i, j;
50536
50537+ pax_track_stack();
50538+
50539 bh = __getblk(dev, block, bufsize);
50540 if (buffer_uptodate(bh))
50541 return (bh);
50542diff -urNp linux-2.6.39/fs/reiserfs/namei.c linux-2.6.39/fs/reiserfs/namei.c
50543--- linux-2.6.39/fs/reiserfs/namei.c 2011-05-19 00:06:34.000000000 -0400
50544+++ linux-2.6.39/fs/reiserfs/namei.c 2011-05-22 19:36:32.000000000 -0400
50545@@ -1225,6 +1225,8 @@ static int reiserfs_rename(struct inode
50546 unsigned long savelink = 1;
50547 struct timespec ctime;
50548
50549+ pax_track_stack();
50550+
50551 /* three balancings: (1) old name removal, (2) new name insertion
50552 and (3) maybe "save" link insertion
50553 stat data updates: (1) old directory,
50554diff -urNp linux-2.6.39/fs/reiserfs/procfs.c linux-2.6.39/fs/reiserfs/procfs.c
50555--- linux-2.6.39/fs/reiserfs/procfs.c 2011-05-19 00:06:34.000000000 -0400
50556+++ linux-2.6.39/fs/reiserfs/procfs.c 2011-05-22 19:36:32.000000000 -0400
50557@@ -113,7 +113,7 @@ static int show_super(struct seq_file *m
50558 "SMALL_TAILS " : "NO_TAILS ",
50559 replay_only(sb) ? "REPLAY_ONLY " : "",
50560 convert_reiserfs(sb) ? "CONV " : "",
50561- atomic_read(&r->s_generation_counter),
50562+ atomic_read_unchecked(&r->s_generation_counter),
50563 SF(s_disk_reads), SF(s_disk_writes), SF(s_fix_nodes),
50564 SF(s_do_balance), SF(s_unneeded_left_neighbor),
50565 SF(s_good_search_by_key_reada), SF(s_bmaps),
50566@@ -299,6 +299,8 @@ static int show_journal(struct seq_file
50567 struct journal_params *jp = &rs->s_v1.s_journal;
50568 char b[BDEVNAME_SIZE];
50569
50570+ pax_track_stack();
50571+
50572 seq_printf(m, /* on-disk fields */
50573 "jp_journal_1st_block: \t%i\n"
50574 "jp_journal_dev: \t%s[%x]\n"
50575diff -urNp linux-2.6.39/fs/reiserfs/stree.c linux-2.6.39/fs/reiserfs/stree.c
50576--- linux-2.6.39/fs/reiserfs/stree.c 2011-05-19 00:06:34.000000000 -0400
50577+++ linux-2.6.39/fs/reiserfs/stree.c 2011-05-22 19:36:32.000000000 -0400
50578@@ -1196,6 +1196,8 @@ int reiserfs_delete_item(struct reiserfs
50579 int iter = 0;
50580 #endif
50581
50582+ pax_track_stack();
50583+
50584 BUG_ON(!th->t_trans_id);
50585
50586 init_tb_struct(th, &s_del_balance, sb, path,
50587@@ -1333,6 +1335,8 @@ void reiserfs_delete_solid_item(struct r
50588 int retval;
50589 int quota_cut_bytes = 0;
50590
50591+ pax_track_stack();
50592+
50593 BUG_ON(!th->t_trans_id);
50594
50595 le_key2cpu_key(&cpu_key, key);
50596@@ -1562,6 +1566,8 @@ int reiserfs_cut_from_item(struct reiser
50597 int quota_cut_bytes;
50598 loff_t tail_pos = 0;
50599
50600+ pax_track_stack();
50601+
50602 BUG_ON(!th->t_trans_id);
50603
50604 init_tb_struct(th, &s_cut_balance, inode->i_sb, path,
50605@@ -1957,6 +1963,8 @@ int reiserfs_paste_into_item(struct reis
50606 int retval;
50607 int fs_gen;
50608
50609+ pax_track_stack();
50610+
50611 BUG_ON(!th->t_trans_id);
50612
50613 fs_gen = get_generation(inode->i_sb);
50614@@ -2045,6 +2053,8 @@ int reiserfs_insert_item(struct reiserfs
50615 int fs_gen = 0;
50616 int quota_bytes = 0;
50617
50618+ pax_track_stack();
50619+
50620 BUG_ON(!th->t_trans_id);
50621
50622 if (inode) { /* Do we count quotas for item? */
50623diff -urNp linux-2.6.39/fs/reiserfs/super.c linux-2.6.39/fs/reiserfs/super.c
50624--- linux-2.6.39/fs/reiserfs/super.c 2011-05-19 00:06:34.000000000 -0400
50625+++ linux-2.6.39/fs/reiserfs/super.c 2011-05-22 19:36:32.000000000 -0400
50626@@ -927,6 +927,8 @@ static int reiserfs_parse_options(struct
50627 {.option_name = NULL}
50628 };
50629
50630+ pax_track_stack();
50631+
50632 *blocks = 0;
50633 if (!options || !*options)
50634 /* use default configuration: create tails, journaling on, no
50635diff -urNp linux-2.6.39/fs/select.c linux-2.6.39/fs/select.c
50636--- linux-2.6.39/fs/select.c 2011-05-19 00:06:34.000000000 -0400
50637+++ linux-2.6.39/fs/select.c 2011-05-22 19:41:42.000000000 -0400
50638@@ -20,6 +20,7 @@
50639 #include <linux/module.h>
50640 #include <linux/slab.h>
50641 #include <linux/poll.h>
50642+#include <linux/security.h>
50643 #include <linux/personality.h> /* for STICKY_TIMEOUTS */
50644 #include <linux/file.h>
50645 #include <linux/fdtable.h>
50646@@ -403,6 +404,8 @@ int do_select(int n, fd_set_bits *fds, s
50647 int retval, i, timed_out = 0;
50648 unsigned long slack = 0;
50649
50650+ pax_track_stack();
50651+
50652 rcu_read_lock();
50653 retval = max_select_fd(n, fds);
50654 rcu_read_unlock();
50655@@ -528,6 +531,8 @@ int core_sys_select(int n, fd_set __user
50656 /* Allocate small arguments on the stack to save memory and be faster */
50657 long stack_fds[SELECT_STACK_ALLOC/sizeof(long)];
50658
50659+ pax_track_stack();
50660+
50661 ret = -EINVAL;
50662 if (n < 0)
50663 goto out_nofds;
50664@@ -837,6 +842,9 @@ int do_sys_poll(struct pollfd __user *uf
50665 struct poll_list *walk = head;
50666 unsigned long todo = nfds;
50667
50668+ pax_track_stack();
50669+
50670+ gr_learn_resource(current, RLIMIT_NOFILE, nfds, 1);
50671 if (nfds > rlimit(RLIMIT_NOFILE))
50672 return -EINVAL;
50673
50674diff -urNp linux-2.6.39/fs/seq_file.c linux-2.6.39/fs/seq_file.c
50675--- linux-2.6.39/fs/seq_file.c 2011-05-19 00:06:34.000000000 -0400
50676+++ linux-2.6.39/fs/seq_file.c 2011-05-22 19:36:32.000000000 -0400
50677@@ -76,7 +76,8 @@ static int traverse(struct seq_file *m,
50678 return 0;
50679 }
50680 if (!m->buf) {
50681- m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL);
50682+ m->size = PAGE_SIZE;
50683+ m->buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
50684 if (!m->buf)
50685 return -ENOMEM;
50686 }
50687@@ -116,7 +117,8 @@ static int traverse(struct seq_file *m,
50688 Eoverflow:
50689 m->op->stop(m, p);
50690 kfree(m->buf);
50691- m->buf = kmalloc(m->size <<= 1, GFP_KERNEL);
50692+ m->size <<= 1;
50693+ m->buf = kmalloc(m->size, GFP_KERNEL);
50694 return !m->buf ? -ENOMEM : -EAGAIN;
50695 }
50696
50697@@ -169,7 +171,8 @@ ssize_t seq_read(struct file *file, char
50698 m->version = file->f_version;
50699 /* grab buffer if we didn't have one */
50700 if (!m->buf) {
50701- m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL);
50702+ m->size = PAGE_SIZE;
50703+ m->buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
50704 if (!m->buf)
50705 goto Enomem;
50706 }
50707@@ -210,7 +213,8 @@ ssize_t seq_read(struct file *file, char
50708 goto Fill;
50709 m->op->stop(m, p);
50710 kfree(m->buf);
50711- m->buf = kmalloc(m->size <<= 1, GFP_KERNEL);
50712+ m->size <<= 1;
50713+ m->buf = kmalloc(m->size, GFP_KERNEL);
50714 if (!m->buf)
50715 goto Enomem;
50716 m->count = 0;
50717diff -urNp linux-2.6.39/fs/splice.c linux-2.6.39/fs/splice.c
50718--- linux-2.6.39/fs/splice.c 2011-05-19 00:06:34.000000000 -0400
50719+++ linux-2.6.39/fs/splice.c 2011-05-22 19:36:32.000000000 -0400
50720@@ -186,7 +186,7 @@ ssize_t splice_to_pipe(struct pipe_inode
50721 pipe_lock(pipe);
50722
50723 for (;;) {
50724- if (!pipe->readers) {
50725+ if (!atomic_read(&pipe->readers)) {
50726 send_sig(SIGPIPE, current, 0);
50727 if (!ret)
50728 ret = -EPIPE;
50729@@ -240,9 +240,9 @@ ssize_t splice_to_pipe(struct pipe_inode
50730 do_wakeup = 0;
50731 }
50732
50733- pipe->waiting_writers++;
50734+ atomic_inc(&pipe->waiting_writers);
50735 pipe_wait(pipe);
50736- pipe->waiting_writers--;
50737+ atomic_dec(&pipe->waiting_writers);
50738 }
50739
50740 pipe_unlock(pipe);
50741@@ -316,6 +316,8 @@ __generic_file_splice_read(struct file *
50742 .spd_release = spd_release_page,
50743 };
50744
50745+ pax_track_stack();
50746+
50747 if (splice_grow_spd(pipe, &spd))
50748 return -ENOMEM;
50749
50750@@ -556,7 +558,7 @@ static ssize_t kernel_readv(struct file
50751 old_fs = get_fs();
50752 set_fs(get_ds());
50753 /* The cast to a user pointer is valid due to the set_fs() */
50754- res = vfs_readv(file, (const struct iovec __user *)vec, vlen, &pos);
50755+ res = vfs_readv(file, (__force const struct iovec __user *)vec, vlen, &pos);
50756 set_fs(old_fs);
50757
50758 return res;
50759@@ -571,7 +573,7 @@ static ssize_t kernel_write(struct file
50760 old_fs = get_fs();
50761 set_fs(get_ds());
50762 /* The cast to a user pointer is valid due to the set_fs() */
50763- res = vfs_write(file, (const char __user *)buf, count, &pos);
50764+ res = vfs_write(file, (__force const char __user *)buf, count, &pos);
50765 set_fs(old_fs);
50766
50767 return res;
50768@@ -599,6 +601,8 @@ ssize_t default_file_splice_read(struct
50769 .spd_release = spd_release_page,
50770 };
50771
50772+ pax_track_stack();
50773+
50774 if (splice_grow_spd(pipe, &spd))
50775 return -ENOMEM;
50776
50777@@ -622,7 +626,7 @@ ssize_t default_file_splice_read(struct
50778 goto err;
50779
50780 this_len = min_t(size_t, len, PAGE_CACHE_SIZE - offset);
50781- vec[i].iov_base = (void __user *) page_address(page);
50782+ vec[i].iov_base = (__force void __user *) page_address(page);
50783 vec[i].iov_len = this_len;
50784 spd.pages[i] = page;
50785 spd.nr_pages++;
50786@@ -842,10 +846,10 @@ EXPORT_SYMBOL(splice_from_pipe_feed);
50787 int splice_from_pipe_next(struct pipe_inode_info *pipe, struct splice_desc *sd)
50788 {
50789 while (!pipe->nrbufs) {
50790- if (!pipe->writers)
50791+ if (!atomic_read(&pipe->writers))
50792 return 0;
50793
50794- if (!pipe->waiting_writers && sd->num_spliced)
50795+ if (!atomic_read(&pipe->waiting_writers) && sd->num_spliced)
50796 return 0;
50797
50798 if (sd->flags & SPLICE_F_NONBLOCK)
50799@@ -1178,7 +1182,7 @@ ssize_t splice_direct_to_actor(struct fi
50800 * out of the pipe right after the splice_to_pipe(). So set
50801 * PIPE_READERS appropriately.
50802 */
50803- pipe->readers = 1;
50804+ atomic_set(&pipe->readers, 1);
50805
50806 current->splice_pipe = pipe;
50807 }
50808@@ -1615,6 +1619,8 @@ static long vmsplice_to_pipe(struct file
50809 };
50810 long ret;
50811
50812+ pax_track_stack();
50813+
50814 pipe = get_pipe_info(file);
50815 if (!pipe)
50816 return -EBADF;
50817@@ -1730,9 +1736,9 @@ static int ipipe_prep(struct pipe_inode_
50818 ret = -ERESTARTSYS;
50819 break;
50820 }
50821- if (!pipe->writers)
50822+ if (!atomic_read(&pipe->writers))
50823 break;
50824- if (!pipe->waiting_writers) {
50825+ if (!atomic_read(&pipe->waiting_writers)) {
50826 if (flags & SPLICE_F_NONBLOCK) {
50827 ret = -EAGAIN;
50828 break;
50829@@ -1764,7 +1770,7 @@ static int opipe_prep(struct pipe_inode_
50830 pipe_lock(pipe);
50831
50832 while (pipe->nrbufs >= pipe->buffers) {
50833- if (!pipe->readers) {
50834+ if (!atomic_read(&pipe->readers)) {
50835 send_sig(SIGPIPE, current, 0);
50836 ret = -EPIPE;
50837 break;
50838@@ -1777,9 +1783,9 @@ static int opipe_prep(struct pipe_inode_
50839 ret = -ERESTARTSYS;
50840 break;
50841 }
50842- pipe->waiting_writers++;
50843+ atomic_inc(&pipe->waiting_writers);
50844 pipe_wait(pipe);
50845- pipe->waiting_writers--;
50846+ atomic_dec(&pipe->waiting_writers);
50847 }
50848
50849 pipe_unlock(pipe);
50850@@ -1815,14 +1821,14 @@ retry:
50851 pipe_double_lock(ipipe, opipe);
50852
50853 do {
50854- if (!opipe->readers) {
50855+ if (!atomic_read(&opipe->readers)) {
50856 send_sig(SIGPIPE, current, 0);
50857 if (!ret)
50858 ret = -EPIPE;
50859 break;
50860 }
50861
50862- if (!ipipe->nrbufs && !ipipe->writers)
50863+ if (!ipipe->nrbufs && !atomic_read(&ipipe->writers))
50864 break;
50865
50866 /*
50867@@ -1922,7 +1928,7 @@ static int link_pipe(struct pipe_inode_i
50868 pipe_double_lock(ipipe, opipe);
50869
50870 do {
50871- if (!opipe->readers) {
50872+ if (!atomic_read(&opipe->readers)) {
50873 send_sig(SIGPIPE, current, 0);
50874 if (!ret)
50875 ret = -EPIPE;
50876@@ -1967,7 +1973,7 @@ static int link_pipe(struct pipe_inode_i
50877 * return EAGAIN if we have the potential of some data in the
50878 * future, otherwise just return 0
50879 */
50880- if (!ret && ipipe->waiting_writers && (flags & SPLICE_F_NONBLOCK))
50881+ if (!ret && atomic_read(&ipipe->waiting_writers) && (flags & SPLICE_F_NONBLOCK))
50882 ret = -EAGAIN;
50883
50884 pipe_unlock(ipipe);
50885diff -urNp linux-2.6.39/fs/sysfs/file.c linux-2.6.39/fs/sysfs/file.c
50886--- linux-2.6.39/fs/sysfs/file.c 2011-05-19 00:06:34.000000000 -0400
50887+++ linux-2.6.39/fs/sysfs/file.c 2011-05-22 19:36:32.000000000 -0400
50888@@ -44,7 +44,7 @@ static DEFINE_SPINLOCK(sysfs_open_dirent
50889
50890 struct sysfs_open_dirent {
50891 atomic_t refcnt;
50892- atomic_t event;
50893+ atomic_unchecked_t event;
50894 wait_queue_head_t poll;
50895 struct list_head buffers; /* goes through sysfs_buffer.list */
50896 };
50897@@ -88,7 +88,7 @@ static int fill_read_buffer(struct dentr
50898 if (!sysfs_get_active(attr_sd))
50899 return -ENODEV;
50900
50901- buffer->event = atomic_read(&attr_sd->s_attr.open->event);
50902+ buffer->event = atomic_read_unchecked(&attr_sd->s_attr.open->event);
50903 count = ops->show(kobj, attr_sd->s_attr.attr, buffer->page);
50904
50905 sysfs_put_active(attr_sd);
50906@@ -294,7 +294,7 @@ static int sysfs_get_open_dirent(struct
50907 return -ENOMEM;
50908
50909 atomic_set(&new_od->refcnt, 0);
50910- atomic_set(&new_od->event, 1);
50911+ atomic_set_unchecked(&new_od->event, 1);
50912 init_waitqueue_head(&new_od->poll);
50913 INIT_LIST_HEAD(&new_od->buffers);
50914 goto retry;
50915@@ -444,7 +444,7 @@ static unsigned int sysfs_poll(struct fi
50916
50917 sysfs_put_active(attr_sd);
50918
50919- if (buffer->event != atomic_read(&od->event))
50920+ if (buffer->event != atomic_read_unchecked(&od->event))
50921 goto trigger;
50922
50923 return DEFAULT_POLLMASK;
50924@@ -463,7 +463,7 @@ void sysfs_notify_dirent(struct sysfs_di
50925
50926 od = sd->s_attr.open;
50927 if (od) {
50928- atomic_inc(&od->event);
50929+ atomic_inc_unchecked(&od->event);
50930 wake_up_interruptible(&od->poll);
50931 }
50932
50933diff -urNp linux-2.6.39/fs/sysfs/mount.c linux-2.6.39/fs/sysfs/mount.c
50934--- linux-2.6.39/fs/sysfs/mount.c 2011-05-19 00:06:34.000000000 -0400
50935+++ linux-2.6.39/fs/sysfs/mount.c 2011-05-22 19:41:42.000000000 -0400
50936@@ -36,7 +36,11 @@ struct sysfs_dirent sysfs_root = {
50937 .s_name = "",
50938 .s_count = ATOMIC_INIT(1),
50939 .s_flags = SYSFS_DIR | (KOBJ_NS_TYPE_NONE << SYSFS_NS_TYPE_SHIFT),
50940+#ifdef CONFIG_GRKERNSEC_SYSFS_RESTRICT
50941+ .s_mode = S_IFDIR | S_IRWXU,
50942+#else
50943 .s_mode = S_IFDIR | S_IRWXU | S_IRUGO | S_IXUGO,
50944+#endif
50945 .s_ino = 1,
50946 };
50947
50948diff -urNp linux-2.6.39/fs/sysfs/symlink.c linux-2.6.39/fs/sysfs/symlink.c
50949--- linux-2.6.39/fs/sysfs/symlink.c 2011-05-19 00:06:34.000000000 -0400
50950+++ linux-2.6.39/fs/sysfs/symlink.c 2011-05-22 19:36:32.000000000 -0400
50951@@ -286,7 +286,7 @@ static void *sysfs_follow_link(struct de
50952
50953 static void sysfs_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie)
50954 {
50955- char *page = nd_get_link(nd);
50956+ const char *page = nd_get_link(nd);
50957 if (!IS_ERR(page))
50958 free_page((unsigned long)page);
50959 }
50960diff -urNp linux-2.6.39/fs/udf/inode.c linux-2.6.39/fs/udf/inode.c
50961--- linux-2.6.39/fs/udf/inode.c 2011-05-19 00:06:34.000000000 -0400
50962+++ linux-2.6.39/fs/udf/inode.c 2011-05-22 19:36:32.000000000 -0400
50963@@ -560,6 +560,8 @@ static struct buffer_head *inode_getblk(
50964 int goal = 0, pgoal = iinfo->i_location.logicalBlockNum;
50965 int lastblock = 0;
50966
50967+ pax_track_stack();
50968+
50969 prev_epos.offset = udf_file_entry_alloc_offset(inode);
50970 prev_epos.block = iinfo->i_location;
50971 prev_epos.bh = NULL;
50972diff -urNp linux-2.6.39/fs/udf/misc.c linux-2.6.39/fs/udf/misc.c
50973--- linux-2.6.39/fs/udf/misc.c 2011-05-19 00:06:34.000000000 -0400
50974+++ linux-2.6.39/fs/udf/misc.c 2011-05-22 19:36:32.000000000 -0400
50975@@ -286,7 +286,7 @@ void udf_new_tag(char *data, uint16_t id
50976
50977 u8 udf_tag_checksum(const struct tag *t)
50978 {
50979- u8 *data = (u8 *)t;
50980+ const u8 *data = (const u8 *)t;
50981 u8 checksum = 0;
50982 int i;
50983 for (i = 0; i < sizeof(struct tag); ++i)
50984diff -urNp linux-2.6.39/fs/utimes.c linux-2.6.39/fs/utimes.c
50985--- linux-2.6.39/fs/utimes.c 2011-05-19 00:06:34.000000000 -0400
50986+++ linux-2.6.39/fs/utimes.c 2011-05-22 19:41:42.000000000 -0400
50987@@ -1,6 +1,7 @@
50988 #include <linux/compiler.h>
50989 #include <linux/file.h>
50990 #include <linux/fs.h>
50991+#include <linux/security.h>
50992 #include <linux/linkage.h>
50993 #include <linux/mount.h>
50994 #include <linux/namei.h>
50995@@ -101,6 +102,12 @@ static int utimes_common(struct path *pa
50996 goto mnt_drop_write_and_out;
50997 }
50998 }
50999+
51000+ if (!gr_acl_handle_utime(path->dentry, path->mnt)) {
51001+ error = -EACCES;
51002+ goto mnt_drop_write_and_out;
51003+ }
51004+
51005 mutex_lock(&inode->i_mutex);
51006 error = notify_change(path->dentry, &newattrs);
51007 mutex_unlock(&inode->i_mutex);
51008diff -urNp linux-2.6.39/fs/xattr_acl.c linux-2.6.39/fs/xattr_acl.c
51009--- linux-2.6.39/fs/xattr_acl.c 2011-05-19 00:06:34.000000000 -0400
51010+++ linux-2.6.39/fs/xattr_acl.c 2011-05-22 19:36:32.000000000 -0400
51011@@ -17,8 +17,8 @@
51012 struct posix_acl *
51013 posix_acl_from_xattr(const void *value, size_t size)
51014 {
51015- posix_acl_xattr_header *header = (posix_acl_xattr_header *)value;
51016- posix_acl_xattr_entry *entry = (posix_acl_xattr_entry *)(header+1), *end;
51017+ const posix_acl_xattr_header *header = (const posix_acl_xattr_header *)value;
51018+ const posix_acl_xattr_entry *entry = (const posix_acl_xattr_entry *)(header+1), *end;
51019 int count;
51020 struct posix_acl *acl;
51021 struct posix_acl_entry *acl_e;
51022diff -urNp linux-2.6.39/fs/xattr.c linux-2.6.39/fs/xattr.c
51023--- linux-2.6.39/fs/xattr.c 2011-05-19 00:06:34.000000000 -0400
51024+++ linux-2.6.39/fs/xattr.c 2011-05-22 19:41:42.000000000 -0400
51025@@ -247,7 +247,7 @@ EXPORT_SYMBOL_GPL(vfs_removexattr);
51026 * Extended attribute SET operations
51027 */
51028 static long
51029-setxattr(struct dentry *d, const char __user *name, const void __user *value,
51030+setxattr(struct path *path, const char __user *name, const void __user *value,
51031 size_t size, int flags)
51032 {
51033 int error;
51034@@ -271,7 +271,13 @@ setxattr(struct dentry *d, const char __
51035 return PTR_ERR(kvalue);
51036 }
51037
51038- error = vfs_setxattr(d, kname, kvalue, size, flags);
51039+ if (!gr_acl_handle_setxattr(path->dentry, path->mnt)) {
51040+ error = -EACCES;
51041+ goto out;
51042+ }
51043+
51044+ error = vfs_setxattr(path->dentry, kname, kvalue, size, flags);
51045+out:
51046 kfree(kvalue);
51047 return error;
51048 }
51049@@ -288,7 +294,7 @@ SYSCALL_DEFINE5(setxattr, const char __u
51050 return error;
51051 error = mnt_want_write(path.mnt);
51052 if (!error) {
51053- error = setxattr(path.dentry, name, value, size, flags);
51054+ error = setxattr(&path, name, value, size, flags);
51055 mnt_drop_write(path.mnt);
51056 }
51057 path_put(&path);
51058@@ -307,7 +313,7 @@ SYSCALL_DEFINE5(lsetxattr, const char __
51059 return error;
51060 error = mnt_want_write(path.mnt);
51061 if (!error) {
51062- error = setxattr(path.dentry, name, value, size, flags);
51063+ error = setxattr(&path, name, value, size, flags);
51064 mnt_drop_write(path.mnt);
51065 }
51066 path_put(&path);
51067@@ -318,17 +324,15 @@ SYSCALL_DEFINE5(fsetxattr, int, fd, cons
51068 const void __user *,value, size_t, size, int, flags)
51069 {
51070 struct file *f;
51071- struct dentry *dentry;
51072 int error = -EBADF;
51073
51074 f = fget(fd);
51075 if (!f)
51076 return error;
51077- dentry = f->f_path.dentry;
51078- audit_inode(NULL, dentry);
51079+ audit_inode(NULL, f->f_path.dentry);
51080 error = mnt_want_write_file(f);
51081 if (!error) {
51082- error = setxattr(dentry, name, value, size, flags);
51083+ error = setxattr(&f->f_path, name, value, size, flags);
51084 mnt_drop_write(f->f_path.mnt);
51085 }
51086 fput(f);
51087diff -urNp linux-2.6.39/fs/xfs/linux-2.6/xfs_ioctl32.c linux-2.6.39/fs/xfs/linux-2.6/xfs_ioctl32.c
51088--- linux-2.6.39/fs/xfs/linux-2.6/xfs_ioctl32.c 2011-05-19 00:06:34.000000000 -0400
51089+++ linux-2.6.39/fs/xfs/linux-2.6/xfs_ioctl32.c 2011-05-22 19:41:42.000000000 -0400
51090@@ -73,6 +73,7 @@ xfs_compat_ioc_fsgeometry_v1(
51091 xfs_fsop_geom_t fsgeo;
51092 int error;
51093
51094+ memset(&fsgeo, 0, sizeof(fsgeo));
51095 error = xfs_fs_geometry(mp, &fsgeo, 3);
51096 if (error)
51097 return -error;
51098diff -urNp linux-2.6.39/fs/xfs/linux-2.6/xfs_ioctl.c linux-2.6.39/fs/xfs/linux-2.6/xfs_ioctl.c
51099--- linux-2.6.39/fs/xfs/linux-2.6/xfs_ioctl.c 2011-05-19 00:06:34.000000000 -0400
51100+++ linux-2.6.39/fs/xfs/linux-2.6/xfs_ioctl.c 2011-05-22 19:36:32.000000000 -0400
51101@@ -128,7 +128,7 @@ xfs_find_handle(
51102 }
51103
51104 error = -EFAULT;
51105- if (copy_to_user(hreq->ohandle, &handle, hsize) ||
51106+ if (hsize > sizeof handle || copy_to_user(hreq->ohandle, &handle, hsize) ||
51107 copy_to_user(hreq->ohandlen, &hsize, sizeof(__s32)))
51108 goto out_put;
51109
51110diff -urNp linux-2.6.39/fs/xfs/linux-2.6/xfs_iops.c linux-2.6.39/fs/xfs/linux-2.6/xfs_iops.c
51111--- linux-2.6.39/fs/xfs/linux-2.6/xfs_iops.c 2011-05-19 00:06:34.000000000 -0400
51112+++ linux-2.6.39/fs/xfs/linux-2.6/xfs_iops.c 2011-05-22 19:36:32.000000000 -0400
51113@@ -437,7 +437,7 @@ xfs_vn_put_link(
51114 struct nameidata *nd,
51115 void *p)
51116 {
51117- char *s = nd_get_link(nd);
51118+ const char *s = nd_get_link(nd);
51119
51120 if (!IS_ERR(s))
51121 kfree(s);
51122diff -urNp linux-2.6.39/fs/xfs/xfs_bmap.c linux-2.6.39/fs/xfs/xfs_bmap.c
51123--- linux-2.6.39/fs/xfs/xfs_bmap.c 2011-05-19 00:06:34.000000000 -0400
51124+++ linux-2.6.39/fs/xfs/xfs_bmap.c 2011-05-22 19:36:32.000000000 -0400
51125@@ -287,7 +287,7 @@ xfs_bmap_validate_ret(
51126 int nmap,
51127 int ret_nmap);
51128 #else
51129-#define xfs_bmap_validate_ret(bno,len,flags,mval,onmap,nmap)
51130+#define xfs_bmap_validate_ret(bno,len,flags,mval,onmap,nmap) do {} while (0)
51131 #endif /* DEBUG */
51132
51133 STATIC int
51134diff -urNp linux-2.6.39/fs/xfs/xfs_dir2.c linux-2.6.39/fs/xfs/xfs_dir2.c
51135--- linux-2.6.39/fs/xfs/xfs_dir2.c 2011-05-19 00:06:34.000000000 -0400
51136+++ linux-2.6.39/fs/xfs/xfs_dir2.c 2011-05-22 19:36:32.000000000 -0400
51137@@ -85,7 +85,7 @@ xfs_ascii_ci_compname(
51138 return result;
51139 }
51140
51141-static struct xfs_nameops xfs_ascii_ci_nameops = {
51142+static const struct xfs_nameops xfs_ascii_ci_nameops = {
51143 .hashname = xfs_ascii_ci_hashname,
51144 .compname = xfs_ascii_ci_compname,
51145 };
51146diff -urNp linux-2.6.39/fs/xfs/xfs_dir2_sf.c linux-2.6.39/fs/xfs/xfs_dir2_sf.c
51147--- linux-2.6.39/fs/xfs/xfs_dir2_sf.c 2011-05-19 00:06:34.000000000 -0400
51148+++ linux-2.6.39/fs/xfs/xfs_dir2_sf.c 2011-05-22 19:36:32.000000000 -0400
51149@@ -780,7 +780,15 @@ xfs_dir2_sf_getdents(
51150 }
51151
51152 ino = xfs_dir2_sf_get_inumber(sfp, xfs_dir2_sf_inumberp(sfep));
51153- if (filldir(dirent, (char *)sfep->name, sfep->namelen,
51154+ if (dp->i_df.if_u1.if_data == dp->i_df.if_u2.if_inline_data) {
51155+ char name[sfep->namelen];
51156+ memcpy(name, sfep->name, sfep->namelen);
51157+ if (filldir(dirent, name, sfep->namelen,
51158+ off & 0x7fffffff, ino, DT_UNKNOWN)) {
51159+ *offset = off & 0x7fffffff;
51160+ return 0;
51161+ }
51162+ } else if (filldir(dirent, (char *)sfep->name, sfep->namelen,
51163 off & 0x7fffffff, ino, DT_UNKNOWN)) {
51164 *offset = off & 0x7fffffff;
51165 return 0;
51166diff -urNp linux-2.6.39/grsecurity/gracl_alloc.c linux-2.6.39/grsecurity/gracl_alloc.c
51167--- linux-2.6.39/grsecurity/gracl_alloc.c 1969-12-31 19:00:00.000000000 -0500
51168+++ linux-2.6.39/grsecurity/gracl_alloc.c 2011-05-22 19:41:42.000000000 -0400
51169@@ -0,0 +1,105 @@
51170+#include <linux/kernel.h>
51171+#include <linux/mm.h>
51172+#include <linux/slab.h>
51173+#include <linux/vmalloc.h>
51174+#include <linux/gracl.h>
51175+#include <linux/grsecurity.h>
51176+
51177+static unsigned long alloc_stack_next = 1;
51178+static unsigned long alloc_stack_size = 1;
51179+static void **alloc_stack;
51180+
51181+static __inline__ int
51182+alloc_pop(void)
51183+{
51184+ if (alloc_stack_next == 1)
51185+ return 0;
51186+
51187+ kfree(alloc_stack[alloc_stack_next - 2]);
51188+
51189+ alloc_stack_next--;
51190+
51191+ return 1;
51192+}
51193+
51194+static __inline__ int
51195+alloc_push(void *buf)
51196+{
51197+ if (alloc_stack_next >= alloc_stack_size)
51198+ return 1;
51199+
51200+ alloc_stack[alloc_stack_next - 1] = buf;
51201+
51202+ alloc_stack_next++;
51203+
51204+ return 0;
51205+}
51206+
51207+void *
51208+acl_alloc(unsigned long len)
51209+{
51210+ void *ret = NULL;
51211+
51212+ if (!len || len > PAGE_SIZE)
51213+ goto out;
51214+
51215+ ret = kmalloc(len, GFP_KERNEL);
51216+
51217+ if (ret) {
51218+ if (alloc_push(ret)) {
51219+ kfree(ret);
51220+ ret = NULL;
51221+ }
51222+ }
51223+
51224+out:
51225+ return ret;
51226+}
51227+
51228+void *
51229+acl_alloc_num(unsigned long num, unsigned long len)
51230+{
51231+ if (!len || (num > (PAGE_SIZE / len)))
51232+ return NULL;
51233+
51234+ return acl_alloc(num * len);
51235+}
51236+
51237+void
51238+acl_free_all(void)
51239+{
51240+ if (gr_acl_is_enabled() || !alloc_stack)
51241+ return;
51242+
51243+ while (alloc_pop()) ;
51244+
51245+ if (alloc_stack) {
51246+ if ((alloc_stack_size * sizeof (void *)) <= PAGE_SIZE)
51247+ kfree(alloc_stack);
51248+ else
51249+ vfree(alloc_stack);
51250+ }
51251+
51252+ alloc_stack = NULL;
51253+ alloc_stack_size = 1;
51254+ alloc_stack_next = 1;
51255+
51256+ return;
51257+}
51258+
51259+int
51260+acl_alloc_stack_init(unsigned long size)
51261+{
51262+ if ((size * sizeof (void *)) <= PAGE_SIZE)
51263+ alloc_stack =
51264+ (void **) kmalloc(size * sizeof (void *), GFP_KERNEL);
51265+ else
51266+ alloc_stack = (void **) vmalloc(size * sizeof (void *));
51267+
51268+ alloc_stack_size = size;
51269+
51270+ if (!alloc_stack)
51271+ return 0;
51272+ else
51273+ return 1;
51274+}
51275diff -urNp linux-2.6.39/grsecurity/gracl.c linux-2.6.39/grsecurity/gracl.c
51276--- linux-2.6.39/grsecurity/gracl.c 1969-12-31 19:00:00.000000000 -0500
51277+++ linux-2.6.39/grsecurity/gracl.c 2011-05-24 20:27:30.000000000 -0400
51278@@ -0,0 +1,4103 @@
51279+#include <linux/kernel.h>
51280+#include <linux/module.h>
51281+#include <linux/sched.h>
51282+#include <linux/mm.h>
51283+#include <linux/file.h>
51284+#include <linux/fs.h>
51285+#include <linux/namei.h>
51286+#include <linux/mount.h>
51287+#include <linux/tty.h>
51288+#include <linux/proc_fs.h>
51289+#include <linux/lglock.h>
51290+#include <linux/slab.h>
51291+#include <linux/vmalloc.h>
51292+#include <linux/types.h>
51293+#include <linux/sysctl.h>
51294+#include <linux/netdevice.h>
51295+#include <linux/ptrace.h>
51296+#include <linux/gracl.h>
51297+#include <linux/gralloc.h>
51298+#include <linux/grsecurity.h>
51299+#include <linux/grinternal.h>
51300+#include <linux/pid_namespace.h>
51301+#include <linux/fdtable.h>
51302+#include <linux/percpu.h>
51303+
51304+#include <asm/uaccess.h>
51305+#include <asm/errno.h>
51306+#include <asm/mman.h>
51307+
51308+static struct acl_role_db acl_role_set;
51309+static struct name_db name_set;
51310+static struct inodev_db inodev_set;
51311+
51312+/* for keeping track of userspace pointers used for subjects, so we
51313+ can share references in the kernel as well
51314+*/
51315+
51316+static struct path real_root;
51317+
51318+static struct acl_subj_map_db subj_map_set;
51319+
51320+static struct acl_role_label *default_role;
51321+
51322+static struct acl_role_label *role_list;
51323+
51324+static u16 acl_sp_role_value;
51325+
51326+extern char *gr_shared_page[4];
51327+static DEFINE_MUTEX(gr_dev_mutex);
51328+DEFINE_RWLOCK(gr_inode_lock);
51329+
51330+struct gr_arg *gr_usermode;
51331+
51332+static unsigned int gr_status __read_only = GR_STATUS_INIT;
51333+
51334+extern int chkpw(struct gr_arg *entry, unsigned char *salt, unsigned char *sum);
51335+extern void gr_clear_learn_entries(void);
51336+
51337+#ifdef CONFIG_GRKERNSEC_RESLOG
51338+extern void gr_log_resource(const struct task_struct *task,
51339+ const int res, const unsigned long wanted, const int gt);
51340+#endif
51341+
51342+unsigned char *gr_system_salt;
51343+unsigned char *gr_system_sum;
51344+
51345+static struct sprole_pw **acl_special_roles = NULL;
51346+static __u16 num_sprole_pws = 0;
51347+
51348+static struct acl_role_label *kernel_role = NULL;
51349+
51350+static unsigned int gr_auth_attempts = 0;
51351+static unsigned long gr_auth_expires = 0UL;
51352+
51353+#ifdef CONFIG_NET
51354+extern struct vfsmount *sock_mnt;
51355+#endif
51356+
51357+extern struct vfsmount *pipe_mnt;
51358+extern struct vfsmount *shm_mnt;
51359+#ifdef CONFIG_HUGETLBFS
51360+extern struct vfsmount *hugetlbfs_vfsmount;
51361+#endif
51362+
51363+static struct acl_object_label *fakefs_obj;
51364+
51365+extern int gr_init_uidset(void);
51366+extern void gr_free_uidset(void);
51367+extern void gr_remove_uid(uid_t uid);
51368+extern int gr_find_uid(uid_t uid);
51369+
51370+DECLARE_BRLOCK(vfsmount_lock);
51371+
51372+__inline__ int
51373+gr_acl_is_enabled(void)
51374+{
51375+ return (gr_status & GR_READY);
51376+}
51377+
51378+#ifdef CONFIG_BTRFS_FS
51379+extern dev_t get_btrfs_dev_from_inode(struct inode *inode);
51380+extern int btrfs_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat);
51381+#endif
51382+
51383+static inline dev_t __get_dev(const struct dentry *dentry)
51384+{
51385+#ifdef CONFIG_BTRFS_FS
51386+ if (dentry->d_inode->i_op && dentry->d_inode->i_op->getattr == &btrfs_getattr)
51387+ return get_btrfs_dev_from_inode(dentry->d_inode);
51388+ else
51389+#endif
51390+ return dentry->d_inode->i_sb->s_dev;
51391+}
51392+
51393+dev_t gr_get_dev_from_dentry(struct dentry *dentry)
51394+{
51395+ return __get_dev(dentry);
51396+}
51397+
51398+static char gr_task_roletype_to_char(struct task_struct *task)
51399+{
51400+ switch (task->role->roletype &
51401+ (GR_ROLE_DEFAULT | GR_ROLE_USER | GR_ROLE_GROUP |
51402+ GR_ROLE_SPECIAL)) {
51403+ case GR_ROLE_DEFAULT:
51404+ return 'D';
51405+ case GR_ROLE_USER:
51406+ return 'U';
51407+ case GR_ROLE_GROUP:
51408+ return 'G';
51409+ case GR_ROLE_SPECIAL:
51410+ return 'S';
51411+ }
51412+
51413+ return 'X';
51414+}
51415+
51416+char gr_roletype_to_char(void)
51417+{
51418+ return gr_task_roletype_to_char(current);
51419+}
51420+
51421+__inline__ int
51422+gr_acl_tpe_check(void)
51423+{
51424+ if (unlikely(!(gr_status & GR_READY)))
51425+ return 0;
51426+ if (current->role->roletype & GR_ROLE_TPE)
51427+ return 1;
51428+ else
51429+ return 0;
51430+}
51431+
51432+int
51433+gr_handle_rawio(const struct inode *inode)
51434+{
51435+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
51436+ if (inode && S_ISBLK(inode->i_mode) &&
51437+ grsec_enable_chroot_caps && proc_is_chrooted(current) &&
51438+ !capable(CAP_SYS_RAWIO))
51439+ return 1;
51440+#endif
51441+ return 0;
51442+}
51443+
51444+static int
51445+gr_streq(const char *a, const char *b, const unsigned int lena, const unsigned int lenb)
51446+{
51447+ if (likely(lena != lenb))
51448+ return 0;
51449+
51450+ return !memcmp(a, b, lena);
51451+}
51452+
51453+static int prepend(char **buffer, int *buflen, const char *str, int namelen)
51454+{
51455+ *buflen -= namelen;
51456+ if (*buflen < 0)
51457+ return -ENAMETOOLONG;
51458+ *buffer -= namelen;
51459+ memcpy(*buffer, str, namelen);
51460+ return 0;
51461+}
51462+
51463+static int prepend_name(char **buffer, int *buflen, struct qstr *name)
51464+{
51465+ return prepend(buffer, buflen, name->name, name->len);
51466+}
51467+
51468+static int prepend_path(const struct path *path, struct path *root,
51469+ char **buffer, int *buflen)
51470+{
51471+ struct dentry *dentry = path->dentry;
51472+ struct vfsmount *vfsmnt = path->mnt;
51473+ bool slash = false;
51474+ int error = 0;
51475+
51476+ while (dentry != root->dentry || vfsmnt != root->mnt) {
51477+ struct dentry * parent;
51478+
51479+ if (dentry == vfsmnt->mnt_root || IS_ROOT(dentry)) {
51480+ /* Global root? */
51481+ if (vfsmnt->mnt_parent == vfsmnt) {
51482+ goto out;
51483+ }
51484+ dentry = vfsmnt->mnt_mountpoint;
51485+ vfsmnt = vfsmnt->mnt_parent;
51486+ continue;
51487+ }
51488+ parent = dentry->d_parent;
51489+ prefetch(parent);
51490+ spin_lock(&dentry->d_lock);
51491+ error = prepend_name(buffer, buflen, &dentry->d_name);
51492+ spin_unlock(&dentry->d_lock);
51493+ if (!error)
51494+ error = prepend(buffer, buflen, "/", 1);
51495+ if (error)
51496+ break;
51497+
51498+ slash = true;
51499+ dentry = parent;
51500+ }
51501+
51502+out:
51503+ if (!error && !slash)
51504+ error = prepend(buffer, buflen, "/", 1);
51505+
51506+ return error;
51507+}
51508+
51509+/* this must be called with vfsmount_lock and rename_lock held */
51510+
51511+static char *__our_d_path(const struct path *path, struct path *root,
51512+ char *buf, int buflen)
51513+{
51514+ char *res = buf + buflen;
51515+ int error;
51516+
51517+ prepend(&res, &buflen, "\0", 1);
51518+ error = prepend_path(path, root, &res, &buflen);
51519+ if (error)
51520+ return ERR_PTR(error);
51521+
51522+ return res;
51523+}
51524+
51525+static char *
51526+gen_full_path(struct path *path, struct path *root, char *buf, int buflen)
51527+{
51528+ char *retval;
51529+
51530+ retval = __our_d_path(path, root, buf, buflen);
51531+ if (unlikely(IS_ERR(retval)))
51532+ retval = strcpy(buf, "<path too long>");
51533+ else if (unlikely(retval[1] == '/' && retval[2] == '\0'))
51534+ retval[1] = '\0';
51535+
51536+ return retval;
51537+}
51538+
51539+static char *
51540+__d_real_path(const struct dentry *dentry, const struct vfsmount *vfsmnt,
51541+ char *buf, int buflen)
51542+{
51543+ struct path path;
51544+ char *res;
51545+
51546+ path.dentry = (struct dentry *)dentry;
51547+ path.mnt = (struct vfsmount *)vfsmnt;
51548+
51549+ /* we can use real_root.dentry, real_root.mnt, because this is only called
51550+ by the RBAC system */
51551+ res = gen_full_path(&path, &real_root, buf, buflen);
51552+
51553+ return res;
51554+}
51555+
51556+static char *
51557+d_real_path(const struct dentry *dentry, const struct vfsmount *vfsmnt,
51558+ char *buf, int buflen)
51559+{
51560+ char *res;
51561+ struct path path;
51562+ struct path root;
51563+ struct task_struct *reaper = &init_task;
51564+
51565+ path.dentry = (struct dentry *)dentry;
51566+ path.mnt = (struct vfsmount *)vfsmnt;
51567+
51568+ /* we can't use real_root.dentry, real_root.mnt, because they belong only to the RBAC system */
51569+ get_fs_root(reaper->fs, &root);
51570+
51571+ write_seqlock(&rename_lock);
51572+ br_read_lock(vfsmount_lock);
51573+ res = gen_full_path(&path, &root, buf, buflen);
51574+ br_read_unlock(vfsmount_lock);
51575+ write_sequnlock(&rename_lock);
51576+
51577+ path_put(&root);
51578+ return res;
51579+}
51580+
51581+static char *
51582+gr_to_filename_rbac(const struct dentry *dentry, const struct vfsmount *mnt)
51583+{
51584+ char *ret;
51585+ write_seqlock(&rename_lock);
51586+ br_read_lock(vfsmount_lock);
51587+ ret = __d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0],smp_processor_id()),
51588+ PAGE_SIZE);
51589+ br_read_unlock(vfsmount_lock);
51590+ write_sequnlock(&rename_lock);
51591+ return ret;
51592+}
51593+
51594+char *
51595+gr_to_filename_nolock(const struct dentry *dentry, const struct vfsmount *mnt)
51596+{
51597+ return __d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0],smp_processor_id()),
51598+ PAGE_SIZE);
51599+}
51600+
51601+char *
51602+gr_to_filename(const struct dentry *dentry, const struct vfsmount *mnt)
51603+{
51604+ return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0], smp_processor_id()),
51605+ PAGE_SIZE);
51606+}
51607+
51608+char *
51609+gr_to_filename1(const struct dentry *dentry, const struct vfsmount *mnt)
51610+{
51611+ return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[1], smp_processor_id()),
51612+ PAGE_SIZE);
51613+}
51614+
51615+char *
51616+gr_to_filename2(const struct dentry *dentry, const struct vfsmount *mnt)
51617+{
51618+ return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[2], smp_processor_id()),
51619+ PAGE_SIZE);
51620+}
51621+
51622+char *
51623+gr_to_filename3(const struct dentry *dentry, const struct vfsmount *mnt)
51624+{
51625+ return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[3], smp_processor_id()),
51626+ PAGE_SIZE);
51627+}
51628+
51629+__inline__ __u32
51630+to_gr_audit(const __u32 reqmode)
51631+{
51632+ /* masks off auditable permission flags, then shifts them to create
51633+ auditing flags, and adds the special case of append auditing if
51634+ we're requesting write */
51635+ return (((reqmode & ~GR_AUDITS) << 10) | ((reqmode & GR_WRITE) ? GR_AUDIT_APPEND : 0));
51636+}
51637+
51638+struct acl_subject_label *
51639+lookup_subject_map(const struct acl_subject_label *userp)
51640+{
51641+ unsigned int index = shash(userp, subj_map_set.s_size);
51642+ struct subject_map *match;
51643+
51644+ match = subj_map_set.s_hash[index];
51645+
51646+ while (match && match->user != userp)
51647+ match = match->next;
51648+
51649+ if (match != NULL)
51650+ return match->kernel;
51651+ else
51652+ return NULL;
51653+}
51654+
51655+static void
51656+insert_subj_map_entry(struct subject_map *subjmap)
51657+{
51658+ unsigned int index = shash(subjmap->user, subj_map_set.s_size);
51659+ struct subject_map **curr;
51660+
51661+ subjmap->prev = NULL;
51662+
51663+ curr = &subj_map_set.s_hash[index];
51664+ if (*curr != NULL)
51665+ (*curr)->prev = subjmap;
51666+
51667+ subjmap->next = *curr;
51668+ *curr = subjmap;
51669+
51670+ return;
51671+}
51672+
51673+static struct acl_role_label *
51674+lookup_acl_role_label(const struct task_struct *task, const uid_t uid,
51675+ const gid_t gid)
51676+{
51677+ unsigned int index = rhash(uid, GR_ROLE_USER, acl_role_set.r_size);
51678+ struct acl_role_label *match;
51679+ struct role_allowed_ip *ipp;
51680+ unsigned int x;
51681+ u32 curr_ip = task->signal->curr_ip;
51682+
51683+ task->signal->saved_ip = curr_ip;
51684+
51685+ match = acl_role_set.r_hash[index];
51686+
51687+ while (match) {
51688+ if ((match->roletype & (GR_ROLE_DOMAIN | GR_ROLE_USER)) == (GR_ROLE_DOMAIN | GR_ROLE_USER)) {
51689+ for (x = 0; x < match->domain_child_num; x++) {
51690+ if (match->domain_children[x] == uid)
51691+ goto found;
51692+ }
51693+ } else if (match->uidgid == uid && match->roletype & GR_ROLE_USER)
51694+ break;
51695+ match = match->next;
51696+ }
51697+found:
51698+ if (match == NULL) {
51699+ try_group:
51700+ index = rhash(gid, GR_ROLE_GROUP, acl_role_set.r_size);
51701+ match = acl_role_set.r_hash[index];
51702+
51703+ while (match) {
51704+ if ((match->roletype & (GR_ROLE_DOMAIN | GR_ROLE_GROUP)) == (GR_ROLE_DOMAIN | GR_ROLE_GROUP)) {
51705+ for (x = 0; x < match->domain_child_num; x++) {
51706+ if (match->domain_children[x] == gid)
51707+ goto found2;
51708+ }
51709+ } else if (match->uidgid == gid && match->roletype & GR_ROLE_GROUP)
51710+ break;
51711+ match = match->next;
51712+ }
51713+found2:
51714+ if (match == NULL)
51715+ match = default_role;
51716+ if (match->allowed_ips == NULL)
51717+ return match;
51718+ else {
51719+ for (ipp = match->allowed_ips; ipp; ipp = ipp->next) {
51720+ if (likely
51721+ ((ntohl(curr_ip) & ipp->netmask) ==
51722+ (ntohl(ipp->addr) & ipp->netmask)))
51723+ return match;
51724+ }
51725+ match = default_role;
51726+ }
51727+ } else if (match->allowed_ips == NULL) {
51728+ return match;
51729+ } else {
51730+ for (ipp = match->allowed_ips; ipp; ipp = ipp->next) {
51731+ if (likely
51732+ ((ntohl(curr_ip) & ipp->netmask) ==
51733+ (ntohl(ipp->addr) & ipp->netmask)))
51734+ return match;
51735+ }
51736+ goto try_group;
51737+ }
51738+
51739+ return match;
51740+}
51741+
51742+struct acl_subject_label *
51743+lookup_acl_subj_label(const ino_t ino, const dev_t dev,
51744+ const struct acl_role_label *role)
51745+{
51746+ unsigned int index = fhash(ino, dev, role->subj_hash_size);
51747+ struct acl_subject_label *match;
51748+
51749+ match = role->subj_hash[index];
51750+
51751+ while (match && (match->inode != ino || match->device != dev ||
51752+ (match->mode & GR_DELETED))) {
51753+ match = match->next;
51754+ }
51755+
51756+ if (match && !(match->mode & GR_DELETED))
51757+ return match;
51758+ else
51759+ return NULL;
51760+}
51761+
51762+struct acl_subject_label *
51763+lookup_acl_subj_label_deleted(const ino_t ino, const dev_t dev,
51764+ const struct acl_role_label *role)
51765+{
51766+ unsigned int index = fhash(ino, dev, role->subj_hash_size);
51767+ struct acl_subject_label *match;
51768+
51769+ match = role->subj_hash[index];
51770+
51771+ while (match && (match->inode != ino || match->device != dev ||
51772+ !(match->mode & GR_DELETED))) {
51773+ match = match->next;
51774+ }
51775+
51776+ if (match && (match->mode & GR_DELETED))
51777+ return match;
51778+ else
51779+ return NULL;
51780+}
51781+
51782+static struct acl_object_label *
51783+lookup_acl_obj_label(const ino_t ino, const dev_t dev,
51784+ const struct acl_subject_label *subj)
51785+{
51786+ unsigned int index = fhash(ino, dev, subj->obj_hash_size);
51787+ struct acl_object_label *match;
51788+
51789+ match = subj->obj_hash[index];
51790+
51791+ while (match && (match->inode != ino || match->device != dev ||
51792+ (match->mode & GR_DELETED))) {
51793+ match = match->next;
51794+ }
51795+
51796+ if (match && !(match->mode & GR_DELETED))
51797+ return match;
51798+ else
51799+ return NULL;
51800+}
51801+
51802+static struct acl_object_label *
51803+lookup_acl_obj_label_create(const ino_t ino, const dev_t dev,
51804+ const struct acl_subject_label *subj)
51805+{
51806+ unsigned int index = fhash(ino, dev, subj->obj_hash_size);
51807+ struct acl_object_label *match;
51808+
51809+ match = subj->obj_hash[index];
51810+
51811+ while (match && (match->inode != ino || match->device != dev ||
51812+ !(match->mode & GR_DELETED))) {
51813+ match = match->next;
51814+ }
51815+
51816+ if (match && (match->mode & GR_DELETED))
51817+ return match;
51818+
51819+ match = subj->obj_hash[index];
51820+
51821+ while (match && (match->inode != ino || match->device != dev ||
51822+ (match->mode & GR_DELETED))) {
51823+ match = match->next;
51824+ }
51825+
51826+ if (match && !(match->mode & GR_DELETED))
51827+ return match;
51828+ else
51829+ return NULL;
51830+}
51831+
51832+static struct name_entry *
51833+lookup_name_entry(const char *name)
51834+{
51835+ unsigned int len = strlen(name);
51836+ unsigned int key = full_name_hash(name, len);
51837+ unsigned int index = key % name_set.n_size;
51838+ struct name_entry *match;
51839+
51840+ match = name_set.n_hash[index];
51841+
51842+ while (match && (match->key != key || !gr_streq(match->name, name, match->len, len)))
51843+ match = match->next;
51844+
51845+ return match;
51846+}
51847+
51848+static struct name_entry *
51849+lookup_name_entry_create(const char *name)
51850+{
51851+ unsigned int len = strlen(name);
51852+ unsigned int key = full_name_hash(name, len);
51853+ unsigned int index = key % name_set.n_size;
51854+ struct name_entry *match;
51855+
51856+ match = name_set.n_hash[index];
51857+
51858+ while (match && (match->key != key || !gr_streq(match->name, name, match->len, len) ||
51859+ !match->deleted))
51860+ match = match->next;
51861+
51862+ if (match && match->deleted)
51863+ return match;
51864+
51865+ match = name_set.n_hash[index];
51866+
51867+ while (match && (match->key != key || !gr_streq(match->name, name, match->len, len) ||
51868+ match->deleted))
51869+ match = match->next;
51870+
51871+ if (match && !match->deleted)
51872+ return match;
51873+ else
51874+ return NULL;
51875+}
51876+
51877+static struct inodev_entry *
51878+lookup_inodev_entry(const ino_t ino, const dev_t dev)
51879+{
51880+ unsigned int index = fhash(ino, dev, inodev_set.i_size);
51881+ struct inodev_entry *match;
51882+
51883+ match = inodev_set.i_hash[index];
51884+
51885+ while (match && (match->nentry->inode != ino || match->nentry->device != dev))
51886+ match = match->next;
51887+
51888+ return match;
51889+}
51890+
51891+static void
51892+insert_inodev_entry(struct inodev_entry *entry)
51893+{
51894+ unsigned int index = fhash(entry->nentry->inode, entry->nentry->device,
51895+ inodev_set.i_size);
51896+ struct inodev_entry **curr;
51897+
51898+ entry->prev = NULL;
51899+
51900+ curr = &inodev_set.i_hash[index];
51901+ if (*curr != NULL)
51902+ (*curr)->prev = entry;
51903+
51904+ entry->next = *curr;
51905+ *curr = entry;
51906+
51907+ return;
51908+}
51909+
51910+static void
51911+__insert_acl_role_label(struct acl_role_label *role, uid_t uidgid)
51912+{
51913+ unsigned int index =
51914+ rhash(uidgid, role->roletype & (GR_ROLE_USER | GR_ROLE_GROUP), acl_role_set.r_size);
51915+ struct acl_role_label **curr;
51916+ struct acl_role_label *tmp;
51917+
51918+ curr = &acl_role_set.r_hash[index];
51919+
51920+ /* if role was already inserted due to domains and already has
51921+ a role in the same bucket as it attached, then we need to
51922+ combine these two buckets
51923+ */
51924+ if (role->next) {
51925+ tmp = role->next;
51926+ while (tmp->next)
51927+ tmp = tmp->next;
51928+ tmp->next = *curr;
51929+ } else
51930+ role->next = *curr;
51931+ *curr = role;
51932+
51933+ return;
51934+}
51935+
51936+static void
51937+insert_acl_role_label(struct acl_role_label *role)
51938+{
51939+ int i;
51940+
51941+ if (role_list == NULL) {
51942+ role_list = role;
51943+ role->prev = NULL;
51944+ } else {
51945+ role->prev = role_list;
51946+ role_list = role;
51947+ }
51948+
51949+ /* used for hash chains */
51950+ role->next = NULL;
51951+
51952+ if (role->roletype & GR_ROLE_DOMAIN) {
51953+ for (i = 0; i < role->domain_child_num; i++)
51954+ __insert_acl_role_label(role, role->domain_children[i]);
51955+ } else
51956+ __insert_acl_role_label(role, role->uidgid);
51957+}
51958+
51959+static int
51960+insert_name_entry(char *name, const ino_t inode, const dev_t device, __u8 deleted)
51961+{
51962+ struct name_entry **curr, *nentry;
51963+ struct inodev_entry *ientry;
51964+ unsigned int len = strlen(name);
51965+ unsigned int key = full_name_hash(name, len);
51966+ unsigned int index = key % name_set.n_size;
51967+
51968+ curr = &name_set.n_hash[index];
51969+
51970+ while (*curr && ((*curr)->key != key || !gr_streq((*curr)->name, name, (*curr)->len, len)))
51971+ curr = &((*curr)->next);
51972+
51973+ if (*curr != NULL)
51974+ return 1;
51975+
51976+ nentry = acl_alloc(sizeof (struct name_entry));
51977+ if (nentry == NULL)
51978+ return 0;
51979+ ientry = acl_alloc(sizeof (struct inodev_entry));
51980+ if (ientry == NULL)
51981+ return 0;
51982+ ientry->nentry = nentry;
51983+
51984+ nentry->key = key;
51985+ nentry->name = name;
51986+ nentry->inode = inode;
51987+ nentry->device = device;
51988+ nentry->len = len;
51989+ nentry->deleted = deleted;
51990+
51991+ nentry->prev = NULL;
51992+ curr = &name_set.n_hash[index];
51993+ if (*curr != NULL)
51994+ (*curr)->prev = nentry;
51995+ nentry->next = *curr;
51996+ *curr = nentry;
51997+
51998+ /* insert us into the table searchable by inode/dev */
51999+ insert_inodev_entry(ientry);
52000+
52001+ return 1;
52002+}
52003+
52004+static void
52005+insert_acl_obj_label(struct acl_object_label *obj,
52006+ struct acl_subject_label *subj)
52007+{
52008+ unsigned int index =
52009+ fhash(obj->inode, obj->device, subj->obj_hash_size);
52010+ struct acl_object_label **curr;
52011+
52012+
52013+ obj->prev = NULL;
52014+
52015+ curr = &subj->obj_hash[index];
52016+ if (*curr != NULL)
52017+ (*curr)->prev = obj;
52018+
52019+ obj->next = *curr;
52020+ *curr = obj;
52021+
52022+ return;
52023+}
52024+
52025+static void
52026+insert_acl_subj_label(struct acl_subject_label *obj,
52027+ struct acl_role_label *role)
52028+{
52029+ unsigned int index = fhash(obj->inode, obj->device, role->subj_hash_size);
52030+ struct acl_subject_label **curr;
52031+
52032+ obj->prev = NULL;
52033+
52034+ curr = &role->subj_hash[index];
52035+ if (*curr != NULL)
52036+ (*curr)->prev = obj;
52037+
52038+ obj->next = *curr;
52039+ *curr = obj;
52040+
52041+ return;
52042+}
52043+
52044+/* allocating chained hash tables, so optimal size is where lambda ~ 1 */
52045+
52046+static void *
52047+create_table(__u32 * len, int elementsize)
52048+{
52049+ unsigned int table_sizes[] = {
52050+ 7, 13, 31, 61, 127, 251, 509, 1021, 2039, 4093, 8191, 16381,
52051+ 32749, 65521, 131071, 262139, 524287, 1048573, 2097143,
52052+ 4194301, 8388593, 16777213, 33554393, 67108859
52053+ };
52054+ void *newtable = NULL;
52055+ unsigned int pwr = 0;
52056+
52057+ while ((pwr < ((sizeof (table_sizes) / sizeof (table_sizes[0])) - 1)) &&
52058+ table_sizes[pwr] <= *len)
52059+ pwr++;
52060+
52061+ if (table_sizes[pwr] <= *len || (table_sizes[pwr] > ULONG_MAX / elementsize))
52062+ return newtable;
52063+
52064+ if ((table_sizes[pwr] * elementsize) <= PAGE_SIZE)
52065+ newtable =
52066+ kmalloc(table_sizes[pwr] * elementsize, GFP_KERNEL);
52067+ else
52068+ newtable = vmalloc(table_sizes[pwr] * elementsize);
52069+
52070+ *len = table_sizes[pwr];
52071+
52072+ return newtable;
52073+}
52074+
52075+static int
52076+init_variables(const struct gr_arg *arg)
52077+{
52078+ struct task_struct *reaper = &init_task;
52079+ unsigned int stacksize;
52080+
52081+ subj_map_set.s_size = arg->role_db.num_subjects;
52082+ acl_role_set.r_size = arg->role_db.num_roles + arg->role_db.num_domain_children;
52083+ name_set.n_size = arg->role_db.num_objects;
52084+ inodev_set.i_size = arg->role_db.num_objects;
52085+
52086+ if (!subj_map_set.s_size || !acl_role_set.r_size ||
52087+ !name_set.n_size || !inodev_set.i_size)
52088+ return 1;
52089+
52090+ if (!gr_init_uidset())
52091+ return 1;
52092+
52093+ /* set up the stack that holds allocation info */
52094+
52095+ stacksize = arg->role_db.num_pointers + 5;
52096+
52097+ if (!acl_alloc_stack_init(stacksize))
52098+ return 1;
52099+
52100+ /* grab reference for the real root dentry and vfsmount */
52101+ get_fs_root(reaper->fs, &real_root);
52102+
52103+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
52104+ printk(KERN_ALERT "Obtained real root device=%d, inode=%lu\n", __get_dev(real_root.dentry), real_root.dentry->d_inode->i_ino);
52105+#endif
52106+
52107+ fakefs_obj = acl_alloc(sizeof(struct acl_object_label));
52108+ if (fakefs_obj == NULL)
52109+ return 1;
52110+ fakefs_obj->mode = GR_FIND | GR_READ | GR_WRITE | GR_EXEC;
52111+
52112+ subj_map_set.s_hash =
52113+ (struct subject_map **) create_table(&subj_map_set.s_size, sizeof(void *));
52114+ acl_role_set.r_hash =
52115+ (struct acl_role_label **) create_table(&acl_role_set.r_size, sizeof(void *));
52116+ name_set.n_hash = (struct name_entry **) create_table(&name_set.n_size, sizeof(void *));
52117+ inodev_set.i_hash =
52118+ (struct inodev_entry **) create_table(&inodev_set.i_size, sizeof(void *));
52119+
52120+ if (!subj_map_set.s_hash || !acl_role_set.r_hash ||
52121+ !name_set.n_hash || !inodev_set.i_hash)
52122+ return 1;
52123+
52124+ memset(subj_map_set.s_hash, 0,
52125+ sizeof(struct subject_map *) * subj_map_set.s_size);
52126+ memset(acl_role_set.r_hash, 0,
52127+ sizeof (struct acl_role_label *) * acl_role_set.r_size);
52128+ memset(name_set.n_hash, 0,
52129+ sizeof (struct name_entry *) * name_set.n_size);
52130+ memset(inodev_set.i_hash, 0,
52131+ sizeof (struct inodev_entry *) * inodev_set.i_size);
52132+
52133+ return 0;
52134+}
52135+
52136+/* free information not needed after startup
52137+ currently contains user->kernel pointer mappings for subjects
52138+*/
52139+
52140+static void
52141+free_init_variables(void)
52142+{
52143+ __u32 i;
52144+
52145+ if (subj_map_set.s_hash) {
52146+ for (i = 0; i < subj_map_set.s_size; i++) {
52147+ if (subj_map_set.s_hash[i]) {
52148+ kfree(subj_map_set.s_hash[i]);
52149+ subj_map_set.s_hash[i] = NULL;
52150+ }
52151+ }
52152+
52153+ if ((subj_map_set.s_size * sizeof (struct subject_map *)) <=
52154+ PAGE_SIZE)
52155+ kfree(subj_map_set.s_hash);
52156+ else
52157+ vfree(subj_map_set.s_hash);
52158+ }
52159+
52160+ return;
52161+}
52162+
52163+static void
52164+free_variables(void)
52165+{
52166+ struct acl_subject_label *s;
52167+ struct acl_role_label *r;
52168+ struct task_struct *task, *task2;
52169+ unsigned int x;
52170+
52171+ gr_clear_learn_entries();
52172+
52173+ read_lock(&tasklist_lock);
52174+ do_each_thread(task2, task) {
52175+ task->acl_sp_role = 0;
52176+ task->acl_role_id = 0;
52177+ task->acl = NULL;
52178+ task->role = NULL;
52179+ } while_each_thread(task2, task);
52180+ read_unlock(&tasklist_lock);
52181+
52182+ /* release the reference to the real root dentry and vfsmount */
52183+ path_put(&real_root);
52184+
52185+ /* free all object hash tables */
52186+
52187+ FOR_EACH_ROLE_START(r)
52188+ if (r->subj_hash == NULL)
52189+ goto next_role;
52190+ FOR_EACH_SUBJECT_START(r, s, x)
52191+ if (s->obj_hash == NULL)
52192+ break;
52193+ if ((s->obj_hash_size * sizeof (struct acl_object_label *)) <= PAGE_SIZE)
52194+ kfree(s->obj_hash);
52195+ else
52196+ vfree(s->obj_hash);
52197+ FOR_EACH_SUBJECT_END(s, x)
52198+ FOR_EACH_NESTED_SUBJECT_START(r, s)
52199+ if (s->obj_hash == NULL)
52200+ break;
52201+ if ((s->obj_hash_size * sizeof (struct acl_object_label *)) <= PAGE_SIZE)
52202+ kfree(s->obj_hash);
52203+ else
52204+ vfree(s->obj_hash);
52205+ FOR_EACH_NESTED_SUBJECT_END(s)
52206+ if ((r->subj_hash_size * sizeof (struct acl_subject_label *)) <= PAGE_SIZE)
52207+ kfree(r->subj_hash);
52208+ else
52209+ vfree(r->subj_hash);
52210+ r->subj_hash = NULL;
52211+next_role:
52212+ FOR_EACH_ROLE_END(r)
52213+
52214+ acl_free_all();
52215+
52216+ if (acl_role_set.r_hash) {
52217+ if ((acl_role_set.r_size * sizeof (struct acl_role_label *)) <=
52218+ PAGE_SIZE)
52219+ kfree(acl_role_set.r_hash);
52220+ else
52221+ vfree(acl_role_set.r_hash);
52222+ }
52223+ if (name_set.n_hash) {
52224+ if ((name_set.n_size * sizeof (struct name_entry *)) <=
52225+ PAGE_SIZE)
52226+ kfree(name_set.n_hash);
52227+ else
52228+ vfree(name_set.n_hash);
52229+ }
52230+
52231+ if (inodev_set.i_hash) {
52232+ if ((inodev_set.i_size * sizeof (struct inodev_entry *)) <=
52233+ PAGE_SIZE)
52234+ kfree(inodev_set.i_hash);
52235+ else
52236+ vfree(inodev_set.i_hash);
52237+ }
52238+
52239+ gr_free_uidset();
52240+
52241+ memset(&name_set, 0, sizeof (struct name_db));
52242+ memset(&inodev_set, 0, sizeof (struct inodev_db));
52243+ memset(&acl_role_set, 0, sizeof (struct acl_role_db));
52244+ memset(&subj_map_set, 0, sizeof (struct acl_subj_map_db));
52245+
52246+ default_role = NULL;
52247+ role_list = NULL;
52248+
52249+ return;
52250+}
52251+
52252+static __u32
52253+count_user_objs(struct acl_object_label *userp)
52254+{
52255+ struct acl_object_label o_tmp;
52256+ __u32 num = 0;
52257+
52258+ while (userp) {
52259+ if (copy_from_user(&o_tmp, userp,
52260+ sizeof (struct acl_object_label)))
52261+ break;
52262+
52263+ userp = o_tmp.prev;
52264+ num++;
52265+ }
52266+
52267+ return num;
52268+}
52269+
52270+static struct acl_subject_label *
52271+do_copy_user_subj(struct acl_subject_label *userp, struct acl_role_label *role);
52272+
52273+static int
52274+copy_user_glob(struct acl_object_label *obj)
52275+{
52276+ struct acl_object_label *g_tmp, **guser;
52277+ unsigned int len;
52278+ char *tmp;
52279+
52280+ if (obj->globbed == NULL)
52281+ return 0;
52282+
52283+ guser = &obj->globbed;
52284+ while (*guser) {
52285+ g_tmp = (struct acl_object_label *)
52286+ acl_alloc(sizeof (struct acl_object_label));
52287+ if (g_tmp == NULL)
52288+ return -ENOMEM;
52289+
52290+ if (copy_from_user(g_tmp, *guser,
52291+ sizeof (struct acl_object_label)))
52292+ return -EFAULT;
52293+
52294+ len = strnlen_user(g_tmp->filename, PATH_MAX);
52295+
52296+ if (!len || len >= PATH_MAX)
52297+ return -EINVAL;
52298+
52299+ if ((tmp = (char *) acl_alloc(len)) == NULL)
52300+ return -ENOMEM;
52301+
52302+ if (copy_from_user(tmp, g_tmp->filename, len))
52303+ return -EFAULT;
52304+ tmp[len-1] = '\0';
52305+ g_tmp->filename = tmp;
52306+
52307+ *guser = g_tmp;
52308+ guser = &(g_tmp->next);
52309+ }
52310+
52311+ return 0;
52312+}
52313+
52314+static int
52315+copy_user_objs(struct acl_object_label *userp, struct acl_subject_label *subj,
52316+ struct acl_role_label *role)
52317+{
52318+ struct acl_object_label *o_tmp;
52319+ unsigned int len;
52320+ int ret;
52321+ char *tmp;
52322+
52323+ while (userp) {
52324+ if ((o_tmp = (struct acl_object_label *)
52325+ acl_alloc(sizeof (struct acl_object_label))) == NULL)
52326+ return -ENOMEM;
52327+
52328+ if (copy_from_user(o_tmp, userp,
52329+ sizeof (struct acl_object_label)))
52330+ return -EFAULT;
52331+
52332+ userp = o_tmp->prev;
52333+
52334+ len = strnlen_user(o_tmp->filename, PATH_MAX);
52335+
52336+ if (!len || len >= PATH_MAX)
52337+ return -EINVAL;
52338+
52339+ if ((tmp = (char *) acl_alloc(len)) == NULL)
52340+ return -ENOMEM;
52341+
52342+ if (copy_from_user(tmp, o_tmp->filename, len))
52343+ return -EFAULT;
52344+ tmp[len-1] = '\0';
52345+ o_tmp->filename = tmp;
52346+
52347+ insert_acl_obj_label(o_tmp, subj);
52348+ if (!insert_name_entry(o_tmp->filename, o_tmp->inode,
52349+ o_tmp->device, (o_tmp->mode & GR_DELETED) ? 1 : 0))
52350+ return -ENOMEM;
52351+
52352+ ret = copy_user_glob(o_tmp);
52353+ if (ret)
52354+ return ret;
52355+
52356+ if (o_tmp->nested) {
52357+ o_tmp->nested = do_copy_user_subj(o_tmp->nested, role);
52358+ if (IS_ERR(o_tmp->nested))
52359+ return PTR_ERR(o_tmp->nested);
52360+
52361+ /* insert into nested subject list */
52362+ o_tmp->nested->next = role->hash->first;
52363+ role->hash->first = o_tmp->nested;
52364+ }
52365+ }
52366+
52367+ return 0;
52368+}
52369+
52370+static __u32
52371+count_user_subjs(struct acl_subject_label *userp)
52372+{
52373+ struct acl_subject_label s_tmp;
52374+ __u32 num = 0;
52375+
52376+ while (userp) {
52377+ if (copy_from_user(&s_tmp, userp,
52378+ sizeof (struct acl_subject_label)))
52379+ break;
52380+
52381+ userp = s_tmp.prev;
52382+ /* do not count nested subjects against this count, since
52383+ they are not included in the hash table, but are
52384+ attached to objects. We have already counted
52385+ the subjects in userspace for the allocation
52386+ stack
52387+ */
52388+ if (!(s_tmp.mode & GR_NESTED))
52389+ num++;
52390+ }
52391+
52392+ return num;
52393+}
52394+
52395+static int
52396+copy_user_allowedips(struct acl_role_label *rolep)
52397+{
52398+ struct role_allowed_ip *ruserip, *rtmp = NULL, *rlast;
52399+
52400+ ruserip = rolep->allowed_ips;
52401+
52402+ while (ruserip) {
52403+ rlast = rtmp;
52404+
52405+ if ((rtmp = (struct role_allowed_ip *)
52406+ acl_alloc(sizeof (struct role_allowed_ip))) == NULL)
52407+ return -ENOMEM;
52408+
52409+ if (copy_from_user(rtmp, ruserip,
52410+ sizeof (struct role_allowed_ip)))
52411+ return -EFAULT;
52412+
52413+ ruserip = rtmp->prev;
52414+
52415+ if (!rlast) {
52416+ rtmp->prev = NULL;
52417+ rolep->allowed_ips = rtmp;
52418+ } else {
52419+ rlast->next = rtmp;
52420+ rtmp->prev = rlast;
52421+ }
52422+
52423+ if (!ruserip)
52424+ rtmp->next = NULL;
52425+ }
52426+
52427+ return 0;
52428+}
52429+
52430+static int
52431+copy_user_transitions(struct acl_role_label *rolep)
52432+{
52433+ struct role_transition *rusertp, *rtmp = NULL, *rlast;
52434+
52435+ unsigned int len;
52436+ char *tmp;
52437+
52438+ rusertp = rolep->transitions;
52439+
52440+ while (rusertp) {
52441+ rlast = rtmp;
52442+
52443+ if ((rtmp = (struct role_transition *)
52444+ acl_alloc(sizeof (struct role_transition))) == NULL)
52445+ return -ENOMEM;
52446+
52447+ if (copy_from_user(rtmp, rusertp,
52448+ sizeof (struct role_transition)))
52449+ return -EFAULT;
52450+
52451+ rusertp = rtmp->prev;
52452+
52453+ len = strnlen_user(rtmp->rolename, GR_SPROLE_LEN);
52454+
52455+ if (!len || len >= GR_SPROLE_LEN)
52456+ return -EINVAL;
52457+
52458+ if ((tmp = (char *) acl_alloc(len)) == NULL)
52459+ return -ENOMEM;
52460+
52461+ if (copy_from_user(tmp, rtmp->rolename, len))
52462+ return -EFAULT;
52463+ tmp[len-1] = '\0';
52464+ rtmp->rolename = tmp;
52465+
52466+ if (!rlast) {
52467+ rtmp->prev = NULL;
52468+ rolep->transitions = rtmp;
52469+ } else {
52470+ rlast->next = rtmp;
52471+ rtmp->prev = rlast;
52472+ }
52473+
52474+ if (!rusertp)
52475+ rtmp->next = NULL;
52476+ }
52477+
52478+ return 0;
52479+}
52480+
52481+static struct acl_subject_label *
52482+do_copy_user_subj(struct acl_subject_label *userp, struct acl_role_label *role)
52483+{
52484+ struct acl_subject_label *s_tmp = NULL, *s_tmp2;
52485+ unsigned int len;
52486+ char *tmp;
52487+ __u32 num_objs;
52488+ struct acl_ip_label **i_tmp, *i_utmp2;
52489+ struct gr_hash_struct ghash;
52490+ struct subject_map *subjmap;
52491+ unsigned int i_num;
52492+ int err;
52493+
52494+ s_tmp = lookup_subject_map(userp);
52495+
52496+ /* we've already copied this subject into the kernel, just return
52497+ the reference to it, and don't copy it over again
52498+ */
52499+ if (s_tmp)
52500+ return(s_tmp);
52501+
52502+ if ((s_tmp = (struct acl_subject_label *)
52503+ acl_alloc(sizeof (struct acl_subject_label))) == NULL)
52504+ return ERR_PTR(-ENOMEM);
52505+
52506+ subjmap = (struct subject_map *)kmalloc(sizeof (struct subject_map), GFP_KERNEL);
52507+ if (subjmap == NULL)
52508+ return ERR_PTR(-ENOMEM);
52509+
52510+ subjmap->user = userp;
52511+ subjmap->kernel = s_tmp;
52512+ insert_subj_map_entry(subjmap);
52513+
52514+ if (copy_from_user(s_tmp, userp,
52515+ sizeof (struct acl_subject_label)))
52516+ return ERR_PTR(-EFAULT);
52517+
52518+ len = strnlen_user(s_tmp->filename, PATH_MAX);
52519+
52520+ if (!len || len >= PATH_MAX)
52521+ return ERR_PTR(-EINVAL);
52522+
52523+ if ((tmp = (char *) acl_alloc(len)) == NULL)
52524+ return ERR_PTR(-ENOMEM);
52525+
52526+ if (copy_from_user(tmp, s_tmp->filename, len))
52527+ return ERR_PTR(-EFAULT);
52528+ tmp[len-1] = '\0';
52529+ s_tmp->filename = tmp;
52530+
52531+ if (!strcmp(s_tmp->filename, "/"))
52532+ role->root_label = s_tmp;
52533+
52534+ if (copy_from_user(&ghash, s_tmp->hash, sizeof(struct gr_hash_struct)))
52535+ return ERR_PTR(-EFAULT);
52536+
52537+ /* copy user and group transition tables */
52538+
52539+ if (s_tmp->user_trans_num) {
52540+ uid_t *uidlist;
52541+
52542+ uidlist = (uid_t *)acl_alloc_num(s_tmp->user_trans_num, sizeof(uid_t));
52543+ if (uidlist == NULL)
52544+ return ERR_PTR(-ENOMEM);
52545+ if (copy_from_user(uidlist, s_tmp->user_transitions, s_tmp->user_trans_num * sizeof(uid_t)))
52546+ return ERR_PTR(-EFAULT);
52547+
52548+ s_tmp->user_transitions = uidlist;
52549+ }
52550+
52551+ if (s_tmp->group_trans_num) {
52552+ gid_t *gidlist;
52553+
52554+ gidlist = (gid_t *)acl_alloc_num(s_tmp->group_trans_num, sizeof(gid_t));
52555+ if (gidlist == NULL)
52556+ return ERR_PTR(-ENOMEM);
52557+ if (copy_from_user(gidlist, s_tmp->group_transitions, s_tmp->group_trans_num * sizeof(gid_t)))
52558+ return ERR_PTR(-EFAULT);
52559+
52560+ s_tmp->group_transitions = gidlist;
52561+ }
52562+
52563+ /* set up object hash table */
52564+ num_objs = count_user_objs(ghash.first);
52565+
52566+ s_tmp->obj_hash_size = num_objs;
52567+ s_tmp->obj_hash =
52568+ (struct acl_object_label **)
52569+ create_table(&(s_tmp->obj_hash_size), sizeof(void *));
52570+
52571+ if (!s_tmp->obj_hash)
52572+ return ERR_PTR(-ENOMEM);
52573+
52574+ memset(s_tmp->obj_hash, 0,
52575+ s_tmp->obj_hash_size *
52576+ sizeof (struct acl_object_label *));
52577+
52578+ /* add in objects */
52579+ err = copy_user_objs(ghash.first, s_tmp, role);
52580+
52581+ if (err)
52582+ return ERR_PTR(err);
52583+
52584+ /* set pointer for parent subject */
52585+ if (s_tmp->parent_subject) {
52586+ s_tmp2 = do_copy_user_subj(s_tmp->parent_subject, role);
52587+
52588+ if (IS_ERR(s_tmp2))
52589+ return s_tmp2;
52590+
52591+ s_tmp->parent_subject = s_tmp2;
52592+ }
52593+
52594+ /* add in ip acls */
52595+
52596+ if (!s_tmp->ip_num) {
52597+ s_tmp->ips = NULL;
52598+ goto insert;
52599+ }
52600+
52601+ i_tmp =
52602+ (struct acl_ip_label **) acl_alloc_num(s_tmp->ip_num,
52603+ sizeof (struct acl_ip_label *));
52604+
52605+ if (!i_tmp)
52606+ return ERR_PTR(-ENOMEM);
52607+
52608+ for (i_num = 0; i_num < s_tmp->ip_num; i_num++) {
52609+ *(i_tmp + i_num) =
52610+ (struct acl_ip_label *)
52611+ acl_alloc(sizeof (struct acl_ip_label));
52612+ if (!*(i_tmp + i_num))
52613+ return ERR_PTR(-ENOMEM);
52614+
52615+ if (copy_from_user
52616+ (&i_utmp2, s_tmp->ips + i_num,
52617+ sizeof (struct acl_ip_label *)))
52618+ return ERR_PTR(-EFAULT);
52619+
52620+ if (copy_from_user
52621+ (*(i_tmp + i_num), i_utmp2,
52622+ sizeof (struct acl_ip_label)))
52623+ return ERR_PTR(-EFAULT);
52624+
52625+ if ((*(i_tmp + i_num))->iface == NULL)
52626+ continue;
52627+
52628+ len = strnlen_user((*(i_tmp + i_num))->iface, IFNAMSIZ);
52629+ if (!len || len >= IFNAMSIZ)
52630+ return ERR_PTR(-EINVAL);
52631+ tmp = acl_alloc(len);
52632+ if (tmp == NULL)
52633+ return ERR_PTR(-ENOMEM);
52634+ if (copy_from_user(tmp, (*(i_tmp + i_num))->iface, len))
52635+ return ERR_PTR(-EFAULT);
52636+ (*(i_tmp + i_num))->iface = tmp;
52637+ }
52638+
52639+ s_tmp->ips = i_tmp;
52640+
52641+insert:
52642+ if (!insert_name_entry(s_tmp->filename, s_tmp->inode,
52643+ s_tmp->device, (s_tmp->mode & GR_DELETED) ? 1 : 0))
52644+ return ERR_PTR(-ENOMEM);
52645+
52646+ return s_tmp;
52647+}
52648+
52649+static int
52650+copy_user_subjs(struct acl_subject_label *userp, struct acl_role_label *role)
52651+{
52652+ struct acl_subject_label s_pre;
52653+ struct acl_subject_label * ret;
52654+ int err;
52655+
52656+ while (userp) {
52657+ if (copy_from_user(&s_pre, userp,
52658+ sizeof (struct acl_subject_label)))
52659+ return -EFAULT;
52660+
52661+ /* do not add nested subjects here, add
52662+ while parsing objects
52663+ */
52664+
52665+ if (s_pre.mode & GR_NESTED) {
52666+ userp = s_pre.prev;
52667+ continue;
52668+ }
52669+
52670+ ret = do_copy_user_subj(userp, role);
52671+
52672+ err = PTR_ERR(ret);
52673+ if (IS_ERR(ret))
52674+ return err;
52675+
52676+ insert_acl_subj_label(ret, role);
52677+
52678+ userp = s_pre.prev;
52679+ }
52680+
52681+ return 0;
52682+}
52683+
52684+static int
52685+copy_user_acl(struct gr_arg *arg)
52686+{
52687+ struct acl_role_label *r_tmp = NULL, **r_utmp, *r_utmp2;
52688+ struct sprole_pw *sptmp;
52689+ struct gr_hash_struct *ghash;
52690+ uid_t *domainlist;
52691+ unsigned int r_num;
52692+ unsigned int len;
52693+ char *tmp;
52694+ int err = 0;
52695+ __u16 i;
52696+ __u32 num_subjs;
52697+
52698+ /* we need a default and kernel role */
52699+ if (arg->role_db.num_roles < 2)
52700+ return -EINVAL;
52701+
52702+ /* copy special role authentication info from userspace */
52703+
52704+ num_sprole_pws = arg->num_sprole_pws;
52705+ acl_special_roles = (struct sprole_pw **) acl_alloc_num(num_sprole_pws, sizeof(struct sprole_pw *));
52706+
52707+ if (!acl_special_roles) {
52708+ err = -ENOMEM;
52709+ goto cleanup;
52710+ }
52711+
52712+ for (i = 0; i < num_sprole_pws; i++) {
52713+ sptmp = (struct sprole_pw *) acl_alloc(sizeof(struct sprole_pw));
52714+ if (!sptmp) {
52715+ err = -ENOMEM;
52716+ goto cleanup;
52717+ }
52718+ if (copy_from_user(sptmp, arg->sprole_pws + i,
52719+ sizeof (struct sprole_pw))) {
52720+ err = -EFAULT;
52721+ goto cleanup;
52722+ }
52723+
52724+ len =
52725+ strnlen_user(sptmp->rolename, GR_SPROLE_LEN);
52726+
52727+ if (!len || len >= GR_SPROLE_LEN) {
52728+ err = -EINVAL;
52729+ goto cleanup;
52730+ }
52731+
52732+ if ((tmp = (char *) acl_alloc(len)) == NULL) {
52733+ err = -ENOMEM;
52734+ goto cleanup;
52735+ }
52736+
52737+ if (copy_from_user(tmp, sptmp->rolename, len)) {
52738+ err = -EFAULT;
52739+ goto cleanup;
52740+ }
52741+ tmp[len-1] = '\0';
52742+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
52743+ printk(KERN_ALERT "Copying special role %s\n", tmp);
52744+#endif
52745+ sptmp->rolename = tmp;
52746+ acl_special_roles[i] = sptmp;
52747+ }
52748+
52749+ r_utmp = (struct acl_role_label **) arg->role_db.r_table;
52750+
52751+ for (r_num = 0; r_num < arg->role_db.num_roles; r_num++) {
52752+ r_tmp = acl_alloc(sizeof (struct acl_role_label));
52753+
52754+ if (!r_tmp) {
52755+ err = -ENOMEM;
52756+ goto cleanup;
52757+ }
52758+
52759+ if (copy_from_user(&r_utmp2, r_utmp + r_num,
52760+ sizeof (struct acl_role_label *))) {
52761+ err = -EFAULT;
52762+ goto cleanup;
52763+ }
52764+
52765+ if (copy_from_user(r_tmp, r_utmp2,
52766+ sizeof (struct acl_role_label))) {
52767+ err = -EFAULT;
52768+ goto cleanup;
52769+ }
52770+
52771+ len = strnlen_user(r_tmp->rolename, GR_SPROLE_LEN);
52772+
52773+ if (!len || len >= PATH_MAX) {
52774+ err = -EINVAL;
52775+ goto cleanup;
52776+ }
52777+
52778+ if ((tmp = (char *) acl_alloc(len)) == NULL) {
52779+ err = -ENOMEM;
52780+ goto cleanup;
52781+ }
52782+ if (copy_from_user(tmp, r_tmp->rolename, len)) {
52783+ err = -EFAULT;
52784+ goto cleanup;
52785+ }
52786+ tmp[len-1] = '\0';
52787+ r_tmp->rolename = tmp;
52788+
52789+ if (!strcmp(r_tmp->rolename, "default")
52790+ && (r_tmp->roletype & GR_ROLE_DEFAULT)) {
52791+ default_role = r_tmp;
52792+ } else if (!strcmp(r_tmp->rolename, ":::kernel:::")) {
52793+ kernel_role = r_tmp;
52794+ }
52795+
52796+ if ((ghash = (struct gr_hash_struct *) acl_alloc(sizeof(struct gr_hash_struct))) == NULL) {
52797+ err = -ENOMEM;
52798+ goto cleanup;
52799+ }
52800+ if (copy_from_user(ghash, r_tmp->hash, sizeof(struct gr_hash_struct))) {
52801+ err = -EFAULT;
52802+ goto cleanup;
52803+ }
52804+
52805+ r_tmp->hash = ghash;
52806+
52807+ num_subjs = count_user_subjs(r_tmp->hash->first);
52808+
52809+ r_tmp->subj_hash_size = num_subjs;
52810+ r_tmp->subj_hash =
52811+ (struct acl_subject_label **)
52812+ create_table(&(r_tmp->subj_hash_size), sizeof(void *));
52813+
52814+ if (!r_tmp->subj_hash) {
52815+ err = -ENOMEM;
52816+ goto cleanup;
52817+ }
52818+
52819+ err = copy_user_allowedips(r_tmp);
52820+ if (err)
52821+ goto cleanup;
52822+
52823+ /* copy domain info */
52824+ if (r_tmp->domain_children != NULL) {
52825+ domainlist = acl_alloc_num(r_tmp->domain_child_num, sizeof(uid_t));
52826+ if (domainlist == NULL) {
52827+ err = -ENOMEM;
52828+ goto cleanup;
52829+ }
52830+ if (copy_from_user(domainlist, r_tmp->domain_children, r_tmp->domain_child_num * sizeof(uid_t))) {
52831+ err = -EFAULT;
52832+ goto cleanup;
52833+ }
52834+ r_tmp->domain_children = domainlist;
52835+ }
52836+
52837+ err = copy_user_transitions(r_tmp);
52838+ if (err)
52839+ goto cleanup;
52840+
52841+ memset(r_tmp->subj_hash, 0,
52842+ r_tmp->subj_hash_size *
52843+ sizeof (struct acl_subject_label *));
52844+
52845+ err = copy_user_subjs(r_tmp->hash->first, r_tmp);
52846+
52847+ if (err)
52848+ goto cleanup;
52849+
52850+ /* set nested subject list to null */
52851+ r_tmp->hash->first = NULL;
52852+
52853+ insert_acl_role_label(r_tmp);
52854+ }
52855+
52856+ goto return_err;
52857+ cleanup:
52858+ free_variables();
52859+ return_err:
52860+ return err;
52861+
52862+}
52863+
52864+static int
52865+gracl_init(struct gr_arg *args)
52866+{
52867+ int error = 0;
52868+
52869+ memcpy(gr_system_salt, args->salt, GR_SALT_LEN);
52870+ memcpy(gr_system_sum, args->sum, GR_SHA_LEN);
52871+
52872+ if (init_variables(args)) {
52873+ gr_log_str(GR_DONT_AUDIT_GOOD, GR_INITF_ACL_MSG, GR_VERSION);
52874+ error = -ENOMEM;
52875+ free_variables();
52876+ goto out;
52877+ }
52878+
52879+ error = copy_user_acl(args);
52880+ free_init_variables();
52881+ if (error) {
52882+ free_variables();
52883+ goto out;
52884+ }
52885+
52886+ if ((error = gr_set_acls(0))) {
52887+ free_variables();
52888+ goto out;
52889+ }
52890+
52891+ pax_open_kernel();
52892+ gr_status |= GR_READY;
52893+ pax_close_kernel();
52894+
52895+ out:
52896+ return error;
52897+}
52898+
52899+/* derived from glibc fnmatch() 0: match, 1: no match*/
52900+
52901+static int
52902+glob_match(const char *p, const char *n)
52903+{
52904+ char c;
52905+
52906+ while ((c = *p++) != '\0') {
52907+ switch (c) {
52908+ case '?':
52909+ if (*n == '\0')
52910+ return 1;
52911+ else if (*n == '/')
52912+ return 1;
52913+ break;
52914+ case '\\':
52915+ if (*n != c)
52916+ return 1;
52917+ break;
52918+ case '*':
52919+ for (c = *p++; c == '?' || c == '*'; c = *p++) {
52920+ if (*n == '/')
52921+ return 1;
52922+ else if (c == '?') {
52923+ if (*n == '\0')
52924+ return 1;
52925+ else
52926+ ++n;
52927+ }
52928+ }
52929+ if (c == '\0') {
52930+ return 0;
52931+ } else {
52932+ const char *endp;
52933+
52934+ if ((endp = strchr(n, '/')) == NULL)
52935+ endp = n + strlen(n);
52936+
52937+ if (c == '[') {
52938+ for (--p; n < endp; ++n)
52939+ if (!glob_match(p, n))
52940+ return 0;
52941+ } else if (c == '/') {
52942+ while (*n != '\0' && *n != '/')
52943+ ++n;
52944+ if (*n == '/' && !glob_match(p, n + 1))
52945+ return 0;
52946+ } else {
52947+ for (--p; n < endp; ++n)
52948+ if (*n == c && !glob_match(p, n))
52949+ return 0;
52950+ }
52951+
52952+ return 1;
52953+ }
52954+ case '[':
52955+ {
52956+ int not;
52957+ char cold;
52958+
52959+ if (*n == '\0' || *n == '/')
52960+ return 1;
52961+
52962+ not = (*p == '!' || *p == '^');
52963+ if (not)
52964+ ++p;
52965+
52966+ c = *p++;
52967+ for (;;) {
52968+ unsigned char fn = (unsigned char)*n;
52969+
52970+ if (c == '\0')
52971+ return 1;
52972+ else {
52973+ if (c == fn)
52974+ goto matched;
52975+ cold = c;
52976+ c = *p++;
52977+
52978+ if (c == '-' && *p != ']') {
52979+ unsigned char cend = *p++;
52980+
52981+ if (cend == '\0')
52982+ return 1;
52983+
52984+ if (cold <= fn && fn <= cend)
52985+ goto matched;
52986+
52987+ c = *p++;
52988+ }
52989+ }
52990+
52991+ if (c == ']')
52992+ break;
52993+ }
52994+ if (!not)
52995+ return 1;
52996+ break;
52997+ matched:
52998+ while (c != ']') {
52999+ if (c == '\0')
53000+ return 1;
53001+
53002+ c = *p++;
53003+ }
53004+ if (not)
53005+ return 1;
53006+ }
53007+ break;
53008+ default:
53009+ if (c != *n)
53010+ return 1;
53011+ }
53012+
53013+ ++n;
53014+ }
53015+
53016+ if (*n == '\0')
53017+ return 0;
53018+
53019+ if (*n == '/')
53020+ return 0;
53021+
53022+ return 1;
53023+}
53024+
53025+static struct acl_object_label *
53026+chk_glob_label(struct acl_object_label *globbed,
53027+ struct dentry *dentry, struct vfsmount *mnt, char **path)
53028+{
53029+ struct acl_object_label *tmp;
53030+
53031+ if (*path == NULL)
53032+ *path = gr_to_filename_nolock(dentry, mnt);
53033+
53034+ tmp = globbed;
53035+
53036+ while (tmp) {
53037+ if (!glob_match(tmp->filename, *path))
53038+ return tmp;
53039+ tmp = tmp->next;
53040+ }
53041+
53042+ return NULL;
53043+}
53044+
53045+static struct acl_object_label *
53046+__full_lookup(const struct dentry *orig_dentry, const struct vfsmount *orig_mnt,
53047+ const ino_t curr_ino, const dev_t curr_dev,
53048+ const struct acl_subject_label *subj, char **path, const int checkglob)
53049+{
53050+ struct acl_subject_label *tmpsubj;
53051+ struct acl_object_label *retval;
53052+ struct acl_object_label *retval2;
53053+
53054+ tmpsubj = (struct acl_subject_label *) subj;
53055+ read_lock(&gr_inode_lock);
53056+ do {
53057+ retval = lookup_acl_obj_label(curr_ino, curr_dev, tmpsubj);
53058+ if (retval) {
53059+ if (checkglob && retval->globbed) {
53060+ retval2 = chk_glob_label(retval->globbed, (struct dentry *)orig_dentry,
53061+ (struct vfsmount *)orig_mnt, path);
53062+ if (retval2)
53063+ retval = retval2;
53064+ }
53065+ break;
53066+ }
53067+ } while ((tmpsubj = tmpsubj->parent_subject));
53068+ read_unlock(&gr_inode_lock);
53069+
53070+ return retval;
53071+}
53072+
53073+static __inline__ struct acl_object_label *
53074+full_lookup(const struct dentry *orig_dentry, const struct vfsmount *orig_mnt,
53075+ struct dentry *curr_dentry,
53076+ const struct acl_subject_label *subj, char **path, const int checkglob)
53077+{
53078+ int newglob = checkglob;
53079+ ino_t inode;
53080+ dev_t device;
53081+
53082+ /* if we aren't checking a subdirectory of the original path yet, don't do glob checking
53083+ as we don't want a / * rule to match instead of the / object
53084+ don't do this for create lookups that call this function though, since they're looking up
53085+ on the parent and thus need globbing checks on all paths
53086+ */
53087+ if (orig_dentry == curr_dentry && newglob != GR_CREATE_GLOB)
53088+ newglob = GR_NO_GLOB;
53089+
53090+ spin_lock(&curr_dentry->d_lock);
53091+ inode = curr_dentry->d_inode->i_ino;
53092+ device = __get_dev(curr_dentry);
53093+ spin_unlock(&curr_dentry->d_lock);
53094+
53095+ return __full_lookup(orig_dentry, orig_mnt, inode, device, subj, path, newglob);
53096+}
53097+
53098+static struct acl_object_label *
53099+__chk_obj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
53100+ const struct acl_subject_label *subj, char *path, const int checkglob)
53101+{
53102+ struct dentry *dentry = (struct dentry *) l_dentry;
53103+ struct vfsmount *mnt = (struct vfsmount *) l_mnt;
53104+ struct acl_object_label *retval;
53105+ struct dentry *parent;
53106+
53107+ write_seqlock(&rename_lock);
53108+ br_read_lock(vfsmount_lock);
53109+
53110+ if (unlikely((mnt == shm_mnt && dentry->d_inode->i_nlink == 0) || mnt == pipe_mnt ||
53111+#ifdef CONFIG_NET
53112+ mnt == sock_mnt ||
53113+#endif
53114+#ifdef CONFIG_HUGETLBFS
53115+ (mnt == hugetlbfs_vfsmount && dentry->d_inode->i_nlink == 0) ||
53116+#endif
53117+ /* ignore Eric Biederman */
53118+ IS_PRIVATE(l_dentry->d_inode))) {
53119+ retval = fakefs_obj;
53120+ goto out;
53121+ }
53122+
53123+ for (;;) {
53124+ if (dentry == real_root.dentry && mnt == real_root.mnt)
53125+ break;
53126+
53127+ if (dentry == mnt->mnt_root || IS_ROOT(dentry)) {
53128+ if (mnt->mnt_parent == mnt)
53129+ break;
53130+
53131+ retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
53132+ if (retval != NULL)
53133+ goto out;
53134+
53135+ dentry = mnt->mnt_mountpoint;
53136+ mnt = mnt->mnt_parent;
53137+ continue;
53138+ }
53139+
53140+ parent = dentry->d_parent;
53141+ retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
53142+ if (retval != NULL)
53143+ goto out;
53144+
53145+ dentry = parent;
53146+ }
53147+
53148+ retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
53149+
53150+ /* real_root is pinned so we don't have to hold a reference */
53151+ if (retval == NULL)
53152+ retval = full_lookup(l_dentry, l_mnt, real_root.dentry, subj, &path, checkglob);
53153+out:
53154+ br_read_unlock(vfsmount_lock);
53155+ write_sequnlock(&rename_lock);
53156+
53157+ BUG_ON(retval == NULL);
53158+
53159+ return retval;
53160+}
53161+
53162+static __inline__ struct acl_object_label *
53163+chk_obj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
53164+ const struct acl_subject_label *subj)
53165+{
53166+ char *path = NULL;
53167+ return __chk_obj_label(l_dentry, l_mnt, subj, path, GR_REG_GLOB);
53168+}
53169+
53170+static __inline__ struct acl_object_label *
53171+chk_obj_label_noglob(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
53172+ const struct acl_subject_label *subj)
53173+{
53174+ char *path = NULL;
53175+ return __chk_obj_label(l_dentry, l_mnt, subj, path, GR_NO_GLOB);
53176+}
53177+
53178+static __inline__ struct acl_object_label *
53179+chk_obj_create_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
53180+ const struct acl_subject_label *subj, char *path)
53181+{
53182+ return __chk_obj_label(l_dentry, l_mnt, subj, path, GR_CREATE_GLOB);
53183+}
53184+
53185+static struct acl_subject_label *
53186+chk_subj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
53187+ const struct acl_role_label *role)
53188+{
53189+ struct dentry *dentry = (struct dentry *) l_dentry;
53190+ struct vfsmount *mnt = (struct vfsmount *) l_mnt;
53191+ struct acl_subject_label *retval;
53192+ struct dentry *parent;
53193+
53194+ write_seqlock(&rename_lock);
53195+ br_read_lock(vfsmount_lock);
53196+
53197+ for (;;) {
53198+ if (dentry == real_root.dentry && mnt == real_root.mnt)
53199+ break;
53200+ if (dentry == mnt->mnt_root || IS_ROOT(dentry)) {
53201+ if (mnt->mnt_parent == mnt)
53202+ break;
53203+
53204+ spin_lock(&dentry->d_lock);
53205+ read_lock(&gr_inode_lock);
53206+ retval =
53207+ lookup_acl_subj_label(dentry->d_inode->i_ino,
53208+ __get_dev(dentry), role);
53209+ read_unlock(&gr_inode_lock);
53210+ spin_unlock(&dentry->d_lock);
53211+ if (retval != NULL)
53212+ goto out;
53213+
53214+ dentry = mnt->mnt_mountpoint;
53215+ mnt = mnt->mnt_parent;
53216+ continue;
53217+ }
53218+
53219+ spin_lock(&dentry->d_lock);
53220+ read_lock(&gr_inode_lock);
53221+ retval = lookup_acl_subj_label(dentry->d_inode->i_ino,
53222+ __get_dev(dentry), role);
53223+ read_unlock(&gr_inode_lock);
53224+ parent = dentry->d_parent;
53225+ spin_unlock(&dentry->d_lock);
53226+
53227+ if (retval != NULL)
53228+ goto out;
53229+
53230+ dentry = parent;
53231+ }
53232+
53233+ spin_lock(&dentry->d_lock);
53234+ read_lock(&gr_inode_lock);
53235+ retval = lookup_acl_subj_label(dentry->d_inode->i_ino,
53236+ __get_dev(dentry), role);
53237+ read_unlock(&gr_inode_lock);
53238+ spin_unlock(&dentry->d_lock);
53239+
53240+ if (unlikely(retval == NULL)) {
53241+ /* real_root is pinned, we don't need to hold a reference */
53242+ read_lock(&gr_inode_lock);
53243+ retval = lookup_acl_subj_label(real_root.dentry->d_inode->i_ino,
53244+ __get_dev(real_root.dentry), role);
53245+ read_unlock(&gr_inode_lock);
53246+ }
53247+out:
53248+ br_read_unlock(vfsmount_lock);
53249+ write_sequnlock(&rename_lock);
53250+
53251+ BUG_ON(retval == NULL);
53252+
53253+ return retval;
53254+}
53255+
53256+static void
53257+gr_log_learn(const struct dentry *dentry, const struct vfsmount *mnt, const __u32 mode)
53258+{
53259+ struct task_struct *task = current;
53260+ const struct cred *cred = current_cred();
53261+
53262+ security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename, task->role->roletype,
53263+ cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
53264+ task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
53265+ 1UL, 1UL, gr_to_filename(dentry, mnt), (unsigned long) mode, &task->signal->saved_ip);
53266+
53267+ return;
53268+}
53269+
53270+static void
53271+gr_log_learn_sysctl(const char *path, const __u32 mode)
53272+{
53273+ struct task_struct *task = current;
53274+ const struct cred *cred = current_cred();
53275+
53276+ security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename, task->role->roletype,
53277+ cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
53278+ task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
53279+ 1UL, 1UL, path, (unsigned long) mode, &task->signal->saved_ip);
53280+
53281+ return;
53282+}
53283+
53284+static void
53285+gr_log_learn_id_change(const char type, const unsigned int real,
53286+ const unsigned int effective, const unsigned int fs)
53287+{
53288+ struct task_struct *task = current;
53289+ const struct cred *cred = current_cred();
53290+
53291+ security_learn(GR_ID_LEARN_MSG, task->role->rolename, task->role->roletype,
53292+ cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
53293+ task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
53294+ type, real, effective, fs, &task->signal->saved_ip);
53295+
53296+ return;
53297+}
53298+
53299+__u32
53300+gr_check_link(const struct dentry * new_dentry,
53301+ const struct dentry * parent_dentry,
53302+ const struct vfsmount * parent_mnt,
53303+ const struct dentry * old_dentry, const struct vfsmount * old_mnt)
53304+{
53305+ struct acl_object_label *obj;
53306+ __u32 oldmode, newmode;
53307+ __u32 needmode;
53308+
53309+ if (unlikely(!(gr_status & GR_READY)))
53310+ return (GR_CREATE | GR_LINK);
53311+
53312+ obj = chk_obj_label(old_dentry, old_mnt, current->acl);
53313+ oldmode = obj->mode;
53314+
53315+ if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
53316+ oldmode |= (GR_CREATE | GR_LINK);
53317+
53318+ needmode = GR_CREATE | GR_AUDIT_CREATE | GR_SUPPRESS;
53319+ if (old_dentry->d_inode->i_mode & (S_ISUID | S_ISGID))
53320+ needmode |= GR_SETID | GR_AUDIT_SETID;
53321+
53322+ newmode =
53323+ gr_check_create(new_dentry, parent_dentry, parent_mnt,
53324+ oldmode | needmode);
53325+
53326+ needmode = newmode & (GR_FIND | GR_APPEND | GR_WRITE | GR_EXEC |
53327+ GR_SETID | GR_READ | GR_FIND | GR_DELETE |
53328+ GR_INHERIT | GR_AUDIT_INHERIT);
53329+
53330+ if (old_dentry->d_inode->i_mode & (S_ISUID | S_ISGID) && !(newmode & GR_SETID))
53331+ goto bad;
53332+
53333+ if ((oldmode & needmode) != needmode)
53334+ goto bad;
53335+
53336+ needmode = oldmode & (GR_NOPTRACE | GR_PTRACERD | GR_INHERIT | GR_AUDITS);
53337+ if ((newmode & needmode) != needmode)
53338+ goto bad;
53339+
53340+ if ((newmode & (GR_CREATE | GR_LINK)) == (GR_CREATE | GR_LINK))
53341+ return newmode;
53342+bad:
53343+ needmode = oldmode;
53344+ if (old_dentry->d_inode->i_mode & (S_ISUID | S_ISGID))
53345+ needmode |= GR_SETID;
53346+
53347+ if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN)) {
53348+ gr_log_learn(old_dentry, old_mnt, needmode);
53349+ return (GR_CREATE | GR_LINK);
53350+ } else if (newmode & GR_SUPPRESS)
53351+ return GR_SUPPRESS;
53352+ else
53353+ return 0;
53354+}
53355+
53356+__u32
53357+gr_search_file(const struct dentry * dentry, const __u32 mode,
53358+ const struct vfsmount * mnt)
53359+{
53360+ __u32 retval = mode;
53361+ struct acl_subject_label *curracl;
53362+ struct acl_object_label *currobj;
53363+
53364+ if (unlikely(!(gr_status & GR_READY)))
53365+ return (mode & ~GR_AUDITS);
53366+
53367+ curracl = current->acl;
53368+
53369+ currobj = chk_obj_label(dentry, mnt, curracl);
53370+ retval = currobj->mode & mode;
53371+
53372+ /* if we're opening a specified transfer file for writing
53373+ (e.g. /dev/initctl), then transfer our role to init
53374+ */
53375+ if (unlikely(currobj->mode & GR_INIT_TRANSFER && retval & GR_WRITE &&
53376+ current->role->roletype & GR_ROLE_PERSIST)) {
53377+ struct task_struct *task = init_pid_ns.child_reaper;
53378+
53379+ if (task->role != current->role) {
53380+ task->acl_sp_role = 0;
53381+ task->acl_role_id = current->acl_role_id;
53382+ task->role = current->role;
53383+ rcu_read_lock();
53384+ read_lock(&grsec_exec_file_lock);
53385+ gr_apply_subject_to_task(task);
53386+ read_unlock(&grsec_exec_file_lock);
53387+ rcu_read_unlock();
53388+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_INIT_TRANSFER_MSG);
53389+ }
53390+ }
53391+
53392+ if (unlikely
53393+ ((curracl->mode & (GR_LEARN | GR_INHERITLEARN)) && !(mode & GR_NOPTRACE)
53394+ && (retval != (mode & ~(GR_AUDITS | GR_SUPPRESS))))) {
53395+ __u32 new_mode = mode;
53396+
53397+ new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
53398+
53399+ retval = new_mode;
53400+
53401+ if (new_mode & GR_EXEC && curracl->mode & GR_INHERITLEARN)
53402+ new_mode |= GR_INHERIT;
53403+
53404+ if (!(mode & GR_NOLEARN))
53405+ gr_log_learn(dentry, mnt, new_mode);
53406+ }
53407+
53408+ return retval;
53409+}
53410+
53411+__u32
53412+gr_check_create(const struct dentry * new_dentry, const struct dentry * parent,
53413+ const struct vfsmount * mnt, const __u32 mode)
53414+{
53415+ struct name_entry *match;
53416+ struct acl_object_label *matchpo;
53417+ struct acl_subject_label *curracl;
53418+ char *path;
53419+ __u32 retval;
53420+
53421+ if (unlikely(!(gr_status & GR_READY)))
53422+ return (mode & ~GR_AUDITS);
53423+
53424+ preempt_disable();
53425+ path = gr_to_filename_rbac(new_dentry, mnt);
53426+ match = lookup_name_entry_create(path);
53427+
53428+ if (!match)
53429+ goto check_parent;
53430+
53431+ curracl = current->acl;
53432+
53433+ read_lock(&gr_inode_lock);
53434+ matchpo = lookup_acl_obj_label_create(match->inode, match->device, curracl);
53435+ read_unlock(&gr_inode_lock);
53436+
53437+ if (matchpo) {
53438+ if ((matchpo->mode & mode) !=
53439+ (mode & ~(GR_AUDITS | GR_SUPPRESS))
53440+ && curracl->mode & (GR_LEARN | GR_INHERITLEARN)) {
53441+ __u32 new_mode = mode;
53442+
53443+ new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
53444+
53445+ gr_log_learn(new_dentry, mnt, new_mode);
53446+
53447+ preempt_enable();
53448+ return new_mode;
53449+ }
53450+ preempt_enable();
53451+ return (matchpo->mode & mode);
53452+ }
53453+
53454+ check_parent:
53455+ curracl = current->acl;
53456+
53457+ matchpo = chk_obj_create_label(parent, mnt, curracl, path);
53458+ retval = matchpo->mode & mode;
53459+
53460+ if ((retval != (mode & ~(GR_AUDITS | GR_SUPPRESS)))
53461+ && (curracl->mode & (GR_LEARN | GR_INHERITLEARN))) {
53462+ __u32 new_mode = mode;
53463+
53464+ new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
53465+
53466+ gr_log_learn(new_dentry, mnt, new_mode);
53467+ preempt_enable();
53468+ return new_mode;
53469+ }
53470+
53471+ preempt_enable();
53472+ return retval;
53473+}
53474+
53475+int
53476+gr_check_hidden_task(const struct task_struct *task)
53477+{
53478+ if (unlikely(!(gr_status & GR_READY)))
53479+ return 0;
53480+
53481+ if (!(task->acl->mode & GR_PROCFIND) && !(current->acl->mode & GR_VIEW))
53482+ return 1;
53483+
53484+ return 0;
53485+}
53486+
53487+int
53488+gr_check_protected_task(const struct task_struct *task)
53489+{
53490+ if (unlikely(!(gr_status & GR_READY) || !task))
53491+ return 0;
53492+
53493+ if ((task->acl->mode & GR_PROTECTED) && !(current->acl->mode & GR_KILL) &&
53494+ task->acl != current->acl)
53495+ return 1;
53496+
53497+ return 0;
53498+}
53499+
53500+int
53501+gr_check_protected_task_fowner(struct pid *pid, enum pid_type type)
53502+{
53503+ struct task_struct *p;
53504+ int ret = 0;
53505+
53506+ if (unlikely(!(gr_status & GR_READY) || !pid))
53507+ return ret;
53508+
53509+ read_lock(&tasklist_lock);
53510+ do_each_pid_task(pid, type, p) {
53511+ if ((p->acl->mode & GR_PROTECTED) && !(current->acl->mode & GR_KILL) &&
53512+ p->acl != current->acl) {
53513+ ret = 1;
53514+ goto out;
53515+ }
53516+ } while_each_pid_task(pid, type, p);
53517+out:
53518+ read_unlock(&tasklist_lock);
53519+
53520+ return ret;
53521+}
53522+
53523+void
53524+gr_copy_label(struct task_struct *tsk)
53525+{
53526+ tsk->signal->used_accept = 0;
53527+ tsk->acl_sp_role = 0;
53528+ tsk->acl_role_id = current->acl_role_id;
53529+ tsk->acl = current->acl;
53530+ tsk->role = current->role;
53531+ tsk->signal->curr_ip = current->signal->curr_ip;
53532+ tsk->signal->saved_ip = current->signal->saved_ip;
53533+ if (current->exec_file)
53534+ get_file(current->exec_file);
53535+ tsk->exec_file = current->exec_file;
53536+ tsk->is_writable = current->is_writable;
53537+ if (unlikely(current->signal->used_accept)) {
53538+ current->signal->curr_ip = 0;
53539+ current->signal->saved_ip = 0;
53540+ }
53541+
53542+ return;
53543+}
53544+
53545+static void
53546+gr_set_proc_res(struct task_struct *task)
53547+{
53548+ struct acl_subject_label *proc;
53549+ unsigned short i;
53550+
53551+ proc = task->acl;
53552+
53553+ if (proc->mode & (GR_LEARN | GR_INHERITLEARN))
53554+ return;
53555+
53556+ for (i = 0; i < RLIM_NLIMITS; i++) {
53557+ if (!(proc->resmask & (1 << i)))
53558+ continue;
53559+
53560+ task->signal->rlim[i].rlim_cur = proc->res[i].rlim_cur;
53561+ task->signal->rlim[i].rlim_max = proc->res[i].rlim_max;
53562+ }
53563+
53564+ return;
53565+}
53566+
53567+extern int __gr_process_user_ban(struct user_struct *user);
53568+
53569+int
53570+gr_check_user_change(int real, int effective, int fs)
53571+{
53572+ unsigned int i;
53573+ __u16 num;
53574+ uid_t *uidlist;
53575+ int curuid;
53576+ int realok = 0;
53577+ int effectiveok = 0;
53578+ int fsok = 0;
53579+
53580+#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
53581+ struct user_struct *user;
53582+
53583+ if (real == -1)
53584+ goto skipit;
53585+
53586+ user = find_user(real);
53587+ if (user == NULL)
53588+ goto skipit;
53589+
53590+ if (__gr_process_user_ban(user)) {
53591+ /* for find_user */
53592+ free_uid(user);
53593+ return 1;
53594+ }
53595+
53596+ /* for find_user */
53597+ free_uid(user);
53598+
53599+skipit:
53600+#endif
53601+
53602+ if (unlikely(!(gr_status & GR_READY)))
53603+ return 0;
53604+
53605+ if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
53606+ gr_log_learn_id_change('u', real, effective, fs);
53607+
53608+ num = current->acl->user_trans_num;
53609+ uidlist = current->acl->user_transitions;
53610+
53611+ if (uidlist == NULL)
53612+ return 0;
53613+
53614+ if (real == -1)
53615+ realok = 1;
53616+ if (effective == -1)
53617+ effectiveok = 1;
53618+ if (fs == -1)
53619+ fsok = 1;
53620+
53621+ if (current->acl->user_trans_type & GR_ID_ALLOW) {
53622+ for (i = 0; i < num; i++) {
53623+ curuid = (int)uidlist[i];
53624+ if (real == curuid)
53625+ realok = 1;
53626+ if (effective == curuid)
53627+ effectiveok = 1;
53628+ if (fs == curuid)
53629+ fsok = 1;
53630+ }
53631+ } else if (current->acl->user_trans_type & GR_ID_DENY) {
53632+ for (i = 0; i < num; i++) {
53633+ curuid = (int)uidlist[i];
53634+ if (real == curuid)
53635+ break;
53636+ if (effective == curuid)
53637+ break;
53638+ if (fs == curuid)
53639+ break;
53640+ }
53641+ /* not in deny list */
53642+ if (i == num) {
53643+ realok = 1;
53644+ effectiveok = 1;
53645+ fsok = 1;
53646+ }
53647+ }
53648+
53649+ if (realok && effectiveok && fsok)
53650+ return 0;
53651+ else {
53652+ gr_log_int(GR_DONT_AUDIT, GR_USRCHANGE_ACL_MSG, realok ? (effectiveok ? (fsok ? 0 : fs) : effective) : real);
53653+ return 1;
53654+ }
53655+}
53656+
53657+int
53658+gr_check_group_change(int real, int effective, int fs)
53659+{
53660+ unsigned int i;
53661+ __u16 num;
53662+ gid_t *gidlist;
53663+ int curgid;
53664+ int realok = 0;
53665+ int effectiveok = 0;
53666+ int fsok = 0;
53667+
53668+ if (unlikely(!(gr_status & GR_READY)))
53669+ return 0;
53670+
53671+ if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
53672+ gr_log_learn_id_change('g', real, effective, fs);
53673+
53674+ num = current->acl->group_trans_num;
53675+ gidlist = current->acl->group_transitions;
53676+
53677+ if (gidlist == NULL)
53678+ return 0;
53679+
53680+ if (real == -1)
53681+ realok = 1;
53682+ if (effective == -1)
53683+ effectiveok = 1;
53684+ if (fs == -1)
53685+ fsok = 1;
53686+
53687+ if (current->acl->group_trans_type & GR_ID_ALLOW) {
53688+ for (i = 0; i < num; i++) {
53689+ curgid = (int)gidlist[i];
53690+ if (real == curgid)
53691+ realok = 1;
53692+ if (effective == curgid)
53693+ effectiveok = 1;
53694+ if (fs == curgid)
53695+ fsok = 1;
53696+ }
53697+ } else if (current->acl->group_trans_type & GR_ID_DENY) {
53698+ for (i = 0; i < num; i++) {
53699+ curgid = (int)gidlist[i];
53700+ if (real == curgid)
53701+ break;
53702+ if (effective == curgid)
53703+ break;
53704+ if (fs == curgid)
53705+ break;
53706+ }
53707+ /* not in deny list */
53708+ if (i == num) {
53709+ realok = 1;
53710+ effectiveok = 1;
53711+ fsok = 1;
53712+ }
53713+ }
53714+
53715+ if (realok && effectiveok && fsok)
53716+ return 0;
53717+ else {
53718+ gr_log_int(GR_DONT_AUDIT, GR_GRPCHANGE_ACL_MSG, realok ? (effectiveok ? (fsok ? 0 : fs) : effective) : real);
53719+ return 1;
53720+ }
53721+}
53722+
53723+void
53724+gr_set_role_label(struct task_struct *task, const uid_t uid, const uid_t gid)
53725+{
53726+ struct acl_role_label *role = task->role;
53727+ struct acl_subject_label *subj = NULL;
53728+ struct acl_object_label *obj;
53729+ struct file *filp;
53730+
53731+ if (unlikely(!(gr_status & GR_READY)))
53732+ return;
53733+
53734+ filp = task->exec_file;
53735+
53736+ /* kernel process, we'll give them the kernel role */
53737+ if (unlikely(!filp)) {
53738+ task->role = kernel_role;
53739+ task->acl = kernel_role->root_label;
53740+ return;
53741+ } else if (!task->role || !(task->role->roletype & GR_ROLE_SPECIAL))
53742+ role = lookup_acl_role_label(task, uid, gid);
53743+
53744+ /* perform subject lookup in possibly new role
53745+ we can use this result below in the case where role == task->role
53746+ */
53747+ subj = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt, role);
53748+
53749+ /* if we changed uid/gid, but result in the same role
53750+ and are using inheritance, don't lose the inherited subject
53751+ if current subject is other than what normal lookup
53752+ would result in, we arrived via inheritance, don't
53753+ lose subject
53754+ */
53755+ if (role != task->role || (!(task->acl->mode & GR_INHERITLEARN) &&
53756+ (subj == task->acl)))
53757+ task->acl = subj;
53758+
53759+ task->role = role;
53760+
53761+ task->is_writable = 0;
53762+
53763+ /* ignore additional mmap checks for processes that are writable
53764+ by the default ACL */
53765+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
53766+ if (unlikely(obj->mode & GR_WRITE))
53767+ task->is_writable = 1;
53768+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, task->role->root_label);
53769+ if (unlikely(obj->mode & GR_WRITE))
53770+ task->is_writable = 1;
53771+
53772+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
53773+ printk(KERN_ALERT "Set role label for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
53774+#endif
53775+
53776+ gr_set_proc_res(task);
53777+
53778+ return;
53779+}
53780+
53781+int
53782+gr_set_proc_label(const struct dentry *dentry, const struct vfsmount *mnt,
53783+ const int unsafe_share)
53784+{
53785+ struct task_struct *task = current;
53786+ struct acl_subject_label *newacl;
53787+ struct acl_object_label *obj;
53788+ __u32 retmode;
53789+
53790+ if (unlikely(!(gr_status & GR_READY)))
53791+ return 0;
53792+
53793+ newacl = chk_subj_label(dentry, mnt, task->role);
53794+
53795+ task_lock(task);
53796+ if ((((task->ptrace & PT_PTRACED) || unsafe_share) &&
53797+ !(task->acl->mode & GR_POVERRIDE) && (task->acl != newacl) &&
53798+ !(task->role->roletype & GR_ROLE_GOD) &&
53799+ !gr_search_file(dentry, GR_PTRACERD, mnt) &&
53800+ !(task->acl->mode & (GR_LEARN | GR_INHERITLEARN)))) {
53801+ task_unlock(task);
53802+ if (unsafe_share)
53803+ gr_log_fs_generic(GR_DONT_AUDIT, GR_UNSAFESHARE_EXEC_ACL_MSG, dentry, mnt);
53804+ else
53805+ gr_log_fs_generic(GR_DONT_AUDIT, GR_PTRACE_EXEC_ACL_MSG, dentry, mnt);
53806+ return -EACCES;
53807+ }
53808+ task_unlock(task);
53809+
53810+ obj = chk_obj_label(dentry, mnt, task->acl);
53811+ retmode = obj->mode & (GR_INHERIT | GR_AUDIT_INHERIT);
53812+
53813+ if (!(task->acl->mode & GR_INHERITLEARN) &&
53814+ ((newacl->mode & GR_LEARN) || !(retmode & GR_INHERIT))) {
53815+ if (obj->nested)
53816+ task->acl = obj->nested;
53817+ else
53818+ task->acl = newacl;
53819+ } else if (retmode & GR_INHERIT && retmode & GR_AUDIT_INHERIT)
53820+ gr_log_str_fs(GR_DO_AUDIT, GR_INHERIT_ACL_MSG, task->acl->filename, dentry, mnt);
53821+
53822+ task->is_writable = 0;
53823+
53824+ /* ignore additional mmap checks for processes that are writable
53825+ by the default ACL */
53826+ obj = chk_obj_label(dentry, mnt, default_role->root_label);
53827+ if (unlikely(obj->mode & GR_WRITE))
53828+ task->is_writable = 1;
53829+ obj = chk_obj_label(dentry, mnt, task->role->root_label);
53830+ if (unlikely(obj->mode & GR_WRITE))
53831+ task->is_writable = 1;
53832+
53833+ gr_set_proc_res(task);
53834+
53835+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
53836+ printk(KERN_ALERT "Set subject label for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
53837+#endif
53838+ return 0;
53839+}
53840+
53841+/* always called with valid inodev ptr */
53842+static void
53843+do_handle_delete(struct inodev_entry *inodev, const ino_t ino, const dev_t dev)
53844+{
53845+ struct acl_object_label *matchpo;
53846+ struct acl_subject_label *matchps;
53847+ struct acl_subject_label *subj;
53848+ struct acl_role_label *role;
53849+ unsigned int x;
53850+
53851+ FOR_EACH_ROLE_START(role)
53852+ FOR_EACH_SUBJECT_START(role, subj, x)
53853+ if ((matchpo = lookup_acl_obj_label(ino, dev, subj)) != NULL)
53854+ matchpo->mode |= GR_DELETED;
53855+ FOR_EACH_SUBJECT_END(subj,x)
53856+ FOR_EACH_NESTED_SUBJECT_START(role, subj)
53857+ if (subj->inode == ino && subj->device == dev)
53858+ subj->mode |= GR_DELETED;
53859+ FOR_EACH_NESTED_SUBJECT_END(subj)
53860+ if ((matchps = lookup_acl_subj_label(ino, dev, role)) != NULL)
53861+ matchps->mode |= GR_DELETED;
53862+ FOR_EACH_ROLE_END(role)
53863+
53864+ inodev->nentry->deleted = 1;
53865+
53866+ return;
53867+}
53868+
53869+void
53870+gr_handle_delete(const ino_t ino, const dev_t dev)
53871+{
53872+ struct inodev_entry *inodev;
53873+
53874+ if (unlikely(!(gr_status & GR_READY)))
53875+ return;
53876+
53877+ write_lock(&gr_inode_lock);
53878+ inodev = lookup_inodev_entry(ino, dev);
53879+ if (inodev != NULL)
53880+ do_handle_delete(inodev, ino, dev);
53881+ write_unlock(&gr_inode_lock);
53882+
53883+ return;
53884+}
53885+
53886+static void
53887+update_acl_obj_label(const ino_t oldinode, const dev_t olddevice,
53888+ const ino_t newinode, const dev_t newdevice,
53889+ struct acl_subject_label *subj)
53890+{
53891+ unsigned int index = fhash(oldinode, olddevice, subj->obj_hash_size);
53892+ struct acl_object_label *match;
53893+
53894+ match = subj->obj_hash[index];
53895+
53896+ while (match && (match->inode != oldinode ||
53897+ match->device != olddevice ||
53898+ !(match->mode & GR_DELETED)))
53899+ match = match->next;
53900+
53901+ if (match && (match->inode == oldinode)
53902+ && (match->device == olddevice)
53903+ && (match->mode & GR_DELETED)) {
53904+ if (match->prev == NULL) {
53905+ subj->obj_hash[index] = match->next;
53906+ if (match->next != NULL)
53907+ match->next->prev = NULL;
53908+ } else {
53909+ match->prev->next = match->next;
53910+ if (match->next != NULL)
53911+ match->next->prev = match->prev;
53912+ }
53913+ match->prev = NULL;
53914+ match->next = NULL;
53915+ match->inode = newinode;
53916+ match->device = newdevice;
53917+ match->mode &= ~GR_DELETED;
53918+
53919+ insert_acl_obj_label(match, subj);
53920+ }
53921+
53922+ return;
53923+}
53924+
53925+static void
53926+update_acl_subj_label(const ino_t oldinode, const dev_t olddevice,
53927+ const ino_t newinode, const dev_t newdevice,
53928+ struct acl_role_label *role)
53929+{
53930+ unsigned int index = fhash(oldinode, olddevice, role->subj_hash_size);
53931+ struct acl_subject_label *match;
53932+
53933+ match = role->subj_hash[index];
53934+
53935+ while (match && (match->inode != oldinode ||
53936+ match->device != olddevice ||
53937+ !(match->mode & GR_DELETED)))
53938+ match = match->next;
53939+
53940+ if (match && (match->inode == oldinode)
53941+ && (match->device == olddevice)
53942+ && (match->mode & GR_DELETED)) {
53943+ if (match->prev == NULL) {
53944+ role->subj_hash[index] = match->next;
53945+ if (match->next != NULL)
53946+ match->next->prev = NULL;
53947+ } else {
53948+ match->prev->next = match->next;
53949+ if (match->next != NULL)
53950+ match->next->prev = match->prev;
53951+ }
53952+ match->prev = NULL;
53953+ match->next = NULL;
53954+ match->inode = newinode;
53955+ match->device = newdevice;
53956+ match->mode &= ~GR_DELETED;
53957+
53958+ insert_acl_subj_label(match, role);
53959+ }
53960+
53961+ return;
53962+}
53963+
53964+static void
53965+update_inodev_entry(const ino_t oldinode, const dev_t olddevice,
53966+ const ino_t newinode, const dev_t newdevice)
53967+{
53968+ unsigned int index = fhash(oldinode, olddevice, inodev_set.i_size);
53969+ struct inodev_entry *match;
53970+
53971+ match = inodev_set.i_hash[index];
53972+
53973+ while (match && (match->nentry->inode != oldinode ||
53974+ match->nentry->device != olddevice || !match->nentry->deleted))
53975+ match = match->next;
53976+
53977+ if (match && (match->nentry->inode == oldinode)
53978+ && (match->nentry->device == olddevice) &&
53979+ match->nentry->deleted) {
53980+ if (match->prev == NULL) {
53981+ inodev_set.i_hash[index] = match->next;
53982+ if (match->next != NULL)
53983+ match->next->prev = NULL;
53984+ } else {
53985+ match->prev->next = match->next;
53986+ if (match->next != NULL)
53987+ match->next->prev = match->prev;
53988+ }
53989+ match->prev = NULL;
53990+ match->next = NULL;
53991+ match->nentry->inode = newinode;
53992+ match->nentry->device = newdevice;
53993+ match->nentry->deleted = 0;
53994+
53995+ insert_inodev_entry(match);
53996+ }
53997+
53998+ return;
53999+}
54000+
54001+static void
54002+do_handle_create(const struct name_entry *matchn, const struct dentry *dentry,
54003+ const struct vfsmount *mnt)
54004+{
54005+ struct acl_subject_label *subj;
54006+ struct acl_role_label *role;
54007+ unsigned int x;
54008+ ino_t ino = dentry->d_inode->i_ino;
54009+ dev_t dev = __get_dev(dentry);
54010+
54011+ FOR_EACH_ROLE_START(role)
54012+ update_acl_subj_label(matchn->inode, matchn->device, ino, dev, role);
54013+
54014+ FOR_EACH_NESTED_SUBJECT_START(role, subj)
54015+ if ((subj->inode == ino) && (subj->device == dev)) {
54016+ subj->inode = ino;
54017+ subj->device = dev;
54018+ }
54019+ FOR_EACH_NESTED_SUBJECT_END(subj)
54020+ FOR_EACH_SUBJECT_START(role, subj, x)
54021+ update_acl_obj_label(matchn->inode, matchn->device,
54022+ ino, dev, subj);
54023+ FOR_EACH_SUBJECT_END(subj,x)
54024+ FOR_EACH_ROLE_END(role)
54025+
54026+ update_inodev_entry(matchn->inode, matchn->device, ino, dev);
54027+
54028+ return;
54029+}
54030+
54031+void
54032+gr_handle_create(const struct dentry *dentry, const struct vfsmount *mnt)
54033+{
54034+ struct name_entry *matchn;
54035+
54036+ if (unlikely(!(gr_status & GR_READY)))
54037+ return;
54038+
54039+ preempt_disable();
54040+ matchn = lookup_name_entry(gr_to_filename_rbac(dentry, mnt));
54041+
54042+ if (unlikely((unsigned long)matchn)) {
54043+ write_lock(&gr_inode_lock);
54044+ do_handle_create(matchn, dentry, mnt);
54045+ write_unlock(&gr_inode_lock);
54046+ }
54047+ preempt_enable();
54048+
54049+ return;
54050+}
54051+
54052+void
54053+gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
54054+ struct dentry *old_dentry,
54055+ struct dentry *new_dentry,
54056+ struct vfsmount *mnt, const __u8 replace)
54057+{
54058+ struct name_entry *matchn;
54059+ struct inodev_entry *inodev;
54060+ ino_t old_ino = old_dentry->d_inode->i_ino;
54061+ dev_t old_dev = __get_dev(old_dentry);
54062+
54063+ /* vfs_rename swaps the name and parent link for old_dentry and
54064+ new_dentry
54065+ at this point, old_dentry has the new name, parent link, and inode
54066+ for the renamed file
54067+ if a file is being replaced by a rename, new_dentry has the inode
54068+ and name for the replaced file
54069+ */
54070+
54071+ if (unlikely(!(gr_status & GR_READY)))
54072+ return;
54073+
54074+ preempt_disable();
54075+ matchn = lookup_name_entry(gr_to_filename_rbac(old_dentry, mnt));
54076+
54077+ /* we wouldn't have to check d_inode if it weren't for
54078+ NFS silly-renaming
54079+ */
54080+
54081+ write_lock(&gr_inode_lock);
54082+ if (unlikely(replace && new_dentry->d_inode)) {
54083+ ino_t new_ino = new_dentry->d_inode->i_ino;
54084+ dev_t new_dev = __get_dev(new_dentry);
54085+
54086+ inodev = lookup_inodev_entry(new_ino, new_dev);
54087+ if (inodev != NULL && (new_dentry->d_inode->i_nlink <= 1))
54088+ do_handle_delete(inodev, new_ino, new_dev);
54089+ }
54090+
54091+ inodev = lookup_inodev_entry(old_ino, old_dev);
54092+ if (inodev != NULL && (old_dentry->d_inode->i_nlink <= 1))
54093+ do_handle_delete(inodev, old_ino, old_dev);
54094+
54095+ if (unlikely((unsigned long)matchn))
54096+ do_handle_create(matchn, old_dentry, mnt);
54097+
54098+ write_unlock(&gr_inode_lock);
54099+ preempt_enable();
54100+
54101+ return;
54102+}
54103+
54104+static int
54105+lookup_special_role_auth(__u16 mode, const char *rolename, unsigned char **salt,
54106+ unsigned char **sum)
54107+{
54108+ struct acl_role_label *r;
54109+ struct role_allowed_ip *ipp;
54110+ struct role_transition *trans;
54111+ unsigned int i;
54112+ int found = 0;
54113+ u32 curr_ip = current->signal->curr_ip;
54114+
54115+ current->signal->saved_ip = curr_ip;
54116+
54117+ /* check transition table */
54118+
54119+ for (trans = current->role->transitions; trans; trans = trans->next) {
54120+ if (!strcmp(rolename, trans->rolename)) {
54121+ found = 1;
54122+ break;
54123+ }
54124+ }
54125+
54126+ if (!found)
54127+ return 0;
54128+
54129+ /* handle special roles that do not require authentication
54130+ and check ip */
54131+
54132+ FOR_EACH_ROLE_START(r)
54133+ if (!strcmp(rolename, r->rolename) &&
54134+ (r->roletype & GR_ROLE_SPECIAL)) {
54135+ found = 0;
54136+ if (r->allowed_ips != NULL) {
54137+ for (ipp = r->allowed_ips; ipp; ipp = ipp->next) {
54138+ if ((ntohl(curr_ip) & ipp->netmask) ==
54139+ (ntohl(ipp->addr) & ipp->netmask))
54140+ found = 1;
54141+ }
54142+ } else
54143+ found = 2;
54144+ if (!found)
54145+ return 0;
54146+
54147+ if (((mode == GR_SPROLE) && (r->roletype & GR_ROLE_NOPW)) ||
54148+ ((mode == GR_SPROLEPAM) && (r->roletype & GR_ROLE_PAM))) {
54149+ *salt = NULL;
54150+ *sum = NULL;
54151+ return 1;
54152+ }
54153+ }
54154+ FOR_EACH_ROLE_END(r)
54155+
54156+ for (i = 0; i < num_sprole_pws; i++) {
54157+ if (!strcmp(rolename, acl_special_roles[i]->rolename)) {
54158+ *salt = acl_special_roles[i]->salt;
54159+ *sum = acl_special_roles[i]->sum;
54160+ return 1;
54161+ }
54162+ }
54163+
54164+ return 0;
54165+}
54166+
54167+static void
54168+assign_special_role(char *rolename)
54169+{
54170+ struct acl_object_label *obj;
54171+ struct acl_role_label *r;
54172+ struct acl_role_label *assigned = NULL;
54173+ struct task_struct *tsk;
54174+ struct file *filp;
54175+
54176+ FOR_EACH_ROLE_START(r)
54177+ if (!strcmp(rolename, r->rolename) &&
54178+ (r->roletype & GR_ROLE_SPECIAL)) {
54179+ assigned = r;
54180+ break;
54181+ }
54182+ FOR_EACH_ROLE_END(r)
54183+
54184+ if (!assigned)
54185+ return;
54186+
54187+ read_lock(&tasklist_lock);
54188+ read_lock(&grsec_exec_file_lock);
54189+
54190+ tsk = current->real_parent;
54191+ if (tsk == NULL)
54192+ goto out_unlock;
54193+
54194+ filp = tsk->exec_file;
54195+ if (filp == NULL)
54196+ goto out_unlock;
54197+
54198+ tsk->is_writable = 0;
54199+
54200+ tsk->acl_sp_role = 1;
54201+ tsk->acl_role_id = ++acl_sp_role_value;
54202+ tsk->role = assigned;
54203+ tsk->acl = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt, tsk->role);
54204+
54205+ /* ignore additional mmap checks for processes that are writable
54206+ by the default ACL */
54207+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
54208+ if (unlikely(obj->mode & GR_WRITE))
54209+ tsk->is_writable = 1;
54210+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, tsk->role->root_label);
54211+ if (unlikely(obj->mode & GR_WRITE))
54212+ tsk->is_writable = 1;
54213+
54214+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
54215+ printk(KERN_ALERT "Assigning special role:%s subject:%s to process (%s:%d)\n", tsk->role->rolename, tsk->acl->filename, tsk->comm, tsk->pid);
54216+#endif
54217+
54218+out_unlock:
54219+ read_unlock(&grsec_exec_file_lock);
54220+ read_unlock(&tasklist_lock);
54221+ return;
54222+}
54223+
54224+int gr_check_secure_terminal(struct task_struct *task)
54225+{
54226+ struct task_struct *p, *p2, *p3;
54227+ struct files_struct *files;
54228+ struct fdtable *fdt;
54229+ struct file *our_file = NULL, *file;
54230+ int i;
54231+
54232+ if (task->signal->tty == NULL)
54233+ return 1;
54234+
54235+ files = get_files_struct(task);
54236+ if (files != NULL) {
54237+ rcu_read_lock();
54238+ fdt = files_fdtable(files);
54239+ for (i=0; i < fdt->max_fds; i++) {
54240+ file = fcheck_files(files, i);
54241+ if (file && (our_file == NULL) && (file->private_data == task->signal->tty)) {
54242+ get_file(file);
54243+ our_file = file;
54244+ }
54245+ }
54246+ rcu_read_unlock();
54247+ put_files_struct(files);
54248+ }
54249+
54250+ if (our_file == NULL)
54251+ return 1;
54252+
54253+ read_lock(&tasklist_lock);
54254+ do_each_thread(p2, p) {
54255+ files = get_files_struct(p);
54256+ if (files == NULL ||
54257+ (p->signal && p->signal->tty == task->signal->tty)) {
54258+ if (files != NULL)
54259+ put_files_struct(files);
54260+ continue;
54261+ }
54262+ rcu_read_lock();
54263+ fdt = files_fdtable(files);
54264+ for (i=0; i < fdt->max_fds; i++) {
54265+ file = fcheck_files(files, i);
54266+ if (file && S_ISCHR(file->f_path.dentry->d_inode->i_mode) &&
54267+ file->f_path.dentry->d_inode->i_rdev == our_file->f_path.dentry->d_inode->i_rdev) {
54268+ p3 = task;
54269+ while (p3->pid > 0) {
54270+ if (p3 == p)
54271+ break;
54272+ p3 = p3->real_parent;
54273+ }
54274+ if (p3 == p)
54275+ break;
54276+ gr_log_ttysniff(GR_DONT_AUDIT_GOOD, GR_TTYSNIFF_ACL_MSG, p);
54277+ gr_handle_alertkill(p);
54278+ rcu_read_unlock();
54279+ put_files_struct(files);
54280+ read_unlock(&tasklist_lock);
54281+ fput(our_file);
54282+ return 0;
54283+ }
54284+ }
54285+ rcu_read_unlock();
54286+ put_files_struct(files);
54287+ } while_each_thread(p2, p);
54288+ read_unlock(&tasklist_lock);
54289+
54290+ fput(our_file);
54291+ return 1;
54292+}
54293+
54294+ssize_t
54295+write_grsec_handler(struct file *file, const char * buf, size_t count, loff_t *ppos)
54296+{
54297+ struct gr_arg_wrapper uwrap;
54298+ unsigned char *sprole_salt = NULL;
54299+ unsigned char *sprole_sum = NULL;
54300+ int error = sizeof (struct gr_arg_wrapper);
54301+ int error2 = 0;
54302+
54303+ mutex_lock(&gr_dev_mutex);
54304+
54305+ if ((gr_status & GR_READY) && !(current->acl->mode & GR_KERNELAUTH)) {
54306+ error = -EPERM;
54307+ goto out;
54308+ }
54309+
54310+ if (count != sizeof (struct gr_arg_wrapper)) {
54311+ gr_log_int_int(GR_DONT_AUDIT_GOOD, GR_DEV_ACL_MSG, (int)count, (int)sizeof(struct gr_arg_wrapper));
54312+ error = -EINVAL;
54313+ goto out;
54314+ }
54315+
54316+
54317+ if (gr_auth_expires && time_after_eq(get_seconds(), gr_auth_expires)) {
54318+ gr_auth_expires = 0;
54319+ gr_auth_attempts = 0;
54320+ }
54321+
54322+ if (copy_from_user(&uwrap, buf, sizeof (struct gr_arg_wrapper))) {
54323+ error = -EFAULT;
54324+ goto out;
54325+ }
54326+
54327+ if ((uwrap.version != GRSECURITY_VERSION) || (uwrap.size != sizeof(struct gr_arg))) {
54328+ error = -EINVAL;
54329+ goto out;
54330+ }
54331+
54332+ if (copy_from_user(gr_usermode, uwrap.arg, sizeof (struct gr_arg))) {
54333+ error = -EFAULT;
54334+ goto out;
54335+ }
54336+
54337+ if (gr_usermode->mode != GR_SPROLE && gr_usermode->mode != GR_SPROLEPAM &&
54338+ gr_auth_attempts >= CONFIG_GRKERNSEC_ACL_MAXTRIES &&
54339+ time_after(gr_auth_expires, get_seconds())) {
54340+ error = -EBUSY;
54341+ goto out;
54342+ }
54343+
54344+ /* if non-root trying to do anything other than use a special role,
54345+ do not attempt authentication, do not count towards authentication
54346+ locking
54347+ */
54348+
54349+ if (gr_usermode->mode != GR_SPROLE && gr_usermode->mode != GR_STATUS &&
54350+ gr_usermode->mode != GR_UNSPROLE && gr_usermode->mode != GR_SPROLEPAM &&
54351+ current_uid()) {
54352+ error = -EPERM;
54353+ goto out;
54354+ }
54355+
54356+ /* ensure pw and special role name are null terminated */
54357+
54358+ gr_usermode->pw[GR_PW_LEN - 1] = '\0';
54359+ gr_usermode->sp_role[GR_SPROLE_LEN - 1] = '\0';
54360+
54361+ /* Okay.
54362+ * We have our enough of the argument structure..(we have yet
54363+ * to copy_from_user the tables themselves) . Copy the tables
54364+ * only if we need them, i.e. for loading operations. */
54365+
54366+ switch (gr_usermode->mode) {
54367+ case GR_STATUS:
54368+ if (gr_status & GR_READY) {
54369+ error = 1;
54370+ if (!gr_check_secure_terminal(current))
54371+ error = 3;
54372+ } else
54373+ error = 2;
54374+ goto out;
54375+ case GR_SHUTDOWN:
54376+ if ((gr_status & GR_READY)
54377+ && !(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
54378+ pax_open_kernel();
54379+ gr_status &= ~GR_READY;
54380+ pax_close_kernel();
54381+
54382+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SHUTS_ACL_MSG);
54383+ free_variables();
54384+ memset(gr_usermode, 0, sizeof (struct gr_arg));
54385+ memset(gr_system_salt, 0, GR_SALT_LEN);
54386+ memset(gr_system_sum, 0, GR_SHA_LEN);
54387+ } else if (gr_status & GR_READY) {
54388+ gr_log_noargs(GR_DONT_AUDIT, GR_SHUTF_ACL_MSG);
54389+ error = -EPERM;
54390+ } else {
54391+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SHUTI_ACL_MSG);
54392+ error = -EAGAIN;
54393+ }
54394+ break;
54395+ case GR_ENABLE:
54396+ if (!(gr_status & GR_READY) && !(error2 = gracl_init(gr_usermode)))
54397+ gr_log_str(GR_DONT_AUDIT_GOOD, GR_ENABLE_ACL_MSG, GR_VERSION);
54398+ else {
54399+ if (gr_status & GR_READY)
54400+ error = -EAGAIN;
54401+ else
54402+ error = error2;
54403+ gr_log_str(GR_DONT_AUDIT, GR_ENABLEF_ACL_MSG, GR_VERSION);
54404+ }
54405+ break;
54406+ case GR_RELOAD:
54407+ if (!(gr_status & GR_READY)) {
54408+ gr_log_str(GR_DONT_AUDIT_GOOD, GR_RELOADI_ACL_MSG, GR_VERSION);
54409+ error = -EAGAIN;
54410+ } else if (!(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
54411+ preempt_disable();
54412+
54413+ pax_open_kernel();
54414+ gr_status &= ~GR_READY;
54415+ pax_close_kernel();
54416+
54417+ free_variables();
54418+ if (!(error2 = gracl_init(gr_usermode))) {
54419+ preempt_enable();
54420+ gr_log_str(GR_DONT_AUDIT_GOOD, GR_RELOAD_ACL_MSG, GR_VERSION);
54421+ } else {
54422+ preempt_enable();
54423+ error = error2;
54424+ gr_log_str(GR_DONT_AUDIT, GR_RELOADF_ACL_MSG, GR_VERSION);
54425+ }
54426+ } else {
54427+ gr_log_str(GR_DONT_AUDIT, GR_RELOADF_ACL_MSG, GR_VERSION);
54428+ error = -EPERM;
54429+ }
54430+ break;
54431+ case GR_SEGVMOD:
54432+ if (unlikely(!(gr_status & GR_READY))) {
54433+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SEGVMODI_ACL_MSG);
54434+ error = -EAGAIN;
54435+ break;
54436+ }
54437+
54438+ if (!(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
54439+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SEGVMODS_ACL_MSG);
54440+ if (gr_usermode->segv_device && gr_usermode->segv_inode) {
54441+ struct acl_subject_label *segvacl;
54442+ segvacl =
54443+ lookup_acl_subj_label(gr_usermode->segv_inode,
54444+ gr_usermode->segv_device,
54445+ current->role);
54446+ if (segvacl) {
54447+ segvacl->crashes = 0;
54448+ segvacl->expires = 0;
54449+ }
54450+ } else if (gr_find_uid(gr_usermode->segv_uid) >= 0) {
54451+ gr_remove_uid(gr_usermode->segv_uid);
54452+ }
54453+ } else {
54454+ gr_log_noargs(GR_DONT_AUDIT, GR_SEGVMODF_ACL_MSG);
54455+ error = -EPERM;
54456+ }
54457+ break;
54458+ case GR_SPROLE:
54459+ case GR_SPROLEPAM:
54460+ if (unlikely(!(gr_status & GR_READY))) {
54461+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SPROLEI_ACL_MSG);
54462+ error = -EAGAIN;
54463+ break;
54464+ }
54465+
54466+ if (current->role->expires && time_after_eq(get_seconds(), current->role->expires)) {
54467+ current->role->expires = 0;
54468+ current->role->auth_attempts = 0;
54469+ }
54470+
54471+ if (current->role->auth_attempts >= CONFIG_GRKERNSEC_ACL_MAXTRIES &&
54472+ time_after(current->role->expires, get_seconds())) {
54473+ error = -EBUSY;
54474+ goto out;
54475+ }
54476+
54477+ if (lookup_special_role_auth
54478+ (gr_usermode->mode, gr_usermode->sp_role, &sprole_salt, &sprole_sum)
54479+ && ((!sprole_salt && !sprole_sum)
54480+ || !(chkpw(gr_usermode, sprole_salt, sprole_sum)))) {
54481+ char *p = "";
54482+ assign_special_role(gr_usermode->sp_role);
54483+ read_lock(&tasklist_lock);
54484+ if (current->real_parent)
54485+ p = current->real_parent->role->rolename;
54486+ read_unlock(&tasklist_lock);
54487+ gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_SPROLES_ACL_MSG,
54488+ p, acl_sp_role_value);
54489+ } else {
54490+ gr_log_str(GR_DONT_AUDIT, GR_SPROLEF_ACL_MSG, gr_usermode->sp_role);
54491+ error = -EPERM;
54492+ if(!(current->role->auth_attempts++))
54493+ current->role->expires = get_seconds() + CONFIG_GRKERNSEC_ACL_TIMEOUT;
54494+
54495+ goto out;
54496+ }
54497+ break;
54498+ case GR_UNSPROLE:
54499+ if (unlikely(!(gr_status & GR_READY))) {
54500+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_UNSPROLEI_ACL_MSG);
54501+ error = -EAGAIN;
54502+ break;
54503+ }
54504+
54505+ if (current->role->roletype & GR_ROLE_SPECIAL) {
54506+ char *p = "";
54507+ int i = 0;
54508+
54509+ read_lock(&tasklist_lock);
54510+ if (current->real_parent) {
54511+ p = current->real_parent->role->rolename;
54512+ i = current->real_parent->acl_role_id;
54513+ }
54514+ read_unlock(&tasklist_lock);
54515+
54516+ gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_UNSPROLES_ACL_MSG, p, i);
54517+ gr_set_acls(1);
54518+ } else {
54519+ error = -EPERM;
54520+ goto out;
54521+ }
54522+ break;
54523+ default:
54524+ gr_log_int(GR_DONT_AUDIT, GR_INVMODE_ACL_MSG, gr_usermode->mode);
54525+ error = -EINVAL;
54526+ break;
54527+ }
54528+
54529+ if (error != -EPERM)
54530+ goto out;
54531+
54532+ if(!(gr_auth_attempts++))
54533+ gr_auth_expires = get_seconds() + CONFIG_GRKERNSEC_ACL_TIMEOUT;
54534+
54535+ out:
54536+ mutex_unlock(&gr_dev_mutex);
54537+ return error;
54538+}
54539+
54540+/* must be called with
54541+ rcu_read_lock();
54542+ read_lock(&tasklist_lock);
54543+ read_lock(&grsec_exec_file_lock);
54544+*/
54545+int gr_apply_subject_to_task(struct task_struct *task)
54546+{
54547+ struct acl_object_label *obj;
54548+ char *tmpname;
54549+ struct acl_subject_label *tmpsubj;
54550+ struct file *filp;
54551+ struct name_entry *nmatch;
54552+
54553+ filp = task->exec_file;
54554+ if (filp == NULL)
54555+ return 0;
54556+
54557+ /* the following is to apply the correct subject
54558+ on binaries running when the RBAC system
54559+ is enabled, when the binaries have been
54560+ replaced or deleted since their execution
54561+ -----
54562+ when the RBAC system starts, the inode/dev
54563+ from exec_file will be one the RBAC system
54564+ is unaware of. It only knows the inode/dev
54565+ of the present file on disk, or the absence
54566+ of it.
54567+ */
54568+ preempt_disable();
54569+ tmpname = gr_to_filename_rbac(filp->f_path.dentry, filp->f_path.mnt);
54570+
54571+ nmatch = lookup_name_entry(tmpname);
54572+ preempt_enable();
54573+ tmpsubj = NULL;
54574+ if (nmatch) {
54575+ if (nmatch->deleted)
54576+ tmpsubj = lookup_acl_subj_label_deleted(nmatch->inode, nmatch->device, task->role);
54577+ else
54578+ tmpsubj = lookup_acl_subj_label(nmatch->inode, nmatch->device, task->role);
54579+ if (tmpsubj != NULL)
54580+ task->acl = tmpsubj;
54581+ }
54582+ if (tmpsubj == NULL)
54583+ task->acl = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt,
54584+ task->role);
54585+ if (task->acl) {
54586+ struct acl_subject_label *curr;
54587+ curr = task->acl;
54588+
54589+ task->is_writable = 0;
54590+ /* ignore additional mmap checks for processes that are writable
54591+ by the default ACL */
54592+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
54593+ if (unlikely(obj->mode & GR_WRITE))
54594+ task->is_writable = 1;
54595+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, task->role->root_label);
54596+ if (unlikely(obj->mode & GR_WRITE))
54597+ task->is_writable = 1;
54598+
54599+ gr_set_proc_res(task);
54600+
54601+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
54602+ printk(KERN_ALERT "gr_set_acls for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
54603+#endif
54604+ } else {
54605+ return 1;
54606+ }
54607+
54608+ return 0;
54609+}
54610+
54611+int
54612+gr_set_acls(const int type)
54613+{
54614+ struct task_struct *task, *task2;
54615+ struct acl_role_label *role = current->role;
54616+ __u16 acl_role_id = current->acl_role_id;
54617+ const struct cred *cred;
54618+ int ret;
54619+
54620+ rcu_read_lock();
54621+ read_lock(&tasklist_lock);
54622+ read_lock(&grsec_exec_file_lock);
54623+ do_each_thread(task2, task) {
54624+ /* check to see if we're called from the exit handler,
54625+ if so, only replace ACLs that have inherited the admin
54626+ ACL */
54627+
54628+ if (type && (task->role != role ||
54629+ task->acl_role_id != acl_role_id))
54630+ continue;
54631+
54632+ task->acl_role_id = 0;
54633+ task->acl_sp_role = 0;
54634+
54635+ if (task->exec_file) {
54636+ cred = __task_cred(task);
54637+ task->role = lookup_acl_role_label(task, cred->uid, cred->gid);
54638+ ret = gr_apply_subject_to_task(task);
54639+ if (ret) {
54640+ read_unlock(&grsec_exec_file_lock);
54641+ read_unlock(&tasklist_lock);
54642+ rcu_read_unlock();
54643+ gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_DEFACL_MSG, task->comm, task->pid);
54644+ return ret;
54645+ }
54646+ } else {
54647+ // it's a kernel process
54648+ task->role = kernel_role;
54649+ task->acl = kernel_role->root_label;
54650+#ifdef CONFIG_GRKERNSEC_ACL_HIDEKERN
54651+ task->acl->mode &= ~GR_PROCFIND;
54652+#endif
54653+ }
54654+ } while_each_thread(task2, task);
54655+ read_unlock(&grsec_exec_file_lock);
54656+ read_unlock(&tasklist_lock);
54657+ rcu_read_unlock();
54658+
54659+ return 0;
54660+}
54661+
54662+void
54663+gr_learn_resource(const struct task_struct *task,
54664+ const int res, const unsigned long wanted, const int gt)
54665+{
54666+ struct acl_subject_label *acl;
54667+ const struct cred *cred;
54668+
54669+ if (unlikely((gr_status & GR_READY) &&
54670+ task->acl && (task->acl->mode & (GR_LEARN | GR_INHERITLEARN))))
54671+ goto skip_reslog;
54672+
54673+#ifdef CONFIG_GRKERNSEC_RESLOG
54674+ gr_log_resource(task, res, wanted, gt);
54675+#endif
54676+ skip_reslog:
54677+
54678+ if (unlikely(!(gr_status & GR_READY) || !wanted || res >= GR_NLIMITS))
54679+ return;
54680+
54681+ acl = task->acl;
54682+
54683+ if (likely(!acl || !(acl->mode & (GR_LEARN | GR_INHERITLEARN)) ||
54684+ !(acl->resmask & (1 << (unsigned short) res))))
54685+ return;
54686+
54687+ if (wanted >= acl->res[res].rlim_cur) {
54688+ unsigned long res_add;
54689+
54690+ res_add = wanted;
54691+ switch (res) {
54692+ case RLIMIT_CPU:
54693+ res_add += GR_RLIM_CPU_BUMP;
54694+ break;
54695+ case RLIMIT_FSIZE:
54696+ res_add += GR_RLIM_FSIZE_BUMP;
54697+ break;
54698+ case RLIMIT_DATA:
54699+ res_add += GR_RLIM_DATA_BUMP;
54700+ break;
54701+ case RLIMIT_STACK:
54702+ res_add += GR_RLIM_STACK_BUMP;
54703+ break;
54704+ case RLIMIT_CORE:
54705+ res_add += GR_RLIM_CORE_BUMP;
54706+ break;
54707+ case RLIMIT_RSS:
54708+ res_add += GR_RLIM_RSS_BUMP;
54709+ break;
54710+ case RLIMIT_NPROC:
54711+ res_add += GR_RLIM_NPROC_BUMP;
54712+ break;
54713+ case RLIMIT_NOFILE:
54714+ res_add += GR_RLIM_NOFILE_BUMP;
54715+ break;
54716+ case RLIMIT_MEMLOCK:
54717+ res_add += GR_RLIM_MEMLOCK_BUMP;
54718+ break;
54719+ case RLIMIT_AS:
54720+ res_add += GR_RLIM_AS_BUMP;
54721+ break;
54722+ case RLIMIT_LOCKS:
54723+ res_add += GR_RLIM_LOCKS_BUMP;
54724+ break;
54725+ case RLIMIT_SIGPENDING:
54726+ res_add += GR_RLIM_SIGPENDING_BUMP;
54727+ break;
54728+ case RLIMIT_MSGQUEUE:
54729+ res_add += GR_RLIM_MSGQUEUE_BUMP;
54730+ break;
54731+ case RLIMIT_NICE:
54732+ res_add += GR_RLIM_NICE_BUMP;
54733+ break;
54734+ case RLIMIT_RTPRIO:
54735+ res_add += GR_RLIM_RTPRIO_BUMP;
54736+ break;
54737+ case RLIMIT_RTTIME:
54738+ res_add += GR_RLIM_RTTIME_BUMP;
54739+ break;
54740+ }
54741+
54742+ acl->res[res].rlim_cur = res_add;
54743+
54744+ if (wanted > acl->res[res].rlim_max)
54745+ acl->res[res].rlim_max = res_add;
54746+
54747+ /* only log the subject filename, since resource logging is supported for
54748+ single-subject learning only */
54749+ rcu_read_lock();
54750+ cred = __task_cred(task);
54751+ security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename,
54752+ task->role->roletype, cred->uid, cred->gid, acl->filename,
54753+ acl->filename, acl->res[res].rlim_cur, acl->res[res].rlim_max,
54754+ "", (unsigned long) res, &task->signal->saved_ip);
54755+ rcu_read_unlock();
54756+ }
54757+
54758+ return;
54759+}
54760+
54761+#if defined(CONFIG_PAX_HAVE_ACL_FLAGS) && (defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR))
54762+void
54763+pax_set_initial_flags(struct linux_binprm *bprm)
54764+{
54765+ struct task_struct *task = current;
54766+ struct acl_subject_label *proc;
54767+ unsigned long flags;
54768+
54769+ if (unlikely(!(gr_status & GR_READY)))
54770+ return;
54771+
54772+ flags = pax_get_flags(task);
54773+
54774+ proc = task->acl;
54775+
54776+ if (proc->pax_flags & GR_PAX_DISABLE_PAGEEXEC)
54777+ flags &= ~MF_PAX_PAGEEXEC;
54778+ if (proc->pax_flags & GR_PAX_DISABLE_SEGMEXEC)
54779+ flags &= ~MF_PAX_SEGMEXEC;
54780+ if (proc->pax_flags & GR_PAX_DISABLE_RANDMMAP)
54781+ flags &= ~MF_PAX_RANDMMAP;
54782+ if (proc->pax_flags & GR_PAX_DISABLE_EMUTRAMP)
54783+ flags &= ~MF_PAX_EMUTRAMP;
54784+ if (proc->pax_flags & GR_PAX_DISABLE_MPROTECT)
54785+ flags &= ~MF_PAX_MPROTECT;
54786+
54787+ if (proc->pax_flags & GR_PAX_ENABLE_PAGEEXEC)
54788+ flags |= MF_PAX_PAGEEXEC;
54789+ if (proc->pax_flags & GR_PAX_ENABLE_SEGMEXEC)
54790+ flags |= MF_PAX_SEGMEXEC;
54791+ if (proc->pax_flags & GR_PAX_ENABLE_RANDMMAP)
54792+ flags |= MF_PAX_RANDMMAP;
54793+ if (proc->pax_flags & GR_PAX_ENABLE_EMUTRAMP)
54794+ flags |= MF_PAX_EMUTRAMP;
54795+ if (proc->pax_flags & GR_PAX_ENABLE_MPROTECT)
54796+ flags |= MF_PAX_MPROTECT;
54797+
54798+ pax_set_flags(task, flags);
54799+
54800+ return;
54801+}
54802+#endif
54803+
54804+#ifdef CONFIG_SYSCTL
54805+/* Eric Biederman likes breaking userland ABI and every inode-based security
54806+ system to save 35kb of memory */
54807+
54808+/* we modify the passed in filename, but adjust it back before returning */
54809+static struct acl_object_label *gr_lookup_by_name(char *name, unsigned int len)
54810+{
54811+ struct name_entry *nmatch;
54812+ char *p, *lastp = NULL;
54813+ struct acl_object_label *obj = NULL, *tmp;
54814+ struct acl_subject_label *tmpsubj;
54815+ char c = '\0';
54816+
54817+ read_lock(&gr_inode_lock);
54818+
54819+ p = name + len - 1;
54820+ do {
54821+ nmatch = lookup_name_entry(name);
54822+ if (lastp != NULL)
54823+ *lastp = c;
54824+
54825+ if (nmatch == NULL)
54826+ goto next_component;
54827+ tmpsubj = current->acl;
54828+ do {
54829+ obj = lookup_acl_obj_label(nmatch->inode, nmatch->device, tmpsubj);
54830+ if (obj != NULL) {
54831+ tmp = obj->globbed;
54832+ while (tmp) {
54833+ if (!glob_match(tmp->filename, name)) {
54834+ obj = tmp;
54835+ goto found_obj;
54836+ }
54837+ tmp = tmp->next;
54838+ }
54839+ goto found_obj;
54840+ }
54841+ } while ((tmpsubj = tmpsubj->parent_subject));
54842+next_component:
54843+ /* end case */
54844+ if (p == name)
54845+ break;
54846+
54847+ while (*p != '/')
54848+ p--;
54849+ if (p == name)
54850+ lastp = p + 1;
54851+ else {
54852+ lastp = p;
54853+ p--;
54854+ }
54855+ c = *lastp;
54856+ *lastp = '\0';
54857+ } while (1);
54858+found_obj:
54859+ read_unlock(&gr_inode_lock);
54860+ /* obj returned will always be non-null */
54861+ return obj;
54862+}
54863+
54864+/* returns 0 when allowing, non-zero on error
54865+ op of 0 is used for readdir, so we don't log the names of hidden files
54866+*/
54867+__u32
54868+gr_handle_sysctl(const struct ctl_table *table, const int op)
54869+{
54870+ struct ctl_table *tmp;
54871+ const char *proc_sys = "/proc/sys";
54872+ char *path;
54873+ struct acl_object_label *obj;
54874+ unsigned short len = 0, pos = 0, depth = 0, i;
54875+ __u32 err = 0;
54876+ __u32 mode = 0;
54877+
54878+ if (unlikely(!(gr_status & GR_READY)))
54879+ return 0;
54880+
54881+ /* for now, ignore operations on non-sysctl entries if it's not a
54882+ readdir*/
54883+ if (table->child != NULL && op != 0)
54884+ return 0;
54885+
54886+ mode |= GR_FIND;
54887+ /* it's only a read if it's an entry, read on dirs is for readdir */
54888+ if (op & MAY_READ)
54889+ mode |= GR_READ;
54890+ if (op & MAY_WRITE)
54891+ mode |= GR_WRITE;
54892+
54893+ preempt_disable();
54894+
54895+ path = per_cpu_ptr(gr_shared_page[0], smp_processor_id());
54896+
54897+ /* it's only a read/write if it's an actual entry, not a dir
54898+ (which are opened for readdir)
54899+ */
54900+
54901+ /* convert the requested sysctl entry into a pathname */
54902+
54903+ for (tmp = (struct ctl_table *)table; tmp != NULL; tmp = tmp->parent) {
54904+ len += strlen(tmp->procname);
54905+ len++;
54906+ depth++;
54907+ }
54908+
54909+ if ((len + depth + strlen(proc_sys) + 1) > PAGE_SIZE) {
54910+ /* deny */
54911+ goto out;
54912+ }
54913+
54914+ memset(path, 0, PAGE_SIZE);
54915+
54916+ memcpy(path, proc_sys, strlen(proc_sys));
54917+
54918+ pos += strlen(proc_sys);
54919+
54920+ for (; depth > 0; depth--) {
54921+ path[pos] = '/';
54922+ pos++;
54923+ for (i = 1, tmp = (struct ctl_table *)table; tmp != NULL; tmp = tmp->parent) {
54924+ if (depth == i) {
54925+ memcpy(path + pos, tmp->procname,
54926+ strlen(tmp->procname));
54927+ pos += strlen(tmp->procname);
54928+ }
54929+ i++;
54930+ }
54931+ }
54932+
54933+ obj = gr_lookup_by_name(path, pos);
54934+ err = obj->mode & (mode | to_gr_audit(mode) | GR_SUPPRESS);
54935+
54936+ if (unlikely((current->acl->mode & (GR_LEARN | GR_INHERITLEARN)) &&
54937+ ((err & mode) != mode))) {
54938+ __u32 new_mode = mode;
54939+
54940+ new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
54941+
54942+ err = 0;
54943+ gr_log_learn_sysctl(path, new_mode);
54944+ } else if (!(err & GR_FIND) && !(err & GR_SUPPRESS) && op != 0) {
54945+ gr_log_hidden_sysctl(GR_DONT_AUDIT, GR_HIDDEN_ACL_MSG, path);
54946+ err = -ENOENT;
54947+ } else if (!(err & GR_FIND)) {
54948+ err = -ENOENT;
54949+ } else if (((err & mode) & ~GR_FIND) != (mode & ~GR_FIND) && !(err & GR_SUPPRESS)) {
54950+ gr_log_str4(GR_DONT_AUDIT, GR_SYSCTL_ACL_MSG, "denied",
54951+ path, (mode & GR_READ) ? " reading" : "",
54952+ (mode & GR_WRITE) ? " writing" : "");
54953+ err = -EACCES;
54954+ } else if ((err & mode) != mode) {
54955+ err = -EACCES;
54956+ } else if ((((err & mode) & ~GR_FIND) == (mode & ~GR_FIND)) && (err & GR_AUDITS)) {
54957+ gr_log_str4(GR_DO_AUDIT, GR_SYSCTL_ACL_MSG, "successful",
54958+ path, (mode & GR_READ) ? " reading" : "",
54959+ (mode & GR_WRITE) ? " writing" : "");
54960+ err = 0;
54961+ } else
54962+ err = 0;
54963+
54964+ out:
54965+ preempt_enable();
54966+
54967+ return err;
54968+}
54969+#endif
54970+
54971+int
54972+gr_handle_proc_ptrace(struct task_struct *task)
54973+{
54974+ struct file *filp;
54975+ struct task_struct *tmp = task;
54976+ struct task_struct *curtemp = current;
54977+ __u32 retmode;
54978+
54979+#ifndef CONFIG_GRKERNSEC_HARDEN_PTRACE
54980+ if (unlikely(!(gr_status & GR_READY)))
54981+ return 0;
54982+#endif
54983+
54984+ read_lock(&tasklist_lock);
54985+ read_lock(&grsec_exec_file_lock);
54986+ filp = task->exec_file;
54987+
54988+ while (tmp->pid > 0) {
54989+ if (tmp == curtemp)
54990+ break;
54991+ tmp = tmp->real_parent;
54992+ }
54993+
54994+ if (!filp || (tmp->pid == 0 && ((grsec_enable_harden_ptrace && current_uid() && !(gr_status & GR_READY)) ||
54995+ ((gr_status & GR_READY) && !(current->acl->mode & GR_RELAXPTRACE))))) {
54996+ read_unlock(&grsec_exec_file_lock);
54997+ read_unlock(&tasklist_lock);
54998+ return 1;
54999+ }
55000+
55001+#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
55002+ if (!(gr_status & GR_READY)) {
55003+ read_unlock(&grsec_exec_file_lock);
55004+ read_unlock(&tasklist_lock);
55005+ return 0;
55006+ }
55007+#endif
55008+
55009+ retmode = gr_search_file(filp->f_path.dentry, GR_NOPTRACE, filp->f_path.mnt);
55010+ read_unlock(&grsec_exec_file_lock);
55011+ read_unlock(&tasklist_lock);
55012+
55013+ if (retmode & GR_NOPTRACE)
55014+ return 1;
55015+
55016+ if (!(current->acl->mode & GR_POVERRIDE) && !(current->role->roletype & GR_ROLE_GOD)
55017+ && (current->acl != task->acl || (current->acl != current->role->root_label
55018+ && current->pid != task->pid)))
55019+ return 1;
55020+
55021+ return 0;
55022+}
55023+
55024+void task_grsec_rbac(struct seq_file *m, struct task_struct *p)
55025+{
55026+ if (unlikely(!(gr_status & GR_READY)))
55027+ return;
55028+
55029+ if (!(current->role->roletype & GR_ROLE_GOD))
55030+ return;
55031+
55032+ seq_printf(m, "RBAC:\t%.64s:%c:%.950s\n",
55033+ p->role->rolename, gr_task_roletype_to_char(p),
55034+ p->acl->filename);
55035+}
55036+
55037+int
55038+gr_handle_ptrace(struct task_struct *task, const long request)
55039+{
55040+ struct task_struct *tmp = task;
55041+ struct task_struct *curtemp = current;
55042+ __u32 retmode;
55043+
55044+#ifndef CONFIG_GRKERNSEC_HARDEN_PTRACE
55045+ if (unlikely(!(gr_status & GR_READY)))
55046+ return 0;
55047+#endif
55048+
55049+ read_lock(&tasklist_lock);
55050+ while (tmp->pid > 0) {
55051+ if (tmp == curtemp)
55052+ break;
55053+ tmp = tmp->real_parent;
55054+ }
55055+
55056+ if (tmp->pid == 0 && ((grsec_enable_harden_ptrace && current_uid() && !(gr_status & GR_READY)) ||
55057+ ((gr_status & GR_READY) && !(current->acl->mode & GR_RELAXPTRACE)))) {
55058+ read_unlock(&tasklist_lock);
55059+ gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
55060+ return 1;
55061+ }
55062+ read_unlock(&tasklist_lock);
55063+
55064+#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
55065+ if (!(gr_status & GR_READY))
55066+ return 0;
55067+#endif
55068+
55069+ read_lock(&grsec_exec_file_lock);
55070+ if (unlikely(!task->exec_file)) {
55071+ read_unlock(&grsec_exec_file_lock);
55072+ return 0;
55073+ }
55074+
55075+ retmode = gr_search_file(task->exec_file->f_path.dentry, GR_PTRACERD | GR_NOPTRACE, task->exec_file->f_path.mnt);
55076+ read_unlock(&grsec_exec_file_lock);
55077+
55078+ if (retmode & GR_NOPTRACE) {
55079+ gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
55080+ return 1;
55081+ }
55082+
55083+ if (retmode & GR_PTRACERD) {
55084+ switch (request) {
55085+ case PTRACE_POKETEXT:
55086+ case PTRACE_POKEDATA:
55087+ case PTRACE_POKEUSR:
55088+#if !defined(CONFIG_PPC32) && !defined(CONFIG_PPC64) && !defined(CONFIG_PARISC) && !defined(CONFIG_ALPHA) && !defined(CONFIG_IA64)
55089+ case PTRACE_SETREGS:
55090+ case PTRACE_SETFPREGS:
55091+#endif
55092+#ifdef CONFIG_X86
55093+ case PTRACE_SETFPXREGS:
55094+#endif
55095+#ifdef CONFIG_ALTIVEC
55096+ case PTRACE_SETVRREGS:
55097+#endif
55098+ return 1;
55099+ default:
55100+ return 0;
55101+ }
55102+ } else if (!(current->acl->mode & GR_POVERRIDE) &&
55103+ !(current->role->roletype & GR_ROLE_GOD) &&
55104+ (current->acl != task->acl)) {
55105+ gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
55106+ return 1;
55107+ }
55108+
55109+ return 0;
55110+}
55111+
55112+static int is_writable_mmap(const struct file *filp)
55113+{
55114+ struct task_struct *task = current;
55115+ struct acl_object_label *obj, *obj2;
55116+
55117+ if (gr_status & GR_READY && !(task->acl->mode & GR_OVERRIDE) &&
55118+ !task->is_writable && S_ISREG(filp->f_path.dentry->d_inode->i_mode) && (filp->f_path.mnt != shm_mnt || (filp->f_path.dentry->d_inode->i_nlink > 0))) {
55119+ obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
55120+ obj2 = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt,
55121+ task->role->root_label);
55122+ if (unlikely((obj->mode & GR_WRITE) || (obj2->mode & GR_WRITE))) {
55123+ gr_log_fs_generic(GR_DONT_AUDIT, GR_WRITLIB_ACL_MSG, filp->f_path.dentry, filp->f_path.mnt);
55124+ return 1;
55125+ }
55126+ }
55127+ return 0;
55128+}
55129+
55130+int
55131+gr_acl_handle_mmap(const struct file *file, const unsigned long prot)
55132+{
55133+ __u32 mode;
55134+
55135+ if (unlikely(!file || !(prot & PROT_EXEC)))
55136+ return 1;
55137+
55138+ if (is_writable_mmap(file))
55139+ return 0;
55140+
55141+ mode =
55142+ gr_search_file(file->f_path.dentry,
55143+ GR_EXEC | GR_AUDIT_EXEC | GR_SUPPRESS,
55144+ file->f_path.mnt);
55145+
55146+ if (!gr_tpe_allow(file))
55147+ return 0;
55148+
55149+ if (unlikely(!(mode & GR_EXEC) && !(mode & GR_SUPPRESS))) {
55150+ gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_MMAP_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
55151+ return 0;
55152+ } else if (unlikely(!(mode & GR_EXEC))) {
55153+ return 0;
55154+ } else if (unlikely(mode & GR_EXEC && mode & GR_AUDIT_EXEC)) {
55155+ gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_MMAP_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
55156+ return 1;
55157+ }
55158+
55159+ return 1;
55160+}
55161+
55162+int
55163+gr_acl_handle_mprotect(const struct file *file, const unsigned long prot)
55164+{
55165+ __u32 mode;
55166+
55167+ if (unlikely(!file || !(prot & PROT_EXEC)))
55168+ return 1;
55169+
55170+ if (is_writable_mmap(file))
55171+ return 0;
55172+
55173+ mode =
55174+ gr_search_file(file->f_path.dentry,
55175+ GR_EXEC | GR_AUDIT_EXEC | GR_SUPPRESS,
55176+ file->f_path.mnt);
55177+
55178+ if (!gr_tpe_allow(file))
55179+ return 0;
55180+
55181+ if (unlikely(!(mode & GR_EXEC) && !(mode & GR_SUPPRESS))) {
55182+ gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_MPROTECT_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
55183+ return 0;
55184+ } else if (unlikely(!(mode & GR_EXEC))) {
55185+ return 0;
55186+ } else if (unlikely(mode & GR_EXEC && mode & GR_AUDIT_EXEC)) {
55187+ gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_MPROTECT_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
55188+ return 1;
55189+ }
55190+
55191+ return 1;
55192+}
55193+
55194+void
55195+gr_acl_handle_psacct(struct task_struct *task, const long code)
55196+{
55197+ unsigned long runtime;
55198+ unsigned long cputime;
55199+ unsigned int wday, cday;
55200+ __u8 whr, chr;
55201+ __u8 wmin, cmin;
55202+ __u8 wsec, csec;
55203+ struct timespec timeval;
55204+
55205+ if (unlikely(!(gr_status & GR_READY) || !task->acl ||
55206+ !(task->acl->mode & GR_PROCACCT)))
55207+ return;
55208+
55209+ do_posix_clock_monotonic_gettime(&timeval);
55210+ runtime = timeval.tv_sec - task->start_time.tv_sec;
55211+ wday = runtime / (3600 * 24);
55212+ runtime -= wday * (3600 * 24);
55213+ whr = runtime / 3600;
55214+ runtime -= whr * 3600;
55215+ wmin = runtime / 60;
55216+ runtime -= wmin * 60;
55217+ wsec = runtime;
55218+
55219+ cputime = (task->utime + task->stime) / HZ;
55220+ cday = cputime / (3600 * 24);
55221+ cputime -= cday * (3600 * 24);
55222+ chr = cputime / 3600;
55223+ cputime -= chr * 3600;
55224+ cmin = cputime / 60;
55225+ cputime -= cmin * 60;
55226+ csec = cputime;
55227+
55228+ gr_log_procacct(GR_DO_AUDIT, GR_ACL_PROCACCT_MSG, task, wday, whr, wmin, wsec, cday, chr, cmin, csec, code);
55229+
55230+ return;
55231+}
55232+
55233+void gr_set_kernel_label(struct task_struct *task)
55234+{
55235+ if (gr_status & GR_READY) {
55236+ task->role = kernel_role;
55237+ task->acl = kernel_role->root_label;
55238+ }
55239+ return;
55240+}
55241+
55242+#ifdef CONFIG_TASKSTATS
55243+int gr_is_taskstats_denied(int pid)
55244+{
55245+ struct task_struct *task;
55246+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
55247+ const struct cred *cred;
55248+#endif
55249+ int ret = 0;
55250+
55251+ /* restrict taskstats viewing to un-chrooted root users
55252+ who have the 'view' subject flag if the RBAC system is enabled
55253+ */
55254+
55255+ rcu_read_lock();
55256+ read_lock(&tasklist_lock);
55257+ task = find_task_by_vpid(pid);
55258+ if (task) {
55259+#ifdef CONFIG_GRKERNSEC_CHROOT
55260+ if (proc_is_chrooted(task))
55261+ ret = -EACCES;
55262+#endif
55263+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
55264+ cred = __task_cred(task);
55265+#ifdef CONFIG_GRKERNSEC_PROC_USER
55266+ if (cred->uid != 0)
55267+ ret = -EACCES;
55268+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
55269+ if (cred->uid != 0 && !groups_search(cred->group_info, CONFIG_GRKERNSEC_PROC_GID))
55270+ ret = -EACCES;
55271+#endif
55272+#endif
55273+ if (gr_status & GR_READY) {
55274+ if (!(task->acl->mode & GR_VIEW))
55275+ ret = -EACCES;
55276+ }
55277+ } else
55278+ ret = -ENOENT;
55279+
55280+ read_unlock(&tasklist_lock);
55281+ rcu_read_unlock();
55282+
55283+ return ret;
55284+}
55285+#endif
55286+
55287+/* AUXV entries are filled via a descendant of search_binary_handler
55288+ after we've already applied the subject for the target
55289+*/
55290+int gr_acl_enable_at_secure(void)
55291+{
55292+ if (unlikely(!(gr_status & GR_READY)))
55293+ return 0;
55294+
55295+ if (current->acl->mode & GR_ATSECURE)
55296+ return 1;
55297+
55298+ return 0;
55299+}
55300+
55301+int gr_acl_handle_filldir(const struct file *file, const char *name, const unsigned int namelen, const ino_t ino)
55302+{
55303+ struct task_struct *task = current;
55304+ struct dentry *dentry = file->f_path.dentry;
55305+ struct vfsmount *mnt = file->f_path.mnt;
55306+ struct acl_object_label *obj, *tmp;
55307+ struct acl_subject_label *subj;
55308+ unsigned int bufsize;
55309+ int is_not_root;
55310+ char *path;
55311+ dev_t dev = __get_dev(dentry);
55312+
55313+ if (unlikely(!(gr_status & GR_READY)))
55314+ return 1;
55315+
55316+ if (task->acl->mode & (GR_LEARN | GR_INHERITLEARN))
55317+ return 1;
55318+
55319+ /* ignore Eric Biederman */
55320+ if (IS_PRIVATE(dentry->d_inode))
55321+ return 1;
55322+
55323+ subj = task->acl;
55324+ do {
55325+ obj = lookup_acl_obj_label(ino, dev, subj);
55326+ if (obj != NULL)
55327+ return (obj->mode & GR_FIND) ? 1 : 0;
55328+ } while ((subj = subj->parent_subject));
55329+
55330+ /* this is purely an optimization since we're looking for an object
55331+ for the directory we're doing a readdir on
55332+ if it's possible for any globbed object to match the entry we're
55333+ filling into the directory, then the object we find here will be
55334+ an anchor point with attached globbed objects
55335+ */
55336+ obj = chk_obj_label_noglob(dentry, mnt, task->acl);
55337+ if (obj->globbed == NULL)
55338+ return (obj->mode & GR_FIND) ? 1 : 0;
55339+
55340+ is_not_root = ((obj->filename[0] == '/') &&
55341+ (obj->filename[1] == '\0')) ? 0 : 1;
55342+ bufsize = PAGE_SIZE - namelen - is_not_root;
55343+
55344+ /* check bufsize > PAGE_SIZE || bufsize == 0 */
55345+ if (unlikely((bufsize - 1) > (PAGE_SIZE - 1)))
55346+ return 1;
55347+
55348+ preempt_disable();
55349+ path = d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0], smp_processor_id()),
55350+ bufsize);
55351+
55352+ bufsize = strlen(path);
55353+
55354+ /* if base is "/", don't append an additional slash */
55355+ if (is_not_root)
55356+ *(path + bufsize) = '/';
55357+ memcpy(path + bufsize + is_not_root, name, namelen);
55358+ *(path + bufsize + namelen + is_not_root) = '\0';
55359+
55360+ tmp = obj->globbed;
55361+ while (tmp) {
55362+ if (!glob_match(tmp->filename, path)) {
55363+ preempt_enable();
55364+ return (tmp->mode & GR_FIND) ? 1 : 0;
55365+ }
55366+ tmp = tmp->next;
55367+ }
55368+ preempt_enable();
55369+ return (obj->mode & GR_FIND) ? 1 : 0;
55370+}
55371+
55372+#ifdef CONFIG_NETFILTER_XT_MATCH_GRADM_MODULE
55373+EXPORT_SYMBOL(gr_acl_is_enabled);
55374+#endif
55375+EXPORT_SYMBOL(gr_learn_resource);
55376+EXPORT_SYMBOL(gr_set_kernel_label);
55377+#ifdef CONFIG_SECURITY
55378+EXPORT_SYMBOL(gr_check_user_change);
55379+EXPORT_SYMBOL(gr_check_group_change);
55380+#endif
55381+
55382diff -urNp linux-2.6.39/grsecurity/gracl_cap.c linux-2.6.39/grsecurity/gracl_cap.c
55383--- linux-2.6.39/grsecurity/gracl_cap.c 1969-12-31 19:00:00.000000000 -0500
55384+++ linux-2.6.39/grsecurity/gracl_cap.c 2011-05-22 19:41:42.000000000 -0400
55385@@ -0,0 +1,139 @@
55386+#include <linux/kernel.h>
55387+#include <linux/module.h>
55388+#include <linux/sched.h>
55389+#include <linux/gracl.h>
55390+#include <linux/grsecurity.h>
55391+#include <linux/grinternal.h>
55392+
55393+static const char *captab_log[] = {
55394+ "CAP_CHOWN",
55395+ "CAP_DAC_OVERRIDE",
55396+ "CAP_DAC_READ_SEARCH",
55397+ "CAP_FOWNER",
55398+ "CAP_FSETID",
55399+ "CAP_KILL",
55400+ "CAP_SETGID",
55401+ "CAP_SETUID",
55402+ "CAP_SETPCAP",
55403+ "CAP_LINUX_IMMUTABLE",
55404+ "CAP_NET_BIND_SERVICE",
55405+ "CAP_NET_BROADCAST",
55406+ "CAP_NET_ADMIN",
55407+ "CAP_NET_RAW",
55408+ "CAP_IPC_LOCK",
55409+ "CAP_IPC_OWNER",
55410+ "CAP_SYS_MODULE",
55411+ "CAP_SYS_RAWIO",
55412+ "CAP_SYS_CHROOT",
55413+ "CAP_SYS_PTRACE",
55414+ "CAP_SYS_PACCT",
55415+ "CAP_SYS_ADMIN",
55416+ "CAP_SYS_BOOT",
55417+ "CAP_SYS_NICE",
55418+ "CAP_SYS_RESOURCE",
55419+ "CAP_SYS_TIME",
55420+ "CAP_SYS_TTY_CONFIG",
55421+ "CAP_MKNOD",
55422+ "CAP_LEASE",
55423+ "CAP_AUDIT_WRITE",
55424+ "CAP_AUDIT_CONTROL",
55425+ "CAP_SETFCAP",
55426+ "CAP_MAC_OVERRIDE",
55427+ "CAP_MAC_ADMIN",
55428+ "CAP_SYSLOG"
55429+};
55430+
55431+EXPORT_SYMBOL(gr_is_capable);
55432+EXPORT_SYMBOL(gr_is_capable_nolog);
55433+
55434+int
55435+gr_is_capable(const int cap)
55436+{
55437+ struct task_struct *task = current;
55438+ const struct cred *cred = current_cred();
55439+ struct acl_subject_label *curracl;
55440+ kernel_cap_t cap_drop = __cap_empty_set, cap_mask = __cap_empty_set;
55441+ kernel_cap_t cap_audit = __cap_empty_set;
55442+
55443+ if (!gr_acl_is_enabled())
55444+ return 1;
55445+
55446+ curracl = task->acl;
55447+
55448+ cap_drop = curracl->cap_lower;
55449+ cap_mask = curracl->cap_mask;
55450+ cap_audit = curracl->cap_invert_audit;
55451+
55452+ while ((curracl = curracl->parent_subject)) {
55453+ /* if the cap isn't specified in the current computed mask but is specified in the
55454+ current level subject, and is lowered in the current level subject, then add
55455+ it to the set of dropped capabilities
55456+ otherwise, add the current level subject's mask to the current computed mask
55457+ */
55458+ if (!cap_raised(cap_mask, cap) && cap_raised(curracl->cap_mask, cap)) {
55459+ cap_raise(cap_mask, cap);
55460+ if (cap_raised(curracl->cap_lower, cap))
55461+ cap_raise(cap_drop, cap);
55462+ if (cap_raised(curracl->cap_invert_audit, cap))
55463+ cap_raise(cap_audit, cap);
55464+ }
55465+ }
55466+
55467+ if (!cap_raised(cap_drop, cap)) {
55468+ if (cap_raised(cap_audit, cap))
55469+ gr_log_cap(GR_DO_AUDIT, GR_CAP_ACL_MSG2, task, captab_log[cap]);
55470+ return 1;
55471+ }
55472+
55473+ curracl = task->acl;
55474+
55475+ if ((curracl->mode & (GR_LEARN | GR_INHERITLEARN))
55476+ && cap_raised(cred->cap_effective, cap)) {
55477+ security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename,
55478+ task->role->roletype, cred->uid,
55479+ cred->gid, task->exec_file ?
55480+ gr_to_filename(task->exec_file->f_path.dentry,
55481+ task->exec_file->f_path.mnt) : curracl->filename,
55482+ curracl->filename, 0UL,
55483+ 0UL, "", (unsigned long) cap, &task->signal->saved_ip);
55484+ return 1;
55485+ }
55486+
55487+ if ((cap >= 0) && (cap < (sizeof(captab_log)/sizeof(captab_log[0]))) && cap_raised(cred->cap_effective, cap) && !cap_raised(cap_audit, cap))
55488+ gr_log_cap(GR_DONT_AUDIT, GR_CAP_ACL_MSG, task, captab_log[cap]);
55489+ return 0;
55490+}
55491+
55492+int
55493+gr_is_capable_nolog(const int cap)
55494+{
55495+ struct acl_subject_label *curracl;
55496+ kernel_cap_t cap_drop = __cap_empty_set, cap_mask = __cap_empty_set;
55497+
55498+ if (!gr_acl_is_enabled())
55499+ return 1;
55500+
55501+ curracl = current->acl;
55502+
55503+ cap_drop = curracl->cap_lower;
55504+ cap_mask = curracl->cap_mask;
55505+
55506+ while ((curracl = curracl->parent_subject)) {
55507+ /* if the cap isn't specified in the current computed mask but is specified in the
55508+ current level subject, and is lowered in the current level subject, then add
55509+ it to the set of dropped capabilities
55510+ otherwise, add the current level subject's mask to the current computed mask
55511+ */
55512+ if (!cap_raised(cap_mask, cap) && cap_raised(curracl->cap_mask, cap)) {
55513+ cap_raise(cap_mask, cap);
55514+ if (cap_raised(curracl->cap_lower, cap))
55515+ cap_raise(cap_drop, cap);
55516+ }
55517+ }
55518+
55519+ if (!cap_raised(cap_drop, cap))
55520+ return 1;
55521+
55522+ return 0;
55523+}
55524+
55525diff -urNp linux-2.6.39/grsecurity/gracl_fs.c linux-2.6.39/grsecurity/gracl_fs.c
55526--- linux-2.6.39/grsecurity/gracl_fs.c 1969-12-31 19:00:00.000000000 -0500
55527+++ linux-2.6.39/grsecurity/gracl_fs.c 2011-05-22 19:41:42.000000000 -0400
55528@@ -0,0 +1,431 @@
55529+#include <linux/kernel.h>
55530+#include <linux/sched.h>
55531+#include <linux/types.h>
55532+#include <linux/fs.h>
55533+#include <linux/file.h>
55534+#include <linux/stat.h>
55535+#include <linux/grsecurity.h>
55536+#include <linux/grinternal.h>
55537+#include <linux/gracl.h>
55538+
55539+__u32
55540+gr_acl_handle_hidden_file(const struct dentry * dentry,
55541+ const struct vfsmount * mnt)
55542+{
55543+ __u32 mode;
55544+
55545+ if (unlikely(!dentry->d_inode))
55546+ return GR_FIND;
55547+
55548+ mode =
55549+ gr_search_file(dentry, GR_FIND | GR_AUDIT_FIND | GR_SUPPRESS, mnt);
55550+
55551+ if (unlikely(mode & GR_FIND && mode & GR_AUDIT_FIND)) {
55552+ gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_HIDDEN_ACL_MSG, dentry, mnt);
55553+ return mode;
55554+ } else if (unlikely(!(mode & GR_FIND) && !(mode & GR_SUPPRESS))) {
55555+ gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_HIDDEN_ACL_MSG, dentry, mnt);
55556+ return 0;
55557+ } else if (unlikely(!(mode & GR_FIND)))
55558+ return 0;
55559+
55560+ return GR_FIND;
55561+}
55562+
55563+__u32
55564+gr_acl_handle_open(const struct dentry * dentry, const struct vfsmount * mnt,
55565+ const int fmode)
55566+{
55567+ __u32 reqmode = GR_FIND;
55568+ __u32 mode;
55569+
55570+ if (unlikely(!dentry->d_inode))
55571+ return reqmode;
55572+
55573+ if (unlikely(fmode & O_APPEND))
55574+ reqmode |= GR_APPEND;
55575+ else if (unlikely(fmode & FMODE_WRITE))
55576+ reqmode |= GR_WRITE;
55577+ if (likely((fmode & FMODE_READ) && !(fmode & O_DIRECTORY)))
55578+ reqmode |= GR_READ;
55579+ if ((fmode & FMODE_GREXEC) && (fmode & __FMODE_EXEC))
55580+ reqmode &= ~GR_READ;
55581+ mode =
55582+ gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS,
55583+ mnt);
55584+
55585+ if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
55586+ gr_log_fs_rbac_mode2(GR_DO_AUDIT, GR_OPEN_ACL_MSG, dentry, mnt,
55587+ reqmode & GR_READ ? " reading" : "",
55588+ reqmode & GR_WRITE ? " writing" : reqmode &
55589+ GR_APPEND ? " appending" : "");
55590+ return reqmode;
55591+ } else
55592+ if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
55593+ {
55594+ gr_log_fs_rbac_mode2(GR_DONT_AUDIT, GR_OPEN_ACL_MSG, dentry, mnt,
55595+ reqmode & GR_READ ? " reading" : "",
55596+ reqmode & GR_WRITE ? " writing" : reqmode &
55597+ GR_APPEND ? " appending" : "");
55598+ return 0;
55599+ } else if (unlikely((mode & reqmode) != reqmode))
55600+ return 0;
55601+
55602+ return reqmode;
55603+}
55604+
55605+__u32
55606+gr_acl_handle_creat(const struct dentry * dentry,
55607+ const struct dentry * p_dentry,
55608+ const struct vfsmount * p_mnt, const int fmode,
55609+ const int imode)
55610+{
55611+ __u32 reqmode = GR_WRITE | GR_CREATE;
55612+ __u32 mode;
55613+
55614+ if (unlikely(fmode & O_APPEND))
55615+ reqmode |= GR_APPEND;
55616+ if (unlikely((fmode & FMODE_READ) && !(fmode & O_DIRECTORY)))
55617+ reqmode |= GR_READ;
55618+ if (unlikely((fmode & O_CREAT) && (imode & (S_ISUID | S_ISGID))))
55619+ reqmode |= GR_SETID;
55620+
55621+ mode =
55622+ gr_check_create(dentry, p_dentry, p_mnt,
55623+ reqmode | to_gr_audit(reqmode) | GR_SUPPRESS);
55624+
55625+ if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
55626+ gr_log_fs_rbac_mode2(GR_DO_AUDIT, GR_CREATE_ACL_MSG, dentry, p_mnt,
55627+ reqmode & GR_READ ? " reading" : "",
55628+ reqmode & GR_WRITE ? " writing" : reqmode &
55629+ GR_APPEND ? " appending" : "");
55630+ return reqmode;
55631+ } else
55632+ if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
55633+ {
55634+ gr_log_fs_rbac_mode2(GR_DONT_AUDIT, GR_CREATE_ACL_MSG, dentry, p_mnt,
55635+ reqmode & GR_READ ? " reading" : "",
55636+ reqmode & GR_WRITE ? " writing" : reqmode &
55637+ GR_APPEND ? " appending" : "");
55638+ return 0;
55639+ } else if (unlikely((mode & reqmode) != reqmode))
55640+ return 0;
55641+
55642+ return reqmode;
55643+}
55644+
55645+__u32
55646+gr_acl_handle_access(const struct dentry * dentry, const struct vfsmount * mnt,
55647+ const int fmode)
55648+{
55649+ __u32 mode, reqmode = GR_FIND;
55650+
55651+ if ((fmode & S_IXOTH) && !S_ISDIR(dentry->d_inode->i_mode))
55652+ reqmode |= GR_EXEC;
55653+ if (fmode & S_IWOTH)
55654+ reqmode |= GR_WRITE;
55655+ if (fmode & S_IROTH)
55656+ reqmode |= GR_READ;
55657+
55658+ mode =
55659+ gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS,
55660+ mnt);
55661+
55662+ if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
55663+ gr_log_fs_rbac_mode3(GR_DO_AUDIT, GR_ACCESS_ACL_MSG, dentry, mnt,
55664+ reqmode & GR_READ ? " reading" : "",
55665+ reqmode & GR_WRITE ? " writing" : "",
55666+ reqmode & GR_EXEC ? " executing" : "");
55667+ return reqmode;
55668+ } else
55669+ if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
55670+ {
55671+ gr_log_fs_rbac_mode3(GR_DONT_AUDIT, GR_ACCESS_ACL_MSG, dentry, mnt,
55672+ reqmode & GR_READ ? " reading" : "",
55673+ reqmode & GR_WRITE ? " writing" : "",
55674+ reqmode & GR_EXEC ? " executing" : "");
55675+ return 0;
55676+ } else if (unlikely((mode & reqmode) != reqmode))
55677+ return 0;
55678+
55679+ return reqmode;
55680+}
55681+
55682+static __u32 generic_fs_handler(const struct dentry *dentry, const struct vfsmount *mnt, __u32 reqmode, const char *fmt)
55683+{
55684+ __u32 mode;
55685+
55686+ mode = gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS, mnt);
55687+
55688+ if (unlikely(((mode & (reqmode)) == (reqmode)) && mode & GR_AUDITS)) {
55689+ gr_log_fs_rbac_generic(GR_DO_AUDIT, fmt, dentry, mnt);
55690+ return mode;
55691+ } else if (unlikely((mode & (reqmode)) != (reqmode) && !(mode & GR_SUPPRESS))) {
55692+ gr_log_fs_rbac_generic(GR_DONT_AUDIT, fmt, dentry, mnt);
55693+ return 0;
55694+ } else if (unlikely((mode & (reqmode)) != (reqmode)))
55695+ return 0;
55696+
55697+ return (reqmode);
55698+}
55699+
55700+__u32
55701+gr_acl_handle_rmdir(const struct dentry * dentry, const struct vfsmount * mnt)
55702+{
55703+ return generic_fs_handler(dentry, mnt, GR_WRITE | GR_DELETE , GR_RMDIR_ACL_MSG);
55704+}
55705+
55706+__u32
55707+gr_acl_handle_unlink(const struct dentry *dentry, const struct vfsmount *mnt)
55708+{
55709+ return generic_fs_handler(dentry, mnt, GR_WRITE | GR_DELETE , GR_UNLINK_ACL_MSG);
55710+}
55711+
55712+__u32
55713+gr_acl_handle_truncate(const struct dentry *dentry, const struct vfsmount *mnt)
55714+{
55715+ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_TRUNCATE_ACL_MSG);
55716+}
55717+
55718+__u32
55719+gr_acl_handle_utime(const struct dentry *dentry, const struct vfsmount *mnt)
55720+{
55721+ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_ATIME_ACL_MSG);
55722+}
55723+
55724+__u32
55725+gr_acl_handle_fchmod(const struct dentry *dentry, const struct vfsmount *mnt,
55726+ mode_t mode)
55727+{
55728+ if (unlikely(dentry->d_inode && S_ISSOCK(dentry->d_inode->i_mode)))
55729+ return 1;
55730+
55731+ if (unlikely((mode != (mode_t)-1) && (mode & (S_ISUID | S_ISGID)))) {
55732+ return generic_fs_handler(dentry, mnt, GR_WRITE | GR_SETID,
55733+ GR_FCHMOD_ACL_MSG);
55734+ } else {
55735+ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_FCHMOD_ACL_MSG);
55736+ }
55737+}
55738+
55739+__u32
55740+gr_acl_handle_chmod(const struct dentry *dentry, const struct vfsmount *mnt,
55741+ mode_t mode)
55742+{
55743+ if (unlikely((mode != (mode_t)-1) && (mode & (S_ISUID | S_ISGID)))) {
55744+ return generic_fs_handler(dentry, mnt, GR_WRITE | GR_SETID,
55745+ GR_CHMOD_ACL_MSG);
55746+ } else {
55747+ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_CHMOD_ACL_MSG);
55748+ }
55749+}
55750+
55751+__u32
55752+gr_acl_handle_chown(const struct dentry *dentry, const struct vfsmount *mnt)
55753+{
55754+ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_CHOWN_ACL_MSG);
55755+}
55756+
55757+__u32
55758+gr_acl_handle_setxattr(const struct dentry *dentry, const struct vfsmount *mnt)
55759+{
55760+ return generic_fs_handler(dentry, mnt, GR_WRITE, GR_SETXATTR_ACL_MSG);
55761+}
55762+
55763+__u32
55764+gr_acl_handle_execve(const struct dentry *dentry, const struct vfsmount *mnt)
55765+{
55766+ return generic_fs_handler(dentry, mnt, GR_EXEC, GR_EXEC_ACL_MSG);
55767+}
55768+
55769+__u32
55770+gr_acl_handle_unix(const struct dentry *dentry, const struct vfsmount *mnt)
55771+{
55772+ return generic_fs_handler(dentry, mnt, GR_READ | GR_WRITE,
55773+ GR_UNIXCONNECT_ACL_MSG);
55774+}
55775+
55776+/* hardlinks require at minimum create permission,
55777+ any additional privilege required is based on the
55778+ privilege of the file being linked to
55779+*/
55780+__u32
55781+gr_acl_handle_link(const struct dentry * new_dentry,
55782+ const struct dentry * parent_dentry,
55783+ const struct vfsmount * parent_mnt,
55784+ const struct dentry * old_dentry,
55785+ const struct vfsmount * old_mnt, const char *to)
55786+{
55787+ __u32 mode;
55788+ __u32 needmode = GR_CREATE | GR_LINK;
55789+ __u32 needaudit = GR_AUDIT_CREATE | GR_AUDIT_LINK;
55790+
55791+ mode =
55792+ gr_check_link(new_dentry, parent_dentry, parent_mnt, old_dentry,
55793+ old_mnt);
55794+
55795+ if (unlikely(((mode & needmode) == needmode) && (mode & needaudit))) {
55796+ gr_log_fs_rbac_str(GR_DO_AUDIT, GR_LINK_ACL_MSG, old_dentry, old_mnt, to);
55797+ return mode;
55798+ } else if (unlikely(((mode & needmode) != needmode) && !(mode & GR_SUPPRESS))) {
55799+ gr_log_fs_rbac_str(GR_DONT_AUDIT, GR_LINK_ACL_MSG, old_dentry, old_mnt, to);
55800+ return 0;
55801+ } else if (unlikely((mode & needmode) != needmode))
55802+ return 0;
55803+
55804+ return 1;
55805+}
55806+
55807+__u32
55808+gr_acl_handle_symlink(const struct dentry * new_dentry,
55809+ const struct dentry * parent_dentry,
55810+ const struct vfsmount * parent_mnt, const char *from)
55811+{
55812+ __u32 needmode = GR_WRITE | GR_CREATE;
55813+ __u32 mode;
55814+
55815+ mode =
55816+ gr_check_create(new_dentry, parent_dentry, parent_mnt,
55817+ GR_CREATE | GR_AUDIT_CREATE |
55818+ GR_WRITE | GR_AUDIT_WRITE | GR_SUPPRESS);
55819+
55820+ if (unlikely(mode & GR_WRITE && mode & GR_AUDITS)) {
55821+ gr_log_fs_str_rbac(GR_DO_AUDIT, GR_SYMLINK_ACL_MSG, from, new_dentry, parent_mnt);
55822+ return mode;
55823+ } else if (unlikely(((mode & needmode) != needmode) && !(mode & GR_SUPPRESS))) {
55824+ gr_log_fs_str_rbac(GR_DONT_AUDIT, GR_SYMLINK_ACL_MSG, from, new_dentry, parent_mnt);
55825+ return 0;
55826+ } else if (unlikely((mode & needmode) != needmode))
55827+ return 0;
55828+
55829+ return (GR_WRITE | GR_CREATE);
55830+}
55831+
55832+static __u32 generic_fs_create_handler(const struct dentry *new_dentry, const struct dentry *parent_dentry, const struct vfsmount *parent_mnt, __u32 reqmode, const char *fmt)
55833+{
55834+ __u32 mode;
55835+
55836+ mode = gr_check_create(new_dentry, parent_dentry, parent_mnt, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS);
55837+
55838+ if (unlikely(((mode & (reqmode)) == (reqmode)) && mode & GR_AUDITS)) {
55839+ gr_log_fs_rbac_generic(GR_DO_AUDIT, fmt, new_dentry, parent_mnt);
55840+ return mode;
55841+ } else if (unlikely((mode & (reqmode)) != (reqmode) && !(mode & GR_SUPPRESS))) {
55842+ gr_log_fs_rbac_generic(GR_DONT_AUDIT, fmt, new_dentry, parent_mnt);
55843+ return 0;
55844+ } else if (unlikely((mode & (reqmode)) != (reqmode)))
55845+ return 0;
55846+
55847+ return (reqmode);
55848+}
55849+
55850+__u32
55851+gr_acl_handle_mknod(const struct dentry * new_dentry,
55852+ const struct dentry * parent_dentry,
55853+ const struct vfsmount * parent_mnt,
55854+ const int mode)
55855+{
55856+ __u32 reqmode = GR_WRITE | GR_CREATE;
55857+ if (unlikely(mode & (S_ISUID | S_ISGID)))
55858+ reqmode |= GR_SETID;
55859+
55860+ return generic_fs_create_handler(new_dentry, parent_dentry, parent_mnt,
55861+ reqmode, GR_MKNOD_ACL_MSG);
55862+}
55863+
55864+__u32
55865+gr_acl_handle_mkdir(const struct dentry *new_dentry,
55866+ const struct dentry *parent_dentry,
55867+ const struct vfsmount *parent_mnt)
55868+{
55869+ return generic_fs_create_handler(new_dentry, parent_dentry, parent_mnt,
55870+ GR_WRITE | GR_CREATE, GR_MKDIR_ACL_MSG);
55871+}
55872+
55873+#define RENAME_CHECK_SUCCESS(old, new) \
55874+ (((old & (GR_WRITE | GR_READ)) == (GR_WRITE | GR_READ)) && \
55875+ ((new & (GR_WRITE | GR_READ)) == (GR_WRITE | GR_READ)))
55876+
55877+int
55878+gr_acl_handle_rename(struct dentry *new_dentry,
55879+ struct dentry *parent_dentry,
55880+ const struct vfsmount *parent_mnt,
55881+ struct dentry *old_dentry,
55882+ struct inode *old_parent_inode,
55883+ struct vfsmount *old_mnt, const char *newname)
55884+{
55885+ __u32 comp1, comp2;
55886+ int error = 0;
55887+
55888+ if (unlikely(!gr_acl_is_enabled()))
55889+ return 0;
55890+
55891+ if (!new_dentry->d_inode) {
55892+ comp1 = gr_check_create(new_dentry, parent_dentry, parent_mnt,
55893+ GR_READ | GR_WRITE | GR_CREATE | GR_AUDIT_READ |
55894+ GR_AUDIT_WRITE | GR_AUDIT_CREATE | GR_SUPPRESS);
55895+ comp2 = gr_search_file(old_dentry, GR_READ | GR_WRITE |
55896+ GR_DELETE | GR_AUDIT_DELETE |
55897+ GR_AUDIT_READ | GR_AUDIT_WRITE |
55898+ GR_SUPPRESS, old_mnt);
55899+ } else {
55900+ comp1 = gr_search_file(new_dentry, GR_READ | GR_WRITE |
55901+ GR_CREATE | GR_DELETE |
55902+ GR_AUDIT_CREATE | GR_AUDIT_DELETE |
55903+ GR_AUDIT_READ | GR_AUDIT_WRITE |
55904+ GR_SUPPRESS, parent_mnt);
55905+ comp2 =
55906+ gr_search_file(old_dentry,
55907+ GR_READ | GR_WRITE | GR_AUDIT_READ |
55908+ GR_DELETE | GR_AUDIT_DELETE |
55909+ GR_AUDIT_WRITE | GR_SUPPRESS, old_mnt);
55910+ }
55911+
55912+ if (RENAME_CHECK_SUCCESS(comp1, comp2) &&
55913+ ((comp1 & GR_AUDITS) || (comp2 & GR_AUDITS)))
55914+ gr_log_fs_rbac_str(GR_DO_AUDIT, GR_RENAME_ACL_MSG, old_dentry, old_mnt, newname);
55915+ else if (!RENAME_CHECK_SUCCESS(comp1, comp2) && !(comp1 & GR_SUPPRESS)
55916+ && !(comp2 & GR_SUPPRESS)) {
55917+ gr_log_fs_rbac_str(GR_DONT_AUDIT, GR_RENAME_ACL_MSG, old_dentry, old_mnt, newname);
55918+ error = -EACCES;
55919+ } else if (unlikely(!RENAME_CHECK_SUCCESS(comp1, comp2)))
55920+ error = -EACCES;
55921+
55922+ return error;
55923+}
55924+
55925+void
55926+gr_acl_handle_exit(void)
55927+{
55928+ u16 id;
55929+ char *rolename;
55930+ struct file *exec_file;
55931+
55932+ if (unlikely(current->acl_sp_role && gr_acl_is_enabled() &&
55933+ !(current->role->roletype & GR_ROLE_PERSIST))) {
55934+ id = current->acl_role_id;
55935+ rolename = current->role->rolename;
55936+ gr_set_acls(1);
55937+ gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_SPROLEL_ACL_MSG, rolename, id);
55938+ }
55939+
55940+ write_lock(&grsec_exec_file_lock);
55941+ exec_file = current->exec_file;
55942+ current->exec_file = NULL;
55943+ write_unlock(&grsec_exec_file_lock);
55944+
55945+ if (exec_file)
55946+ fput(exec_file);
55947+}
55948+
55949+int
55950+gr_acl_handle_procpidmem(const struct task_struct *task)
55951+{
55952+ if (unlikely(!gr_acl_is_enabled()))
55953+ return 0;
55954+
55955+ if (task != current && task->acl->mode & GR_PROTPROCFD)
55956+ return -EACCES;
55957+
55958+ return 0;
55959+}
55960diff -urNp linux-2.6.39/grsecurity/gracl_ip.c linux-2.6.39/grsecurity/gracl_ip.c
55961--- linux-2.6.39/grsecurity/gracl_ip.c 1969-12-31 19:00:00.000000000 -0500
55962+++ linux-2.6.39/grsecurity/gracl_ip.c 2011-05-22 22:47:31.000000000 -0400
55963@@ -0,0 +1,381 @@
55964+#include <linux/kernel.h>
55965+#include <asm/uaccess.h>
55966+#include <asm/errno.h>
55967+#include <net/sock.h>
55968+#include <linux/file.h>
55969+#include <linux/fs.h>
55970+#include <linux/net.h>
55971+#include <linux/in.h>
55972+#include <linux/skbuff.h>
55973+#include <linux/ip.h>
55974+#include <linux/udp.h>
55975+#include <linux/types.h>
55976+#include <linux/sched.h>
55977+#include <linux/netdevice.h>
55978+#include <linux/inetdevice.h>
55979+#include <linux/gracl.h>
55980+#include <linux/grsecurity.h>
55981+#include <linux/grinternal.h>
55982+
55983+#define GR_BIND 0x01
55984+#define GR_CONNECT 0x02
55985+#define GR_INVERT 0x04
55986+#define GR_BINDOVERRIDE 0x08
55987+#define GR_CONNECTOVERRIDE 0x10
55988+#define GR_SOCK_FAMILY 0x20
55989+
55990+static const char * gr_protocols[IPPROTO_MAX] = {
55991+ "ip", "icmp", "igmp", "ggp", "ipencap", "st", "tcp", "cbt",
55992+ "egp", "igp", "bbn-rcc", "nvp", "pup", "argus", "emcon", "xnet",
55993+ "chaos", "udp", "mux", "dcn", "hmp", "prm", "xns-idp", "trunk-1",
55994+ "trunk-2", "leaf-1", "leaf-2", "rdp", "irtp", "iso-tp4", "netblt", "mfe-nsp",
55995+ "merit-inp", "sep", "3pc", "idpr", "xtp", "ddp", "idpr-cmtp", "tp++",
55996+ "il", "ipv6", "sdrp", "ipv6-route", "ipv6-frag", "idrp", "rsvp", "gre",
55997+ "mhrp", "bna", "ipv6-crypt", "ipv6-auth", "i-nlsp", "swipe", "narp", "mobile",
55998+ "tlsp", "skip", "ipv6-icmp", "ipv6-nonxt", "ipv6-opts", "unknown:61", "cftp", "unknown:63",
55999+ "sat-expak", "kryptolan", "rvd", "ippc", "unknown:68", "sat-mon", "visa", "ipcv",
56000+ "cpnx", "cphb", "wsn", "pvp", "br-sat-mon", "sun-nd", "wb-mon", "wb-expak",
56001+ "iso-ip", "vmtp", "secure-vmtp", "vines", "ttp", "nfsnet-igp", "dgp", "tcf",
56002+ "eigrp", "ospf", "sprite-rpc", "larp", "mtp", "ax.25", "ipip", "micp",
56003+ "scc-sp", "etherip", "encap", "unknown:99", "gmtp", "ifmp", "pnni", "pim",
56004+ "aris", "scps", "qnx", "a/n", "ipcomp", "snp", "compaq-peer", "ipx-in-ip",
56005+ "vrrp", "pgm", "unknown:114", "l2tp", "ddx", "iatp", "stp", "srp",
56006+ "uti", "smp", "sm", "ptp", "isis", "fire", "crtp", "crdup",
56007+ "sscopmce", "iplt", "sps", "pipe", "sctp", "fc", "unkown:134", "unknown:135",
56008+ "unknown:136", "unknown:137", "unknown:138", "unknown:139", "unknown:140", "unknown:141", "unknown:142", "unknown:143",
56009+ "unknown:144", "unknown:145", "unknown:146", "unknown:147", "unknown:148", "unknown:149", "unknown:150", "unknown:151",
56010+ "unknown:152", "unknown:153", "unknown:154", "unknown:155", "unknown:156", "unknown:157", "unknown:158", "unknown:159",
56011+ "unknown:160", "unknown:161", "unknown:162", "unknown:163", "unknown:164", "unknown:165", "unknown:166", "unknown:167",
56012+ "unknown:168", "unknown:169", "unknown:170", "unknown:171", "unknown:172", "unknown:173", "unknown:174", "unknown:175",
56013+ "unknown:176", "unknown:177", "unknown:178", "unknown:179", "unknown:180", "unknown:181", "unknown:182", "unknown:183",
56014+ "unknown:184", "unknown:185", "unknown:186", "unknown:187", "unknown:188", "unknown:189", "unknown:190", "unknown:191",
56015+ "unknown:192", "unknown:193", "unknown:194", "unknown:195", "unknown:196", "unknown:197", "unknown:198", "unknown:199",
56016+ "unknown:200", "unknown:201", "unknown:202", "unknown:203", "unknown:204", "unknown:205", "unknown:206", "unknown:207",
56017+ "unknown:208", "unknown:209", "unknown:210", "unknown:211", "unknown:212", "unknown:213", "unknown:214", "unknown:215",
56018+ "unknown:216", "unknown:217", "unknown:218", "unknown:219", "unknown:220", "unknown:221", "unknown:222", "unknown:223",
56019+ "unknown:224", "unknown:225", "unknown:226", "unknown:227", "unknown:228", "unknown:229", "unknown:230", "unknown:231",
56020+ "unknown:232", "unknown:233", "unknown:234", "unknown:235", "unknown:236", "unknown:237", "unknown:238", "unknown:239",
56021+ "unknown:240", "unknown:241", "unknown:242", "unknown:243", "unknown:244", "unknown:245", "unknown:246", "unknown:247",
56022+ "unknown:248", "unknown:249", "unknown:250", "unknown:251", "unknown:252", "unknown:253", "unknown:254", "unknown:255",
56023+ };
56024+
56025+static const char * gr_socktypes[SOCK_MAX] = {
56026+ "unknown:0", "stream", "dgram", "raw", "rdm", "seqpacket", "unknown:6",
56027+ "unknown:7", "unknown:8", "unknown:9", "packet"
56028+ };
56029+
56030+static const char * gr_sockfamilies[AF_MAX+1] = {
56031+ "unspec", "unix", "inet", "ax25", "ipx", "appletalk", "netrom", "bridge", "atmpvc", "x25",
56032+ "inet6", "rose", "decnet", "netbeui", "security", "key", "netlink", "packet", "ash",
56033+ "econet", "atmsvc", "rds", "sna", "irda", "ppox", "wanpipe", "llc", "fam_27", "fam_28",
56034+ "tipc", "bluetooth", "iucv", "rxrpc", "isdn", "phonet", "ieee802154", "ciaf"
56035+ };
56036+
56037+const char *
56038+gr_proto_to_name(unsigned char proto)
56039+{
56040+ return gr_protocols[proto];
56041+}
56042+
56043+const char *
56044+gr_socktype_to_name(unsigned char type)
56045+{
56046+ return gr_socktypes[type];
56047+}
56048+
56049+const char *
56050+gr_sockfamily_to_name(unsigned char family)
56051+{
56052+ return gr_sockfamilies[family];
56053+}
56054+
56055+int
56056+gr_search_socket(const int domain, const int type, const int protocol)
56057+{
56058+ struct acl_subject_label *curr;
56059+ const struct cred *cred = current_cred();
56060+
56061+ if (unlikely(!gr_acl_is_enabled()))
56062+ goto exit;
56063+
56064+ if ((domain < 0) || (type < 0) || (protocol < 0) ||
56065+ (domain >= AF_MAX) || (type >= SOCK_MAX) || (protocol >= IPPROTO_MAX))
56066+ goto exit; // let the kernel handle it
56067+
56068+ curr = current->acl;
56069+
56070+ if (curr->sock_families[domain / 32] & (1 << (domain % 32))) {
56071+ /* the family is allowed, if this is PF_INET allow it only if
56072+ the extra sock type/protocol checks pass */
56073+ if (domain == PF_INET)
56074+ goto inet_check;
56075+ goto exit;
56076+ } else {
56077+ if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
56078+ __u32 fakeip = 0;
56079+ security_learn(GR_IP_LEARN_MSG, current->role->rolename,
56080+ current->role->roletype, cred->uid,
56081+ cred->gid, current->exec_file ?
56082+ gr_to_filename(current->exec_file->f_path.dentry,
56083+ current->exec_file->f_path.mnt) :
56084+ curr->filename, curr->filename,
56085+ &fakeip, domain, 0, 0, GR_SOCK_FAMILY,
56086+ &current->signal->saved_ip);
56087+ goto exit;
56088+ }
56089+ goto exit_fail;
56090+ }
56091+
56092+inet_check:
56093+ /* the rest of this checking is for IPv4 only */
56094+ if (!curr->ips)
56095+ goto exit;
56096+
56097+ if ((curr->ip_type & (1 << type)) &&
56098+ (curr->ip_proto[protocol / 32] & (1 << (protocol % 32))))
56099+ goto exit;
56100+
56101+ if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
56102+ /* we don't place acls on raw sockets , and sometimes
56103+ dgram/ip sockets are opened for ioctl and not
56104+ bind/connect, so we'll fake a bind learn log */
56105+ if (type == SOCK_RAW || type == SOCK_PACKET) {
56106+ __u32 fakeip = 0;
56107+ security_learn(GR_IP_LEARN_MSG, current->role->rolename,
56108+ current->role->roletype, cred->uid,
56109+ cred->gid, current->exec_file ?
56110+ gr_to_filename(current->exec_file->f_path.dentry,
56111+ current->exec_file->f_path.mnt) :
56112+ curr->filename, curr->filename,
56113+ &fakeip, 0, type,
56114+ protocol, GR_CONNECT, &current->signal->saved_ip);
56115+ } else if ((type == SOCK_DGRAM) && (protocol == IPPROTO_IP)) {
56116+ __u32 fakeip = 0;
56117+ security_learn(GR_IP_LEARN_MSG, current->role->rolename,
56118+ current->role->roletype, cred->uid,
56119+ cred->gid, current->exec_file ?
56120+ gr_to_filename(current->exec_file->f_path.dentry,
56121+ current->exec_file->f_path.mnt) :
56122+ curr->filename, curr->filename,
56123+ &fakeip, 0, type,
56124+ protocol, GR_BIND, &current->signal->saved_ip);
56125+ }
56126+ /* we'll log when they use connect or bind */
56127+ goto exit;
56128+ }
56129+
56130+exit_fail:
56131+ if (domain == PF_INET)
56132+ gr_log_str3(GR_DONT_AUDIT, GR_SOCK_MSG, gr_sockfamily_to_name(domain),
56133+ gr_socktype_to_name(type), gr_proto_to_name(protocol));
56134+ else
56135+ gr_log_str2_int(GR_DONT_AUDIT, GR_SOCK_NOINET_MSG, gr_sockfamily_to_name(domain),
56136+ gr_socktype_to_name(type), protocol);
56137+
56138+ return 0;
56139+exit:
56140+ return 1;
56141+}
56142+
56143+int check_ip_policy(struct acl_ip_label *ip, __u32 ip_addr, __u16 ip_port, __u8 protocol, const int mode, const int type, __u32 our_addr, __u32 our_netmask)
56144+{
56145+ if ((ip->mode & mode) &&
56146+ (ip_port >= ip->low) &&
56147+ (ip_port <= ip->high) &&
56148+ ((ntohl(ip_addr) & our_netmask) ==
56149+ (ntohl(our_addr) & our_netmask))
56150+ && (ip->proto[protocol / 32] & (1 << (protocol % 32)))
56151+ && (ip->type & (1 << type))) {
56152+ if (ip->mode & GR_INVERT)
56153+ return 2; // specifically denied
56154+ else
56155+ return 1; // allowed
56156+ }
56157+
56158+ return 0; // not specifically allowed, may continue parsing
56159+}
56160+
56161+static int
56162+gr_search_connectbind(const int full_mode, struct sock *sk,
56163+ struct sockaddr_in *addr, const int type)
56164+{
56165+ char iface[IFNAMSIZ] = {0};
56166+ struct acl_subject_label *curr;
56167+ struct acl_ip_label *ip;
56168+ struct inet_sock *isk;
56169+ struct net_device *dev;
56170+ struct in_device *idev;
56171+ unsigned long i;
56172+ int ret;
56173+ int mode = full_mode & (GR_BIND | GR_CONNECT);
56174+ __u32 ip_addr = 0;
56175+ __u32 our_addr;
56176+ __u32 our_netmask;
56177+ char *p;
56178+ __u16 ip_port = 0;
56179+ const struct cred *cred = current_cred();
56180+
56181+ if (unlikely(!gr_acl_is_enabled() || sk->sk_family != PF_INET))
56182+ return 0;
56183+
56184+ curr = current->acl;
56185+ isk = inet_sk(sk);
56186+
56187+ /* INADDR_ANY overriding for binds, inaddr_any_override is already in network order */
56188+ if ((full_mode & GR_BINDOVERRIDE) && addr->sin_addr.s_addr == htonl(INADDR_ANY) && curr->inaddr_any_override != 0)
56189+ addr->sin_addr.s_addr = curr->inaddr_any_override;
56190+ if ((full_mode & GR_CONNECT) && isk->inet_saddr == htonl(INADDR_ANY) && curr->inaddr_any_override != 0) {
56191+ struct sockaddr_in saddr;
56192+ int err;
56193+
56194+ saddr.sin_family = AF_INET;
56195+ saddr.sin_addr.s_addr = curr->inaddr_any_override;
56196+ saddr.sin_port = isk->inet_sport;
56197+
56198+ err = security_socket_bind(sk->sk_socket, (struct sockaddr *)&saddr, sizeof(struct sockaddr_in));
56199+ if (err)
56200+ return err;
56201+
56202+ err = sk->sk_socket->ops->bind(sk->sk_socket, (struct sockaddr *)&saddr, sizeof(struct sockaddr_in));
56203+ if (err)
56204+ return err;
56205+ }
56206+
56207+ if (!curr->ips)
56208+ return 0;
56209+
56210+ ip_addr = addr->sin_addr.s_addr;
56211+ ip_port = ntohs(addr->sin_port);
56212+
56213+ if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
56214+ security_learn(GR_IP_LEARN_MSG, current->role->rolename,
56215+ current->role->roletype, cred->uid,
56216+ cred->gid, current->exec_file ?
56217+ gr_to_filename(current->exec_file->f_path.dentry,
56218+ current->exec_file->f_path.mnt) :
56219+ curr->filename, curr->filename,
56220+ &ip_addr, ip_port, type,
56221+ sk->sk_protocol, mode, &current->signal->saved_ip);
56222+ return 0;
56223+ }
56224+
56225+ for (i = 0; i < curr->ip_num; i++) {
56226+ ip = *(curr->ips + i);
56227+ if (ip->iface != NULL) {
56228+ strncpy(iface, ip->iface, IFNAMSIZ - 1);
56229+ p = strchr(iface, ':');
56230+ if (p != NULL)
56231+ *p = '\0';
56232+ dev = dev_get_by_name(sock_net(sk), iface);
56233+ if (dev == NULL)
56234+ continue;
56235+ idev = in_dev_get(dev);
56236+ if (idev == NULL) {
56237+ dev_put(dev);
56238+ continue;
56239+ }
56240+ rcu_read_lock();
56241+ for_ifa(idev) {
56242+ if (!strcmp(ip->iface, ifa->ifa_label)) {
56243+ our_addr = ifa->ifa_address;
56244+ our_netmask = 0xffffffff;
56245+ ret = check_ip_policy(ip, ip_addr, ip_port, sk->sk_protocol, mode, type, our_addr, our_netmask);
56246+ if (ret == 1) {
56247+ rcu_read_unlock();
56248+ in_dev_put(idev);
56249+ dev_put(dev);
56250+ return 0;
56251+ } else if (ret == 2) {
56252+ rcu_read_unlock();
56253+ in_dev_put(idev);
56254+ dev_put(dev);
56255+ goto denied;
56256+ }
56257+ }
56258+ } endfor_ifa(idev);
56259+ rcu_read_unlock();
56260+ in_dev_put(idev);
56261+ dev_put(dev);
56262+ } else {
56263+ our_addr = ip->addr;
56264+ our_netmask = ip->netmask;
56265+ ret = check_ip_policy(ip, ip_addr, ip_port, sk->sk_protocol, mode, type, our_addr, our_netmask);
56266+ if (ret == 1)
56267+ return 0;
56268+ else if (ret == 2)
56269+ goto denied;
56270+ }
56271+ }
56272+
56273+denied:
56274+ if (mode == GR_BIND)
56275+ gr_log_int5_str2(GR_DONT_AUDIT, GR_BIND_ACL_MSG, &ip_addr, ip_port, gr_socktype_to_name(type), gr_proto_to_name(sk->sk_protocol));
56276+ else if (mode == GR_CONNECT)
56277+ gr_log_int5_str2(GR_DONT_AUDIT, GR_CONNECT_ACL_MSG, &ip_addr, ip_port, gr_socktype_to_name(type), gr_proto_to_name(sk->sk_protocol));
56278+
56279+ return -EACCES;
56280+}
56281+
56282+int
56283+gr_search_connect(struct socket *sock, struct sockaddr_in *addr)
56284+{
56285+ return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sock->sk, addr, sock->type);
56286+}
56287+
56288+int
56289+gr_search_bind(struct socket *sock, struct sockaddr_in *addr)
56290+{
56291+ return gr_search_connectbind(GR_BIND | GR_BINDOVERRIDE, sock->sk, addr, sock->type);
56292+}
56293+
56294+int gr_search_listen(struct socket *sock)
56295+{
56296+ struct sock *sk = sock->sk;
56297+ struct sockaddr_in addr;
56298+
56299+ addr.sin_addr.s_addr = inet_sk(sk)->inet_saddr;
56300+ addr.sin_port = inet_sk(sk)->inet_sport;
56301+
56302+ return gr_search_connectbind(GR_BIND | GR_CONNECTOVERRIDE, sock->sk, &addr, sock->type);
56303+}
56304+
56305+int gr_search_accept(struct socket *sock)
56306+{
56307+ struct sock *sk = sock->sk;
56308+ struct sockaddr_in addr;
56309+
56310+ addr.sin_addr.s_addr = inet_sk(sk)->inet_saddr;
56311+ addr.sin_port = inet_sk(sk)->inet_sport;
56312+
56313+ return gr_search_connectbind(GR_BIND | GR_CONNECTOVERRIDE, sock->sk, &addr, sock->type);
56314+}
56315+
56316+int
56317+gr_search_udp_sendmsg(struct sock *sk, struct sockaddr_in *addr)
56318+{
56319+ if (addr)
56320+ return gr_search_connectbind(GR_CONNECT, sk, addr, SOCK_DGRAM);
56321+ else {
56322+ struct sockaddr_in sin;
56323+ const struct inet_sock *inet = inet_sk(sk);
56324+
56325+ sin.sin_addr.s_addr = inet->inet_daddr;
56326+ sin.sin_port = inet->inet_dport;
56327+
56328+ return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sk, &sin, SOCK_DGRAM);
56329+ }
56330+}
56331+
56332+int
56333+gr_search_udp_recvmsg(struct sock *sk, const struct sk_buff *skb)
56334+{
56335+ struct sockaddr_in sin;
56336+
56337+ if (unlikely(skb->len < sizeof (struct udphdr)))
56338+ return 0; // skip this packet
56339+
56340+ sin.sin_addr.s_addr = ip_hdr(skb)->saddr;
56341+ sin.sin_port = udp_hdr(skb)->source;
56342+
56343+ return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sk, &sin, SOCK_DGRAM);
56344+}
56345diff -urNp linux-2.6.39/grsecurity/gracl_learn.c linux-2.6.39/grsecurity/gracl_learn.c
56346--- linux-2.6.39/grsecurity/gracl_learn.c 1969-12-31 19:00:00.000000000 -0500
56347+++ linux-2.6.39/grsecurity/gracl_learn.c 2011-05-22 22:47:45.000000000 -0400
56348@@ -0,0 +1,210 @@
56349+#include <linux/kernel.h>
56350+#include <linux/mm.h>
56351+#include <linux/sched.h>
56352+#include <linux/poll.h>
56353+#include <linux/string.h>
56354+#include <linux/file.h>
56355+#include <linux/types.h>
56356+#include <linux/vmalloc.h>
56357+#include <linux/grinternal.h>
56358+
56359+extern ssize_t write_grsec_handler(struct file * file, const char __user * buf,
56360+ size_t count, loff_t *ppos);
56361+extern int gr_acl_is_enabled(void);
56362+
56363+static DECLARE_WAIT_QUEUE_HEAD(learn_wait);
56364+static int gr_learn_attached;
56365+
56366+/* use a 512k buffer */
56367+#define LEARN_BUFFER_SIZE (512 * 1024)
56368+
56369+static DEFINE_SPINLOCK(gr_learn_lock);
56370+static DEFINE_MUTEX(gr_learn_user_mutex);
56371+
56372+/* we need to maintain two buffers, so that the kernel context of grlearn
56373+ uses a semaphore around the userspace copying, and the other kernel contexts
56374+ use a spinlock when copying into the buffer, since they cannot sleep
56375+*/
56376+static char *learn_buffer;
56377+static char *learn_buffer_user;
56378+static int learn_buffer_len;
56379+static int learn_buffer_user_len;
56380+
56381+static ssize_t
56382+read_learn(struct file *file, char __user * buf, size_t count, loff_t * ppos)
56383+{
56384+ DECLARE_WAITQUEUE(wait, current);
56385+ ssize_t retval = 0;
56386+
56387+ add_wait_queue(&learn_wait, &wait);
56388+ set_current_state(TASK_INTERRUPTIBLE);
56389+ do {
56390+ mutex_lock(&gr_learn_user_mutex);
56391+ spin_lock(&gr_learn_lock);
56392+ if (learn_buffer_len)
56393+ break;
56394+ spin_unlock(&gr_learn_lock);
56395+ mutex_unlock(&gr_learn_user_mutex);
56396+ if (file->f_flags & O_NONBLOCK) {
56397+ retval = -EAGAIN;
56398+ goto out;
56399+ }
56400+ if (signal_pending(current)) {
56401+ retval = -ERESTARTSYS;
56402+ goto out;
56403+ }
56404+
56405+ schedule();
56406+ } while (1);
56407+
56408+ memcpy(learn_buffer_user, learn_buffer, learn_buffer_len);
56409+ learn_buffer_user_len = learn_buffer_len;
56410+ retval = learn_buffer_len;
56411+ learn_buffer_len = 0;
56412+
56413+ spin_unlock(&gr_learn_lock);
56414+
56415+ if (copy_to_user(buf, learn_buffer_user, learn_buffer_user_len))
56416+ retval = -EFAULT;
56417+
56418+ mutex_unlock(&gr_learn_user_mutex);
56419+out:
56420+ set_current_state(TASK_RUNNING);
56421+ remove_wait_queue(&learn_wait, &wait);
56422+ return retval;
56423+}
56424+
56425+static unsigned int
56426+poll_learn(struct file * file, poll_table * wait)
56427+{
56428+ poll_wait(file, &learn_wait, wait);
56429+
56430+ if (learn_buffer_len)
56431+ return (POLLIN | POLLRDNORM);
56432+
56433+ return 0;
56434+}
56435+
56436+void
56437+gr_clear_learn_entries(void)
56438+{
56439+ char *tmp;
56440+
56441+ mutex_lock(&gr_learn_user_mutex);
56442+ if (learn_buffer != NULL) {
56443+ spin_lock(&gr_learn_lock);
56444+ tmp = learn_buffer;
56445+ learn_buffer = NULL;
56446+ spin_unlock(&gr_learn_lock);
56447+ vfree(learn_buffer);
56448+ }
56449+ if (learn_buffer_user != NULL) {
56450+ vfree(learn_buffer_user);
56451+ learn_buffer_user = NULL;
56452+ }
56453+ learn_buffer_len = 0;
56454+ mutex_unlock(&gr_learn_user_mutex);
56455+
56456+ return;
56457+}
56458+
56459+void
56460+gr_add_learn_entry(const char *fmt, ...)
56461+{
56462+ va_list args;
56463+ unsigned int len;
56464+
56465+ if (!gr_learn_attached)
56466+ return;
56467+
56468+ spin_lock(&gr_learn_lock);
56469+
56470+ /* leave a gap at the end so we know when it's "full" but don't have to
56471+ compute the exact length of the string we're trying to append
56472+ */
56473+ if (learn_buffer_len > LEARN_BUFFER_SIZE - 16384) {
56474+ spin_unlock(&gr_learn_lock);
56475+ wake_up_interruptible(&learn_wait);
56476+ return;
56477+ }
56478+ if (learn_buffer == NULL) {
56479+ spin_unlock(&gr_learn_lock);
56480+ return;
56481+ }
56482+
56483+ va_start(args, fmt);
56484+ len = vsnprintf(learn_buffer + learn_buffer_len, LEARN_BUFFER_SIZE - learn_buffer_len, fmt, args);
56485+ va_end(args);
56486+
56487+ learn_buffer_len += len + 1;
56488+
56489+ spin_unlock(&gr_learn_lock);
56490+ wake_up_interruptible(&learn_wait);
56491+
56492+ return;
56493+}
56494+
56495+static int
56496+open_learn(struct inode *inode, struct file *file)
56497+{
56498+ if (file->f_mode & FMODE_READ && gr_learn_attached)
56499+ return -EBUSY;
56500+ if (file->f_mode & FMODE_READ) {
56501+ int retval = 0;
56502+ mutex_lock(&gr_learn_user_mutex);
56503+ if (learn_buffer == NULL)
56504+ learn_buffer = vmalloc(LEARN_BUFFER_SIZE);
56505+ if (learn_buffer_user == NULL)
56506+ learn_buffer_user = vmalloc(LEARN_BUFFER_SIZE);
56507+ if (learn_buffer == NULL) {
56508+ retval = -ENOMEM;
56509+ goto out_error;
56510+ }
56511+ if (learn_buffer_user == NULL) {
56512+ retval = -ENOMEM;
56513+ goto out_error;
56514+ }
56515+ learn_buffer_len = 0;
56516+ learn_buffer_user_len = 0;
56517+ gr_learn_attached = 1;
56518+out_error:
56519+ mutex_unlock(&gr_learn_user_mutex);
56520+ return retval;
56521+ }
56522+ return 0;
56523+}
56524+
56525+static int
56526+close_learn(struct inode *inode, struct file *file)
56527+{
56528+ char *tmp;
56529+
56530+ if (file->f_mode & FMODE_READ) {
56531+ mutex_lock(&gr_learn_user_mutex);
56532+ if (learn_buffer != NULL) {
56533+ spin_lock(&gr_learn_lock);
56534+ tmp = learn_buffer;
56535+ learn_buffer = NULL;
56536+ spin_unlock(&gr_learn_lock);
56537+ vfree(tmp);
56538+ }
56539+ if (learn_buffer_user != NULL) {
56540+ vfree(learn_buffer_user);
56541+ learn_buffer_user = NULL;
56542+ }
56543+ learn_buffer_len = 0;
56544+ learn_buffer_user_len = 0;
56545+ gr_learn_attached = 0;
56546+ mutex_unlock(&gr_learn_user_mutex);
56547+ }
56548+
56549+ return 0;
56550+}
56551+
56552+const struct file_operations grsec_fops = {
56553+ .read = read_learn,
56554+ .write = write_grsec_handler,
56555+ .open = open_learn,
56556+ .release = close_learn,
56557+ .poll = poll_learn,
56558+};
56559diff -urNp linux-2.6.39/grsecurity/gracl_res.c linux-2.6.39/grsecurity/gracl_res.c
56560--- linux-2.6.39/grsecurity/gracl_res.c 1969-12-31 19:00:00.000000000 -0500
56561+++ linux-2.6.39/grsecurity/gracl_res.c 2011-05-22 19:41:42.000000000 -0400
56562@@ -0,0 +1,68 @@
56563+#include <linux/kernel.h>
56564+#include <linux/sched.h>
56565+#include <linux/gracl.h>
56566+#include <linux/grinternal.h>
56567+
56568+static const char *restab_log[] = {
56569+ [RLIMIT_CPU] = "RLIMIT_CPU",
56570+ [RLIMIT_FSIZE] = "RLIMIT_FSIZE",
56571+ [RLIMIT_DATA] = "RLIMIT_DATA",
56572+ [RLIMIT_STACK] = "RLIMIT_STACK",
56573+ [RLIMIT_CORE] = "RLIMIT_CORE",
56574+ [RLIMIT_RSS] = "RLIMIT_RSS",
56575+ [RLIMIT_NPROC] = "RLIMIT_NPROC",
56576+ [RLIMIT_NOFILE] = "RLIMIT_NOFILE",
56577+ [RLIMIT_MEMLOCK] = "RLIMIT_MEMLOCK",
56578+ [RLIMIT_AS] = "RLIMIT_AS",
56579+ [RLIMIT_LOCKS] = "RLIMIT_LOCKS",
56580+ [RLIMIT_SIGPENDING] = "RLIMIT_SIGPENDING",
56581+ [RLIMIT_MSGQUEUE] = "RLIMIT_MSGQUEUE",
56582+ [RLIMIT_NICE] = "RLIMIT_NICE",
56583+ [RLIMIT_RTPRIO] = "RLIMIT_RTPRIO",
56584+ [RLIMIT_RTTIME] = "RLIMIT_RTTIME",
56585+ [GR_CRASH_RES] = "RLIMIT_CRASH"
56586+};
56587+
56588+void
56589+gr_log_resource(const struct task_struct *task,
56590+ const int res, const unsigned long wanted, const int gt)
56591+{
56592+ const struct cred *cred;
56593+ unsigned long rlim;
56594+
56595+ if (!gr_acl_is_enabled() && !grsec_resource_logging)
56596+ return;
56597+
56598+ // not yet supported resource
56599+ if (unlikely(!restab_log[res]))
56600+ return;
56601+
56602+ if (res == RLIMIT_CPU || res == RLIMIT_RTTIME)
56603+ rlim = task_rlimit_max(task, res);
56604+ else
56605+ rlim = task_rlimit(task, res);
56606+
56607+ if (likely((rlim == RLIM_INFINITY) || (gt && wanted <= rlim) || (!gt && wanted < rlim)))
56608+ return;
56609+
56610+ rcu_read_lock();
56611+ cred = __task_cred(task);
56612+
56613+ if (res == RLIMIT_NPROC &&
56614+ (cap_raised(cred->cap_effective, CAP_SYS_ADMIN) ||
56615+ cap_raised(cred->cap_effective, CAP_SYS_RESOURCE)))
56616+ goto out_rcu_unlock;
56617+ else if (res == RLIMIT_MEMLOCK &&
56618+ cap_raised(cred->cap_effective, CAP_IPC_LOCK))
56619+ goto out_rcu_unlock;
56620+ else if (res == RLIMIT_NICE && cap_raised(cred->cap_effective, CAP_SYS_NICE))
56621+ goto out_rcu_unlock;
56622+ rcu_read_unlock();
56623+
56624+ gr_log_res_ulong2_str(GR_DONT_AUDIT, GR_RESOURCE_MSG, task, wanted, restab_log[res], rlim);
56625+
56626+ return;
56627+out_rcu_unlock:
56628+ rcu_read_unlock();
56629+ return;
56630+}
56631diff -urNp linux-2.6.39/grsecurity/gracl_segv.c linux-2.6.39/grsecurity/gracl_segv.c
56632--- linux-2.6.39/grsecurity/gracl_segv.c 1969-12-31 19:00:00.000000000 -0500
56633+++ linux-2.6.39/grsecurity/gracl_segv.c 2011-05-22 22:47:39.000000000 -0400
56634@@ -0,0 +1,299 @@
56635+#include <linux/kernel.h>
56636+#include <linux/mm.h>
56637+#include <asm/uaccess.h>
56638+#include <asm/errno.h>
56639+#include <asm/mman.h>
56640+#include <net/sock.h>
56641+#include <linux/file.h>
56642+#include <linux/fs.h>
56643+#include <linux/net.h>
56644+#include <linux/in.h>
56645+#include <linux/slab.h>
56646+#include <linux/types.h>
56647+#include <linux/sched.h>
56648+#include <linux/timer.h>
56649+#include <linux/gracl.h>
56650+#include <linux/grsecurity.h>
56651+#include <linux/grinternal.h>
56652+
56653+static struct crash_uid *uid_set;
56654+static unsigned short uid_used;
56655+static DEFINE_SPINLOCK(gr_uid_lock);
56656+extern rwlock_t gr_inode_lock;
56657+extern struct acl_subject_label *
56658+ lookup_acl_subj_label(const ino_t inode, const dev_t dev,
56659+ struct acl_role_label *role);
56660+
56661+#ifdef CONFIG_BTRFS_FS
56662+extern dev_t get_btrfs_dev_from_inode(struct inode *inode);
56663+extern int btrfs_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat);
56664+#endif
56665+
56666+static inline dev_t __get_dev(const struct dentry *dentry)
56667+{
56668+#ifdef CONFIG_BTRFS_FS
56669+ if (dentry->d_inode->i_op && dentry->d_inode->i_op->getattr == &btrfs_getattr)
56670+ return get_btrfs_dev_from_inode(dentry->d_inode);
56671+ else
56672+#endif
56673+ return dentry->d_inode->i_sb->s_dev;
56674+}
56675+
56676+int
56677+gr_init_uidset(void)
56678+{
56679+ uid_set =
56680+ kmalloc(GR_UIDTABLE_MAX * sizeof (struct crash_uid), GFP_KERNEL);
56681+ uid_used = 0;
56682+
56683+ return uid_set ? 1 : 0;
56684+}
56685+
56686+void
56687+gr_free_uidset(void)
56688+{
56689+ if (uid_set)
56690+ kfree(uid_set);
56691+
56692+ return;
56693+}
56694+
56695+int
56696+gr_find_uid(const uid_t uid)
56697+{
56698+ struct crash_uid *tmp = uid_set;
56699+ uid_t buid;
56700+ int low = 0, high = uid_used - 1, mid;
56701+
56702+ while (high >= low) {
56703+ mid = (low + high) >> 1;
56704+ buid = tmp[mid].uid;
56705+ if (buid == uid)
56706+ return mid;
56707+ if (buid > uid)
56708+ high = mid - 1;
56709+ if (buid < uid)
56710+ low = mid + 1;
56711+ }
56712+
56713+ return -1;
56714+}
56715+
56716+static __inline__ void
56717+gr_insertsort(void)
56718+{
56719+ unsigned short i, j;
56720+ struct crash_uid index;
56721+
56722+ for (i = 1; i < uid_used; i++) {
56723+ index = uid_set[i];
56724+ j = i;
56725+ while ((j > 0) && uid_set[j - 1].uid > index.uid) {
56726+ uid_set[j] = uid_set[j - 1];
56727+ j--;
56728+ }
56729+ uid_set[j] = index;
56730+ }
56731+
56732+ return;
56733+}
56734+
56735+static __inline__ void
56736+gr_insert_uid(const uid_t uid, const unsigned long expires)
56737+{
56738+ int loc;
56739+
56740+ if (uid_used == GR_UIDTABLE_MAX)
56741+ return;
56742+
56743+ loc = gr_find_uid(uid);
56744+
56745+ if (loc >= 0) {
56746+ uid_set[loc].expires = expires;
56747+ return;
56748+ }
56749+
56750+ uid_set[uid_used].uid = uid;
56751+ uid_set[uid_used].expires = expires;
56752+ uid_used++;
56753+
56754+ gr_insertsort();
56755+
56756+ return;
56757+}
56758+
56759+void
56760+gr_remove_uid(const unsigned short loc)
56761+{
56762+ unsigned short i;
56763+
56764+ for (i = loc + 1; i < uid_used; i++)
56765+ uid_set[i - 1] = uid_set[i];
56766+
56767+ uid_used--;
56768+
56769+ return;
56770+}
56771+
56772+int
56773+gr_check_crash_uid(const uid_t uid)
56774+{
56775+ int loc;
56776+ int ret = 0;
56777+
56778+ if (unlikely(!gr_acl_is_enabled()))
56779+ return 0;
56780+
56781+ spin_lock(&gr_uid_lock);
56782+ loc = gr_find_uid(uid);
56783+
56784+ if (loc < 0)
56785+ goto out_unlock;
56786+
56787+ if (time_before_eq(uid_set[loc].expires, get_seconds()))
56788+ gr_remove_uid(loc);
56789+ else
56790+ ret = 1;
56791+
56792+out_unlock:
56793+ spin_unlock(&gr_uid_lock);
56794+ return ret;
56795+}
56796+
56797+static __inline__ int
56798+proc_is_setxid(const struct cred *cred)
56799+{
56800+ if (cred->uid != cred->euid || cred->uid != cred->suid ||
56801+ cred->uid != cred->fsuid)
56802+ return 1;
56803+ if (cred->gid != cred->egid || cred->gid != cred->sgid ||
56804+ cred->gid != cred->fsgid)
56805+ return 1;
56806+
56807+ return 0;
56808+}
56809+
56810+extern int gr_fake_force_sig(int sig, struct task_struct *t);
56811+
56812+void
56813+gr_handle_crash(struct task_struct *task, const int sig)
56814+{
56815+ struct acl_subject_label *curr;
56816+ struct acl_subject_label *curr2;
56817+ struct task_struct *tsk, *tsk2;
56818+ const struct cred *cred;
56819+ const struct cred *cred2;
56820+
56821+ if (sig != SIGSEGV && sig != SIGKILL && sig != SIGBUS && sig != SIGILL)
56822+ return;
56823+
56824+ if (unlikely(!gr_acl_is_enabled()))
56825+ return;
56826+
56827+ curr = task->acl;
56828+
56829+ if (!(curr->resmask & (1 << GR_CRASH_RES)))
56830+ return;
56831+
56832+ if (time_before_eq(curr->expires, get_seconds())) {
56833+ curr->expires = 0;
56834+ curr->crashes = 0;
56835+ }
56836+
56837+ curr->crashes++;
56838+
56839+ if (!curr->expires)
56840+ curr->expires = get_seconds() + curr->res[GR_CRASH_RES].rlim_max;
56841+
56842+ if ((curr->crashes >= curr->res[GR_CRASH_RES].rlim_cur) &&
56843+ time_after(curr->expires, get_seconds())) {
56844+ rcu_read_lock();
56845+ cred = __task_cred(task);
56846+ if (cred->uid && proc_is_setxid(cred)) {
56847+ gr_log_crash1(GR_DONT_AUDIT, GR_SEGVSTART_ACL_MSG, task, curr->res[GR_CRASH_RES].rlim_max);
56848+ spin_lock(&gr_uid_lock);
56849+ gr_insert_uid(cred->uid, curr->expires);
56850+ spin_unlock(&gr_uid_lock);
56851+ curr->expires = 0;
56852+ curr->crashes = 0;
56853+ read_lock(&tasklist_lock);
56854+ do_each_thread(tsk2, tsk) {
56855+ cred2 = __task_cred(tsk);
56856+ if (tsk != task && cred2->uid == cred->uid)
56857+ gr_fake_force_sig(SIGKILL, tsk);
56858+ } while_each_thread(tsk2, tsk);
56859+ read_unlock(&tasklist_lock);
56860+ } else {
56861+ gr_log_crash2(GR_DONT_AUDIT, GR_SEGVNOSUID_ACL_MSG, task, curr->res[GR_CRASH_RES].rlim_max);
56862+ read_lock(&tasklist_lock);
56863+ do_each_thread(tsk2, tsk) {
56864+ if (likely(tsk != task)) {
56865+ curr2 = tsk->acl;
56866+
56867+ if (curr2->device == curr->device &&
56868+ curr2->inode == curr->inode)
56869+ gr_fake_force_sig(SIGKILL, tsk);
56870+ }
56871+ } while_each_thread(tsk2, tsk);
56872+ read_unlock(&tasklist_lock);
56873+ }
56874+ rcu_read_unlock();
56875+ }
56876+
56877+ return;
56878+}
56879+
56880+int
56881+gr_check_crash_exec(const struct file *filp)
56882+{
56883+ struct acl_subject_label *curr;
56884+
56885+ if (unlikely(!gr_acl_is_enabled()))
56886+ return 0;
56887+
56888+ read_lock(&gr_inode_lock);
56889+ curr = lookup_acl_subj_label(filp->f_path.dentry->d_inode->i_ino,
56890+ __get_dev(filp->f_path.dentry),
56891+ current->role);
56892+ read_unlock(&gr_inode_lock);
56893+
56894+ if (!curr || !(curr->resmask & (1 << GR_CRASH_RES)) ||
56895+ (!curr->crashes && !curr->expires))
56896+ return 0;
56897+
56898+ if ((curr->crashes >= curr->res[GR_CRASH_RES].rlim_cur) &&
56899+ time_after(curr->expires, get_seconds()))
56900+ return 1;
56901+ else if (time_before_eq(curr->expires, get_seconds())) {
56902+ curr->crashes = 0;
56903+ curr->expires = 0;
56904+ }
56905+
56906+ return 0;
56907+}
56908+
56909+void
56910+gr_handle_alertkill(struct task_struct *task)
56911+{
56912+ struct acl_subject_label *curracl;
56913+ __u32 curr_ip;
56914+ struct task_struct *p, *p2;
56915+
56916+ if (unlikely(!gr_acl_is_enabled()))
56917+ return;
56918+
56919+ curracl = task->acl;
56920+ curr_ip = task->signal->curr_ip;
56921+
56922+ if ((curracl->mode & GR_KILLIPPROC) && curr_ip) {
56923+ read_lock(&tasklist_lock);
56924+ do_each_thread(p2, p) {
56925+ if (p->signal->curr_ip == curr_ip)
56926+ gr_fake_force_sig(SIGKILL, p);
56927+ } while_each_thread(p2, p);
56928+ read_unlock(&tasklist_lock);
56929+ } else if (curracl->mode & GR_KILLPROC)
56930+ gr_fake_force_sig(SIGKILL, task);
56931+
56932+ return;
56933+}
56934diff -urNp linux-2.6.39/grsecurity/gracl_shm.c linux-2.6.39/grsecurity/gracl_shm.c
56935--- linux-2.6.39/grsecurity/gracl_shm.c 1969-12-31 19:00:00.000000000 -0500
56936+++ linux-2.6.39/grsecurity/gracl_shm.c 2011-05-22 19:41:42.000000000 -0400
56937@@ -0,0 +1,40 @@
56938+#include <linux/kernel.h>
56939+#include <linux/mm.h>
56940+#include <linux/sched.h>
56941+#include <linux/file.h>
56942+#include <linux/ipc.h>
56943+#include <linux/gracl.h>
56944+#include <linux/grsecurity.h>
56945+#include <linux/grinternal.h>
56946+
56947+int
56948+gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
56949+ const time_t shm_createtime, const uid_t cuid, const int shmid)
56950+{
56951+ struct task_struct *task;
56952+
56953+ if (!gr_acl_is_enabled())
56954+ return 1;
56955+
56956+ rcu_read_lock();
56957+ read_lock(&tasklist_lock);
56958+
56959+ task = find_task_by_vpid(shm_cprid);
56960+
56961+ if (unlikely(!task))
56962+ task = find_task_by_vpid(shm_lapid);
56963+
56964+ if (unlikely(task && (time_before_eq((unsigned long)task->start_time.tv_sec, (unsigned long)shm_createtime) ||
56965+ (task->pid == shm_lapid)) &&
56966+ (task->acl->mode & GR_PROTSHM) &&
56967+ (task->acl != current->acl))) {
56968+ read_unlock(&tasklist_lock);
56969+ rcu_read_unlock();
56970+ gr_log_int3(GR_DONT_AUDIT, GR_SHMAT_ACL_MSG, cuid, shm_cprid, shmid);
56971+ return 0;
56972+ }
56973+ read_unlock(&tasklist_lock);
56974+ rcu_read_unlock();
56975+
56976+ return 1;
56977+}
56978diff -urNp linux-2.6.39/grsecurity/grsec_chdir.c linux-2.6.39/grsecurity/grsec_chdir.c
56979--- linux-2.6.39/grsecurity/grsec_chdir.c 1969-12-31 19:00:00.000000000 -0500
56980+++ linux-2.6.39/grsecurity/grsec_chdir.c 2011-05-22 19:41:42.000000000 -0400
56981@@ -0,0 +1,19 @@
56982+#include <linux/kernel.h>
56983+#include <linux/sched.h>
56984+#include <linux/fs.h>
56985+#include <linux/file.h>
56986+#include <linux/grsecurity.h>
56987+#include <linux/grinternal.h>
56988+
56989+void
56990+gr_log_chdir(const struct dentry *dentry, const struct vfsmount *mnt)
56991+{
56992+#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
56993+ if ((grsec_enable_chdir && grsec_enable_group &&
56994+ in_group_p(grsec_audit_gid)) || (grsec_enable_chdir &&
56995+ !grsec_enable_group)) {
56996+ gr_log_fs_generic(GR_DO_AUDIT, GR_CHDIR_AUDIT_MSG, dentry, mnt);
56997+ }
56998+#endif
56999+ return;
57000+}
57001diff -urNp linux-2.6.39/grsecurity/grsec_chroot.c linux-2.6.39/grsecurity/grsec_chroot.c
57002--- linux-2.6.39/grsecurity/grsec_chroot.c 1969-12-31 19:00:00.000000000 -0500
57003+++ linux-2.6.39/grsecurity/grsec_chroot.c 2011-05-22 19:41:42.000000000 -0400
57004@@ -0,0 +1,355 @@
57005+#include <linux/kernel.h>
57006+#include <linux/module.h>
57007+#include <linux/sched.h>
57008+#include <linux/file.h>
57009+#include <linux/fs.h>
57010+#include <linux/mount.h>
57011+#include <linux/types.h>
57012+#include <linux/pid_namespace.h>
57013+#include <linux/grsecurity.h>
57014+#include <linux/grinternal.h>
57015+
57016+void gr_set_chroot_entries(struct task_struct *task, struct path *path)
57017+{
57018+#ifdef CONFIG_GRKERNSEC
57019+ if (task->pid > 1 && path->dentry != init_task.fs->root.dentry &&
57020+ path->dentry != task->nsproxy->mnt_ns->root->mnt_root)
57021+ task->gr_is_chrooted = 1;
57022+ else
57023+ task->gr_is_chrooted = 0;
57024+
57025+ task->gr_chroot_dentry = path->dentry;
57026+#endif
57027+ return;
57028+}
57029+
57030+void gr_clear_chroot_entries(struct task_struct *task)
57031+{
57032+#ifdef CONFIG_GRKERNSEC
57033+ task->gr_is_chrooted = 0;
57034+ task->gr_chroot_dentry = NULL;
57035+#endif
57036+ return;
57037+}
57038+
57039+int
57040+gr_handle_chroot_unix(struct pid *pid)
57041+{
57042+#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
57043+ struct task_struct *p;
57044+
57045+ if (unlikely(!grsec_enable_chroot_unix))
57046+ return 1;
57047+
57048+ if (likely(!proc_is_chrooted(current)))
57049+ return 1;
57050+
57051+ rcu_read_lock();
57052+ read_lock(&tasklist_lock);
57053+ p = pid_task(pid, PIDTYPE_PID);
57054+ if (unlikely(p && !have_same_root(current, p))) {
57055+ read_unlock(&tasklist_lock);
57056+ rcu_read_unlock();
57057+ gr_log_noargs(GR_DONT_AUDIT, GR_UNIX_CHROOT_MSG);
57058+ return 0;
57059+ }
57060+ read_unlock(&tasklist_lock);
57061+ rcu_read_unlock();
57062+#endif
57063+ return 1;
57064+}
57065+
57066+int
57067+gr_handle_chroot_nice(void)
57068+{
57069+#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
57070+ if (grsec_enable_chroot_nice && proc_is_chrooted(current)) {
57071+ gr_log_noargs(GR_DONT_AUDIT, GR_NICE_CHROOT_MSG);
57072+ return -EPERM;
57073+ }
57074+#endif
57075+ return 0;
57076+}
57077+
57078+int
57079+gr_handle_chroot_setpriority(struct task_struct *p, const int niceval)
57080+{
57081+#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
57082+ if (grsec_enable_chroot_nice && (niceval < task_nice(p))
57083+ && proc_is_chrooted(current)) {
57084+ gr_log_str_int(GR_DONT_AUDIT, GR_PRIORITY_CHROOT_MSG, p->comm, p->pid);
57085+ return -EACCES;
57086+ }
57087+#endif
57088+ return 0;
57089+}
57090+
57091+int
57092+gr_handle_chroot_rawio(const struct inode *inode)
57093+{
57094+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
57095+ if (grsec_enable_chroot_caps && proc_is_chrooted(current) &&
57096+ inode && S_ISBLK(inode->i_mode) && !capable(CAP_SYS_RAWIO))
57097+ return 1;
57098+#endif
57099+ return 0;
57100+}
57101+
57102+int
57103+gr_handle_chroot_fowner(struct pid *pid, enum pid_type type)
57104+{
57105+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
57106+ struct task_struct *p;
57107+ int ret = 0;
57108+ if (!grsec_enable_chroot_findtask || !proc_is_chrooted(current) || !pid)
57109+ return ret;
57110+
57111+ read_lock(&tasklist_lock);
57112+ do_each_pid_task(pid, type, p) {
57113+ if (!have_same_root(current, p)) {
57114+ ret = 1;
57115+ goto out;
57116+ }
57117+ } while_each_pid_task(pid, type, p);
57118+out:
57119+ read_unlock(&tasklist_lock);
57120+ return ret;
57121+#endif
57122+ return 0;
57123+}
57124+
57125+int
57126+gr_pid_is_chrooted(struct task_struct *p)
57127+{
57128+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
57129+ if (!grsec_enable_chroot_findtask || !proc_is_chrooted(current) || p == NULL)
57130+ return 0;
57131+
57132+ if ((p->exit_state & (EXIT_ZOMBIE | EXIT_DEAD)) ||
57133+ !have_same_root(current, p)) {
57134+ return 1;
57135+ }
57136+#endif
57137+ return 0;
57138+}
57139+
57140+EXPORT_SYMBOL(gr_pid_is_chrooted);
57141+
57142+#if defined(CONFIG_GRKERNSEC_CHROOT_DOUBLE) || defined(CONFIG_GRKERNSEC_CHROOT_FCHDIR)
57143+int gr_is_outside_chroot(const struct dentry *u_dentry, const struct vfsmount *u_mnt)
57144+{
57145+ struct path path, currentroot;
57146+ int ret = 0;
57147+
57148+ path.dentry = (struct dentry *)u_dentry;
57149+ path.mnt = (struct vfsmount *)u_mnt;
57150+ get_fs_root(current->fs, &currentroot);
57151+ if (path_is_under(&path, &currentroot))
57152+ ret = 1;
57153+ path_put(&currentroot);
57154+
57155+ return ret;
57156+}
57157+#endif
57158+
57159+int
57160+gr_chroot_fchdir(struct dentry *u_dentry, struct vfsmount *u_mnt)
57161+{
57162+#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
57163+ if (!grsec_enable_chroot_fchdir)
57164+ return 1;
57165+
57166+ if (!proc_is_chrooted(current))
57167+ return 1;
57168+ else if (!gr_is_outside_chroot(u_dentry, u_mnt)) {
57169+ gr_log_fs_generic(GR_DONT_AUDIT, GR_CHROOT_FCHDIR_MSG, u_dentry, u_mnt);
57170+ return 0;
57171+ }
57172+#endif
57173+ return 1;
57174+}
57175+
57176+int
57177+gr_chroot_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
57178+ const time_t shm_createtime)
57179+{
57180+#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
57181+ struct pid *pid = NULL;
57182+ time_t starttime;
57183+
57184+ if (unlikely(!grsec_enable_chroot_shmat))
57185+ return 1;
57186+
57187+ if (likely(!proc_is_chrooted(current)))
57188+ return 1;
57189+
57190+ rcu_read_lock();
57191+ read_lock(&tasklist_lock);
57192+
57193+ pid = find_vpid(shm_cprid);
57194+ if (pid) {
57195+ struct task_struct *p;
57196+ p = pid_task(pid, PIDTYPE_PID);
57197+ if (p == NULL)
57198+ goto unlock;
57199+ starttime = p->start_time.tv_sec;
57200+ if (unlikely(!have_same_root(current, p) &&
57201+ time_before_eq((unsigned long)starttime, (unsigned long)shm_createtime))) {
57202+ read_unlock(&tasklist_lock);
57203+ rcu_read_unlock();
57204+ gr_log_noargs(GR_DONT_AUDIT, GR_SHMAT_CHROOT_MSG);
57205+ return 0;
57206+ }
57207+ } else {
57208+ pid = find_vpid(shm_lapid);
57209+ if (pid) {
57210+ struct task_struct *p;
57211+ p = pid_task(pid, PIDTYPE_PID);
57212+ if (p == NULL)
57213+ goto unlock;
57214+ if (unlikely(!have_same_root(current, p))) {
57215+ read_unlock(&tasklist_lock);
57216+ rcu_read_unlock();
57217+ gr_log_noargs(GR_DONT_AUDIT, GR_SHMAT_CHROOT_MSG);
57218+ return 0;
57219+ }
57220+ }
57221+ }
57222+unlock:
57223+ read_unlock(&tasklist_lock);
57224+ rcu_read_unlock();
57225+#endif
57226+ return 1;
57227+}
57228+
57229+void
57230+gr_log_chroot_exec(const struct dentry *dentry, const struct vfsmount *mnt)
57231+{
57232+#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
57233+ if (grsec_enable_chroot_execlog && proc_is_chrooted(current))
57234+ gr_log_fs_generic(GR_DO_AUDIT, GR_EXEC_CHROOT_MSG, dentry, mnt);
57235+#endif
57236+ return;
57237+}
57238+
57239+int
57240+gr_handle_chroot_mknod(const struct dentry *dentry,
57241+ const struct vfsmount *mnt, const int mode)
57242+{
57243+#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
57244+ if (grsec_enable_chroot_mknod && !S_ISFIFO(mode) && !S_ISREG(mode) &&
57245+ proc_is_chrooted(current)) {
57246+ gr_log_fs_generic(GR_DONT_AUDIT, GR_MKNOD_CHROOT_MSG, dentry, mnt);
57247+ return -EPERM;
57248+ }
57249+#endif
57250+ return 0;
57251+}
57252+
57253+int
57254+gr_handle_chroot_mount(const struct dentry *dentry,
57255+ const struct vfsmount *mnt, const char *dev_name)
57256+{
57257+#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
57258+ if (grsec_enable_chroot_mount && proc_is_chrooted(current)) {
57259+ gr_log_str_fs(GR_DONT_AUDIT, GR_MOUNT_CHROOT_MSG, dev_name, dentry, mnt);
57260+ return -EPERM;
57261+ }
57262+#endif
57263+ return 0;
57264+}
57265+
57266+int
57267+gr_handle_chroot_pivot(void)
57268+{
57269+#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
57270+ if (grsec_enable_chroot_pivot && proc_is_chrooted(current)) {
57271+ gr_log_noargs(GR_DONT_AUDIT, GR_PIVOT_CHROOT_MSG);
57272+ return -EPERM;
57273+ }
57274+#endif
57275+ return 0;
57276+}
57277+
57278+int
57279+gr_handle_chroot_chroot(const struct dentry *dentry, const struct vfsmount *mnt)
57280+{
57281+#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
57282+ if (grsec_enable_chroot_double && proc_is_chrooted(current) &&
57283+ !gr_is_outside_chroot(dentry, mnt)) {
57284+ gr_log_fs_generic(GR_DONT_AUDIT, GR_CHROOT_CHROOT_MSG, dentry, mnt);
57285+ return -EPERM;
57286+ }
57287+#endif
57288+ return 0;
57289+}
57290+
57291+int
57292+gr_handle_chroot_caps(struct path *path)
57293+{
57294+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
57295+ if (grsec_enable_chroot_caps && current->pid > 1 && current->fs != NULL &&
57296+ (init_task.fs->root.dentry != path->dentry) &&
57297+ (current->nsproxy->mnt_ns->root->mnt_root != path->dentry)) {
57298+
57299+ kernel_cap_t chroot_caps = GR_CHROOT_CAPS;
57300+ const struct cred *old = current_cred();
57301+ struct cred *new = prepare_creds();
57302+ if (new == NULL)
57303+ return 1;
57304+
57305+ new->cap_permitted = cap_drop(old->cap_permitted,
57306+ chroot_caps);
57307+ new->cap_inheritable = cap_drop(old->cap_inheritable,
57308+ chroot_caps);
57309+ new->cap_effective = cap_drop(old->cap_effective,
57310+ chroot_caps);
57311+
57312+ commit_creds(new);
57313+
57314+ return 0;
57315+ }
57316+#endif
57317+ return 0;
57318+}
57319+
57320+int
57321+gr_handle_chroot_sysctl(const int op)
57322+{
57323+#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
57324+ if (grsec_enable_chroot_sysctl && (op & MAY_WRITE) &&
57325+ proc_is_chrooted(current))
57326+ return -EACCES;
57327+#endif
57328+ return 0;
57329+}
57330+
57331+void
57332+gr_handle_chroot_chdir(struct path *path)
57333+{
57334+#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
57335+ if (grsec_enable_chroot_chdir)
57336+ set_fs_pwd(current->fs, path);
57337+#endif
57338+ return;
57339+}
57340+
57341+int
57342+gr_handle_chroot_chmod(const struct dentry *dentry,
57343+ const struct vfsmount *mnt, const int mode)
57344+{
57345+#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
57346+ /* allow chmod +s on directories, but not files */
57347+ if (grsec_enable_chroot_chmod && !S_ISDIR(dentry->d_inode->i_mode) &&
57348+ ((mode & S_ISUID) || ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))) &&
57349+ proc_is_chrooted(current)) {
57350+ gr_log_fs_generic(GR_DONT_AUDIT, GR_CHMOD_CHROOT_MSG, dentry, mnt);
57351+ return -EPERM;
57352+ }
57353+#endif
57354+ return 0;
57355+}
57356+
57357+#ifdef CONFIG_SECURITY
57358+EXPORT_SYMBOL(gr_handle_chroot_caps);
57359+#endif
57360diff -urNp linux-2.6.39/grsecurity/grsec_disabled.c linux-2.6.39/grsecurity/grsec_disabled.c
57361--- linux-2.6.39/grsecurity/grsec_disabled.c 1969-12-31 19:00:00.000000000 -0500
57362+++ linux-2.6.39/grsecurity/grsec_disabled.c 2011-05-22 19:41:42.000000000 -0400
57363@@ -0,0 +1,447 @@
57364+#include <linux/kernel.h>
57365+#include <linux/module.h>
57366+#include <linux/sched.h>
57367+#include <linux/file.h>
57368+#include <linux/fs.h>
57369+#include <linux/kdev_t.h>
57370+#include <linux/net.h>
57371+#include <linux/in.h>
57372+#include <linux/ip.h>
57373+#include <linux/skbuff.h>
57374+#include <linux/sysctl.h>
57375+
57376+#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
57377+void
57378+pax_set_initial_flags(struct linux_binprm *bprm)
57379+{
57380+ return;
57381+}
57382+#endif
57383+
57384+#ifdef CONFIG_SYSCTL
57385+__u32
57386+gr_handle_sysctl(const struct ctl_table * table, const int op)
57387+{
57388+ return 0;
57389+}
57390+#endif
57391+
57392+#ifdef CONFIG_TASKSTATS
57393+int gr_is_taskstats_denied(int pid)
57394+{
57395+ return 0;
57396+}
57397+#endif
57398+
57399+int
57400+gr_acl_is_enabled(void)
57401+{
57402+ return 0;
57403+}
57404+
57405+int
57406+gr_handle_rawio(const struct inode *inode)
57407+{
57408+ return 0;
57409+}
57410+
57411+void
57412+gr_acl_handle_psacct(struct task_struct *task, const long code)
57413+{
57414+ return;
57415+}
57416+
57417+int
57418+gr_handle_ptrace(struct task_struct *task, const long request)
57419+{
57420+ return 0;
57421+}
57422+
57423+int
57424+gr_handle_proc_ptrace(struct task_struct *task)
57425+{
57426+ return 0;
57427+}
57428+
57429+void
57430+gr_learn_resource(const struct task_struct *task,
57431+ const int res, const unsigned long wanted, const int gt)
57432+{
57433+ return;
57434+}
57435+
57436+int
57437+gr_set_acls(const int type)
57438+{
57439+ return 0;
57440+}
57441+
57442+int
57443+gr_check_hidden_task(const struct task_struct *tsk)
57444+{
57445+ return 0;
57446+}
57447+
57448+int
57449+gr_check_protected_task(const struct task_struct *task)
57450+{
57451+ return 0;
57452+}
57453+
57454+int
57455+gr_check_protected_task_fowner(struct pid *pid, enum pid_type type)
57456+{
57457+ return 0;
57458+}
57459+
57460+void
57461+gr_copy_label(struct task_struct *tsk)
57462+{
57463+ return;
57464+}
57465+
57466+void
57467+gr_set_pax_flags(struct task_struct *task)
57468+{
57469+ return;
57470+}
57471+
57472+int
57473+gr_set_proc_label(const struct dentry *dentry, const struct vfsmount *mnt,
57474+ const int unsafe_share)
57475+{
57476+ return 0;
57477+}
57478+
57479+void
57480+gr_handle_delete(const ino_t ino, const dev_t dev)
57481+{
57482+ return;
57483+}
57484+
57485+void
57486+gr_handle_create(const struct dentry *dentry, const struct vfsmount *mnt)
57487+{
57488+ return;
57489+}
57490+
57491+void
57492+gr_handle_crash(struct task_struct *task, const int sig)
57493+{
57494+ return;
57495+}
57496+
57497+int
57498+gr_check_crash_exec(const struct file *filp)
57499+{
57500+ return 0;
57501+}
57502+
57503+int
57504+gr_check_crash_uid(const uid_t uid)
57505+{
57506+ return 0;
57507+}
57508+
57509+void
57510+gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
57511+ struct dentry *old_dentry,
57512+ struct dentry *new_dentry,
57513+ struct vfsmount *mnt, const __u8 replace)
57514+{
57515+ return;
57516+}
57517+
57518+int
57519+gr_search_socket(const int family, const int type, const int protocol)
57520+{
57521+ return 1;
57522+}
57523+
57524+int
57525+gr_search_connectbind(const int mode, const struct socket *sock,
57526+ const struct sockaddr_in *addr)
57527+{
57528+ return 0;
57529+}
57530+
57531+int
57532+gr_is_capable(const int cap)
57533+{
57534+ return 1;
57535+}
57536+
57537+int
57538+gr_is_capable_nolog(const int cap)
57539+{
57540+ return 1;
57541+}
57542+
57543+void
57544+gr_handle_alertkill(struct task_struct *task)
57545+{
57546+ return;
57547+}
57548+
57549+__u32
57550+gr_acl_handle_execve(const struct dentry * dentry, const struct vfsmount * mnt)
57551+{
57552+ return 1;
57553+}
57554+
57555+__u32
57556+gr_acl_handle_hidden_file(const struct dentry * dentry,
57557+ const struct vfsmount * mnt)
57558+{
57559+ return 1;
57560+}
57561+
57562+__u32
57563+gr_acl_handle_open(const struct dentry * dentry, const struct vfsmount * mnt,
57564+ const int fmode)
57565+{
57566+ return 1;
57567+}
57568+
57569+__u32
57570+gr_acl_handle_rmdir(const struct dentry * dentry, const struct vfsmount * mnt)
57571+{
57572+ return 1;
57573+}
57574+
57575+__u32
57576+gr_acl_handle_unlink(const struct dentry * dentry, const struct vfsmount * mnt)
57577+{
57578+ return 1;
57579+}
57580+
57581+int
57582+gr_acl_handle_mmap(const struct file *file, const unsigned long prot,
57583+ unsigned int *vm_flags)
57584+{
57585+ return 1;
57586+}
57587+
57588+__u32
57589+gr_acl_handle_truncate(const struct dentry * dentry,
57590+ const struct vfsmount * mnt)
57591+{
57592+ return 1;
57593+}
57594+
57595+__u32
57596+gr_acl_handle_utime(const struct dentry * dentry, const struct vfsmount * mnt)
57597+{
57598+ return 1;
57599+}
57600+
57601+__u32
57602+gr_acl_handle_access(const struct dentry * dentry,
57603+ const struct vfsmount * mnt, const int fmode)
57604+{
57605+ return 1;
57606+}
57607+
57608+__u32
57609+gr_acl_handle_fchmod(const struct dentry * dentry, const struct vfsmount * mnt,
57610+ mode_t mode)
57611+{
57612+ return 1;
57613+}
57614+
57615+__u32
57616+gr_acl_handle_chmod(const struct dentry * dentry, const struct vfsmount * mnt,
57617+ mode_t mode)
57618+{
57619+ return 1;
57620+}
57621+
57622+__u32
57623+gr_acl_handle_chown(const struct dentry * dentry, const struct vfsmount * mnt)
57624+{
57625+ return 1;
57626+}
57627+
57628+__u32
57629+gr_acl_handle_setxattr(const struct dentry * dentry, const struct vfsmount * mnt)
57630+{
57631+ return 1;
57632+}
57633+
57634+void
57635+grsecurity_init(void)
57636+{
57637+ return;
57638+}
57639+
57640+__u32
57641+gr_acl_handle_mknod(const struct dentry * new_dentry,
57642+ const struct dentry * parent_dentry,
57643+ const struct vfsmount * parent_mnt,
57644+ const int mode)
57645+{
57646+ return 1;
57647+}
57648+
57649+__u32
57650+gr_acl_handle_mkdir(const struct dentry * new_dentry,
57651+ const struct dentry * parent_dentry,
57652+ const struct vfsmount * parent_mnt)
57653+{
57654+ return 1;
57655+}
57656+
57657+__u32
57658+gr_acl_handle_symlink(const struct dentry * new_dentry,
57659+ const struct dentry * parent_dentry,
57660+ const struct vfsmount * parent_mnt, const char *from)
57661+{
57662+ return 1;
57663+}
57664+
57665+__u32
57666+gr_acl_handle_link(const struct dentry * new_dentry,
57667+ const struct dentry * parent_dentry,
57668+ const struct vfsmount * parent_mnt,
57669+ const struct dentry * old_dentry,
57670+ const struct vfsmount * old_mnt, const char *to)
57671+{
57672+ return 1;
57673+}
57674+
57675+int
57676+gr_acl_handle_rename(const struct dentry *new_dentry,
57677+ const struct dentry *parent_dentry,
57678+ const struct vfsmount *parent_mnt,
57679+ const struct dentry *old_dentry,
57680+ const struct inode *old_parent_inode,
57681+ const struct vfsmount *old_mnt, const char *newname)
57682+{
57683+ return 0;
57684+}
57685+
57686+int
57687+gr_acl_handle_filldir(const struct file *file, const char *name,
57688+ const int namelen, const ino_t ino)
57689+{
57690+ return 1;
57691+}
57692+
57693+int
57694+gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
57695+ const time_t shm_createtime, const uid_t cuid, const int shmid)
57696+{
57697+ return 1;
57698+}
57699+
57700+int
57701+gr_search_bind(const struct socket *sock, const struct sockaddr_in *addr)
57702+{
57703+ return 0;
57704+}
57705+
57706+int
57707+gr_search_accept(const struct socket *sock)
57708+{
57709+ return 0;
57710+}
57711+
57712+int
57713+gr_search_listen(const struct socket *sock)
57714+{
57715+ return 0;
57716+}
57717+
57718+int
57719+gr_search_connect(const struct socket *sock, const struct sockaddr_in *addr)
57720+{
57721+ return 0;
57722+}
57723+
57724+__u32
57725+gr_acl_handle_unix(const struct dentry * dentry, const struct vfsmount * mnt)
57726+{
57727+ return 1;
57728+}
57729+
57730+__u32
57731+gr_acl_handle_creat(const struct dentry * dentry,
57732+ const struct dentry * p_dentry,
57733+ const struct vfsmount * p_mnt, const int fmode,
57734+ const int imode)
57735+{
57736+ return 1;
57737+}
57738+
57739+void
57740+gr_acl_handle_exit(void)
57741+{
57742+ return;
57743+}
57744+
57745+int
57746+gr_acl_handle_mprotect(const struct file *file, const unsigned long prot)
57747+{
57748+ return 1;
57749+}
57750+
57751+void
57752+gr_set_role_label(const uid_t uid, const gid_t gid)
57753+{
57754+ return;
57755+}
57756+
57757+int
57758+gr_acl_handle_procpidmem(const struct task_struct *task)
57759+{
57760+ return 0;
57761+}
57762+
57763+int
57764+gr_search_udp_recvmsg(const struct sock *sk, const struct sk_buff *skb)
57765+{
57766+ return 0;
57767+}
57768+
57769+int
57770+gr_search_udp_sendmsg(const struct sock *sk, const struct sockaddr_in *addr)
57771+{
57772+ return 0;
57773+}
57774+
57775+void
57776+gr_set_kernel_label(struct task_struct *task)
57777+{
57778+ return;
57779+}
57780+
57781+int
57782+gr_check_user_change(int real, int effective, int fs)
57783+{
57784+ return 0;
57785+}
57786+
57787+int
57788+gr_check_group_change(int real, int effective, int fs)
57789+{
57790+ return 0;
57791+}
57792+
57793+int gr_acl_enable_at_secure(void)
57794+{
57795+ return 0;
57796+}
57797+
57798+dev_t gr_get_dev_from_dentry(struct dentry *dentry)
57799+{
57800+ return dentry->d_inode->i_sb->s_dev;
57801+}
57802+
57803+EXPORT_SYMBOL(gr_is_capable);
57804+EXPORT_SYMBOL(gr_is_capable_nolog);
57805+EXPORT_SYMBOL(gr_learn_resource);
57806+EXPORT_SYMBOL(gr_set_kernel_label);
57807+#ifdef CONFIG_SECURITY
57808+EXPORT_SYMBOL(gr_check_user_change);
57809+EXPORT_SYMBOL(gr_check_group_change);
57810+#endif
57811diff -urNp linux-2.6.39/grsecurity/grsec_exec.c linux-2.6.39/grsecurity/grsec_exec.c
57812--- linux-2.6.39/grsecurity/grsec_exec.c 1969-12-31 19:00:00.000000000 -0500
57813+++ linux-2.6.39/grsecurity/grsec_exec.c 2011-05-22 22:41:29.000000000 -0400
57814@@ -0,0 +1,146 @@
57815+#include <linux/kernel.h>
57816+#include <linux/sched.h>
57817+#include <linux/file.h>
57818+#include <linux/binfmts.h>
57819+#include <linux/fs.h>
57820+#include <linux/types.h>
57821+#include <linux/grdefs.h>
57822+#include <linux/grinternal.h>
57823+#include <linux/capability.h>
57824+#include <linux/compat.h>
57825+
57826+#include <asm/uaccess.h>
57827+
57828+#ifdef CONFIG_GRKERNSEC_EXECLOG
57829+static char gr_exec_arg_buf[132];
57830+static DEFINE_MUTEX(gr_exec_arg_mutex);
57831+#endif
57832+
57833+int
57834+gr_handle_nproc(void)
57835+{
57836+#ifdef CONFIG_GRKERNSEC_EXECVE
57837+ const struct cred *cred = current_cred();
57838+ if (grsec_enable_execve && cred->user &&
57839+ (atomic_read(&cred->user->processes) > rlimit(RLIMIT_NPROC)) &&
57840+ !capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE)) {
57841+ gr_log_noargs(GR_DONT_AUDIT, GR_NPROC_MSG);
57842+ return -EAGAIN;
57843+ }
57844+#endif
57845+ return 0;
57846+}
57847+
57848+void
57849+gr_handle_exec_args(struct linux_binprm *bprm, const char __user *const __user *argv)
57850+{
57851+#ifdef CONFIG_GRKERNSEC_EXECLOG
57852+ char *grarg = gr_exec_arg_buf;
57853+ unsigned int i, x, execlen = 0;
57854+ char c;
57855+
57856+ if (!((grsec_enable_execlog && grsec_enable_group &&
57857+ in_group_p(grsec_audit_gid))
57858+ || (grsec_enable_execlog && !grsec_enable_group)))
57859+ return;
57860+
57861+ mutex_lock(&gr_exec_arg_mutex);
57862+ memset(grarg, 0, sizeof(gr_exec_arg_buf));
57863+
57864+ if (unlikely(argv == NULL))
57865+ goto log;
57866+
57867+ for (i = 0; i < bprm->argc && execlen < 128; i++) {
57868+ const char __user *p;
57869+ unsigned int len;
57870+
57871+ if (copy_from_user(&p, argv + i, sizeof(p)))
57872+ goto log;
57873+ if (!p)
57874+ goto log;
57875+ len = strnlen_user(p, 128 - execlen);
57876+ if (len > 128 - execlen)
57877+ len = 128 - execlen;
57878+ else if (len > 0)
57879+ len--;
57880+ if (copy_from_user(grarg + execlen, p, len))
57881+ goto log;
57882+
57883+ /* rewrite unprintable characters */
57884+ for (x = 0; x < len; x++) {
57885+ c = *(grarg + execlen + x);
57886+ if (c < 32 || c > 126)
57887+ *(grarg + execlen + x) = ' ';
57888+ }
57889+
57890+ execlen += len;
57891+ *(grarg + execlen) = ' ';
57892+ *(grarg + execlen + 1) = '\0';
57893+ execlen++;
57894+ }
57895+
57896+ log:
57897+ gr_log_fs_str(GR_DO_AUDIT, GR_EXEC_AUDIT_MSG, bprm->file->f_path.dentry,
57898+ bprm->file->f_path.mnt, grarg);
57899+ mutex_unlock(&gr_exec_arg_mutex);
57900+#endif
57901+ return;
57902+}
57903+
57904+#ifdef CONFIG_COMPAT
57905+void
57906+gr_handle_exec_args_compat(struct linux_binprm *bprm, compat_uptr_t __user *argv)
57907+{
57908+#ifdef CONFIG_GRKERNSEC_EXECLOG
57909+ char *grarg = gr_exec_arg_buf;
57910+ unsigned int i, x, execlen = 0;
57911+ char c;
57912+
57913+ if (!((grsec_enable_execlog && grsec_enable_group &&
57914+ in_group_p(grsec_audit_gid))
57915+ || (grsec_enable_execlog && !grsec_enable_group)))
57916+ return;
57917+
57918+ mutex_lock(&gr_exec_arg_mutex);
57919+ memset(grarg, 0, sizeof(gr_exec_arg_buf));
57920+
57921+ if (unlikely(argv == NULL))
57922+ goto log;
57923+
57924+ for (i = 0; i < bprm->argc && execlen < 128; i++) {
57925+ compat_uptr_t p;
57926+ unsigned int len;
57927+
57928+ if (get_user(p, argv + i))
57929+ goto log;
57930+ len = strnlen_user(compat_ptr(p), 128 - execlen);
57931+ if (len > 128 - execlen)
57932+ len = 128 - execlen;
57933+ else if (len > 0)
57934+ len--;
57935+ else
57936+ goto log;
57937+ if (copy_from_user(grarg + execlen, compat_ptr(p), len))
57938+ goto log;
57939+
57940+ /* rewrite unprintable characters */
57941+ for (x = 0; x < len; x++) {
57942+ c = *(grarg + execlen + x);
57943+ if (c < 32 || c > 126)
57944+ *(grarg + execlen + x) = ' ';
57945+ }
57946+
57947+ execlen += len;
57948+ *(grarg + execlen) = ' ';
57949+ *(grarg + execlen + 1) = '\0';
57950+ execlen++;
57951+ }
57952+
57953+ log:
57954+ gr_log_fs_str(GR_DO_AUDIT, GR_EXEC_AUDIT_MSG, bprm->file->f_path.dentry,
57955+ bprm->file->f_path.mnt, grarg);
57956+ mutex_unlock(&gr_exec_arg_mutex);
57957+#endif
57958+ return;
57959+}
57960+#endif
57961diff -urNp linux-2.6.39/grsecurity/grsec_fifo.c linux-2.6.39/grsecurity/grsec_fifo.c
57962--- linux-2.6.39/grsecurity/grsec_fifo.c 1969-12-31 19:00:00.000000000 -0500
57963+++ linux-2.6.39/grsecurity/grsec_fifo.c 2011-05-22 19:41:42.000000000 -0400
57964@@ -0,0 +1,24 @@
57965+#include <linux/kernel.h>
57966+#include <linux/sched.h>
57967+#include <linux/fs.h>
57968+#include <linux/file.h>
57969+#include <linux/grinternal.h>
57970+
57971+int
57972+gr_handle_fifo(const struct dentry *dentry, const struct vfsmount *mnt,
57973+ const struct dentry *dir, const int flag, const int acc_mode)
57974+{
57975+#ifdef CONFIG_GRKERNSEC_FIFO
57976+ const struct cred *cred = current_cred();
57977+
57978+ if (grsec_enable_fifo && S_ISFIFO(dentry->d_inode->i_mode) &&
57979+ !(flag & O_EXCL) && (dir->d_inode->i_mode & S_ISVTX) &&
57980+ (dentry->d_inode->i_uid != dir->d_inode->i_uid) &&
57981+ (cred->fsuid != dentry->d_inode->i_uid)) {
57982+ if (!inode_permission(dentry->d_inode, acc_mode))
57983+ gr_log_fs_int2(GR_DONT_AUDIT, GR_FIFO_MSG, dentry, mnt, dentry->d_inode->i_uid, dentry->d_inode->i_gid);
57984+ return -EACCES;
57985+ }
57986+#endif
57987+ return 0;
57988+}
57989diff -urNp linux-2.6.39/grsecurity/grsec_fork.c linux-2.6.39/grsecurity/grsec_fork.c
57990--- linux-2.6.39/grsecurity/grsec_fork.c 1969-12-31 19:00:00.000000000 -0500
57991+++ linux-2.6.39/grsecurity/grsec_fork.c 2011-05-22 19:41:42.000000000 -0400
57992@@ -0,0 +1,23 @@
57993+#include <linux/kernel.h>
57994+#include <linux/sched.h>
57995+#include <linux/grsecurity.h>
57996+#include <linux/grinternal.h>
57997+#include <linux/errno.h>
57998+
57999+void
58000+gr_log_forkfail(const int retval)
58001+{
58002+#ifdef CONFIG_GRKERNSEC_FORKFAIL
58003+ if (grsec_enable_forkfail && (retval == -EAGAIN || retval == -ENOMEM)) {
58004+ switch (retval) {
58005+ case -EAGAIN:
58006+ gr_log_str(GR_DONT_AUDIT, GR_FAILFORK_MSG, "EAGAIN");
58007+ break;
58008+ case -ENOMEM:
58009+ gr_log_str(GR_DONT_AUDIT, GR_FAILFORK_MSG, "ENOMEM");
58010+ break;
58011+ }
58012+ }
58013+#endif
58014+ return;
58015+}
58016diff -urNp linux-2.6.39/grsecurity/grsec_init.c linux-2.6.39/grsecurity/grsec_init.c
58017--- linux-2.6.39/grsecurity/grsec_init.c 1969-12-31 19:00:00.000000000 -0500
58018+++ linux-2.6.39/grsecurity/grsec_init.c 2011-05-22 22:47:15.000000000 -0400
58019@@ -0,0 +1,269 @@
58020+#include <linux/kernel.h>
58021+#include <linux/sched.h>
58022+#include <linux/mm.h>
58023+#include <linux/gracl.h>
58024+#include <linux/slab.h>
58025+#include <linux/vmalloc.h>
58026+#include <linux/percpu.h>
58027+#include <linux/module.h>
58028+
58029+int grsec_enable_link;
58030+int grsec_enable_dmesg;
58031+int grsec_enable_harden_ptrace;
58032+int grsec_enable_fifo;
58033+int grsec_enable_execve;
58034+int grsec_enable_execlog;
58035+int grsec_enable_signal;
58036+int grsec_enable_forkfail;
58037+int grsec_enable_audit_ptrace;
58038+int grsec_enable_time;
58039+int grsec_enable_audit_textrel;
58040+int grsec_enable_group;
58041+int grsec_audit_gid;
58042+int grsec_enable_chdir;
58043+int grsec_enable_mount;
58044+int grsec_enable_rofs;
58045+int grsec_enable_chroot_findtask;
58046+int grsec_enable_chroot_mount;
58047+int grsec_enable_chroot_shmat;
58048+int grsec_enable_chroot_fchdir;
58049+int grsec_enable_chroot_double;
58050+int grsec_enable_chroot_pivot;
58051+int grsec_enable_chroot_chdir;
58052+int grsec_enable_chroot_chmod;
58053+int grsec_enable_chroot_mknod;
58054+int grsec_enable_chroot_nice;
58055+int grsec_enable_chroot_execlog;
58056+int grsec_enable_chroot_caps;
58057+int grsec_enable_chroot_sysctl;
58058+int grsec_enable_chroot_unix;
58059+int grsec_enable_tpe;
58060+int grsec_tpe_gid;
58061+int grsec_enable_blackhole;
58062+#ifdef CONFIG_IPV6_MODULE
58063+EXPORT_SYMBOL(grsec_enable_blackhole);
58064+#endif
58065+int grsec_lastack_retries;
58066+int grsec_enable_tpe_all;
58067+int grsec_enable_tpe_invert;
58068+int grsec_enable_socket_all;
58069+int grsec_socket_all_gid;
58070+int grsec_enable_socket_client;
58071+int grsec_socket_client_gid;
58072+int grsec_enable_socket_server;
58073+int grsec_socket_server_gid;
58074+int grsec_resource_logging;
58075+int grsec_disable_privio;
58076+int grsec_enable_log_rwxmaps;
58077+int grsec_lock;
58078+
58079+DEFINE_SPINLOCK(grsec_alert_lock);
58080+unsigned long grsec_alert_wtime = 0;
58081+unsigned long grsec_alert_fyet = 0;
58082+
58083+DEFINE_SPINLOCK(grsec_audit_lock);
58084+
58085+DEFINE_RWLOCK(grsec_exec_file_lock);
58086+
58087+char *gr_shared_page[4];
58088+
58089+char *gr_alert_log_fmt;
58090+char *gr_audit_log_fmt;
58091+char *gr_alert_log_buf;
58092+char *gr_audit_log_buf;
58093+
58094+extern struct gr_arg *gr_usermode;
58095+extern unsigned char *gr_system_salt;
58096+extern unsigned char *gr_system_sum;
58097+
58098+void __init
58099+grsecurity_init(void)
58100+{
58101+ int j;
58102+ /* create the per-cpu shared pages */
58103+
58104+#ifdef CONFIG_X86
58105+ memset((char *)(0x41a + PAGE_OFFSET), 0, 36);
58106+#endif
58107+
58108+ for (j = 0; j < 4; j++) {
58109+ gr_shared_page[j] = (char *)__alloc_percpu(PAGE_SIZE, __alignof__(unsigned long long));
58110+ if (gr_shared_page[j] == NULL) {
58111+ panic("Unable to allocate grsecurity shared page");
58112+ return;
58113+ }
58114+ }
58115+
58116+ /* allocate log buffers */
58117+ gr_alert_log_fmt = kmalloc(512, GFP_KERNEL);
58118+ if (!gr_alert_log_fmt) {
58119+ panic("Unable to allocate grsecurity alert log format buffer");
58120+ return;
58121+ }
58122+ gr_audit_log_fmt = kmalloc(512, GFP_KERNEL);
58123+ if (!gr_audit_log_fmt) {
58124+ panic("Unable to allocate grsecurity audit log format buffer");
58125+ return;
58126+ }
58127+ gr_alert_log_buf = (char *) get_zeroed_page(GFP_KERNEL);
58128+ if (!gr_alert_log_buf) {
58129+ panic("Unable to allocate grsecurity alert log buffer");
58130+ return;
58131+ }
58132+ gr_audit_log_buf = (char *) get_zeroed_page(GFP_KERNEL);
58133+ if (!gr_audit_log_buf) {
58134+ panic("Unable to allocate grsecurity audit log buffer");
58135+ return;
58136+ }
58137+
58138+ /* allocate memory for authentication structure */
58139+ gr_usermode = kmalloc(sizeof(struct gr_arg), GFP_KERNEL);
58140+ gr_system_salt = kmalloc(GR_SALT_LEN, GFP_KERNEL);
58141+ gr_system_sum = kmalloc(GR_SHA_LEN, GFP_KERNEL);
58142+
58143+ if (!gr_usermode || !gr_system_salt || !gr_system_sum) {
58144+ panic("Unable to allocate grsecurity authentication structure");
58145+ return;
58146+ }
58147+
58148+
58149+#ifdef CONFIG_GRKERNSEC_IO
58150+#if !defined(CONFIG_GRKERNSEC_SYSCTL_DISTRO)
58151+ grsec_disable_privio = 1;
58152+#elif defined(CONFIG_GRKERNSEC_SYSCTL_ON)
58153+ grsec_disable_privio = 1;
58154+#else
58155+ grsec_disable_privio = 0;
58156+#endif
58157+#endif
58158+
58159+#ifdef CONFIG_GRKERNSEC_TPE_INVERT
58160+ /* for backward compatibility, tpe_invert always defaults to on if
58161+ enabled in the kernel
58162+ */
58163+ grsec_enable_tpe_invert = 1;
58164+#endif
58165+
58166+#if !defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_SYSCTL_ON)
58167+#ifndef CONFIG_GRKERNSEC_SYSCTL
58168+ grsec_lock = 1;
58169+#endif
58170+
58171+#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
58172+ grsec_enable_audit_textrel = 1;
58173+#endif
58174+#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
58175+ grsec_enable_log_rwxmaps = 1;
58176+#endif
58177+#ifdef CONFIG_GRKERNSEC_AUDIT_GROUP
58178+ grsec_enable_group = 1;
58179+ grsec_audit_gid = CONFIG_GRKERNSEC_AUDIT_GID;
58180+#endif
58181+#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
58182+ grsec_enable_chdir = 1;
58183+#endif
58184+#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
58185+ grsec_enable_harden_ptrace = 1;
58186+#endif
58187+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
58188+ grsec_enable_mount = 1;
58189+#endif
58190+#ifdef CONFIG_GRKERNSEC_LINK
58191+ grsec_enable_link = 1;
58192+#endif
58193+#ifdef CONFIG_GRKERNSEC_DMESG
58194+ grsec_enable_dmesg = 1;
58195+#endif
58196+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
58197+ grsec_enable_blackhole = 1;
58198+ grsec_lastack_retries = 4;
58199+#endif
58200+#ifdef CONFIG_GRKERNSEC_FIFO
58201+ grsec_enable_fifo = 1;
58202+#endif
58203+#ifdef CONFIG_GRKERNSEC_EXECVE
58204+ grsec_enable_execve = 1;
58205+#endif
58206+#ifdef CONFIG_GRKERNSEC_EXECLOG
58207+ grsec_enable_execlog = 1;
58208+#endif
58209+#ifdef CONFIG_GRKERNSEC_SIGNAL
58210+ grsec_enable_signal = 1;
58211+#endif
58212+#ifdef CONFIG_GRKERNSEC_FORKFAIL
58213+ grsec_enable_forkfail = 1;
58214+#endif
58215+#ifdef CONFIG_GRKERNSEC_TIME
58216+ grsec_enable_time = 1;
58217+#endif
58218+#ifdef CONFIG_GRKERNSEC_RESLOG
58219+ grsec_resource_logging = 1;
58220+#endif
58221+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
58222+ grsec_enable_chroot_findtask = 1;
58223+#endif
58224+#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
58225+ grsec_enable_chroot_unix = 1;
58226+#endif
58227+#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
58228+ grsec_enable_chroot_mount = 1;
58229+#endif
58230+#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
58231+ grsec_enable_chroot_fchdir = 1;
58232+#endif
58233+#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
58234+ grsec_enable_chroot_shmat = 1;
58235+#endif
58236+#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
58237+ grsec_enable_audit_ptrace = 1;
58238+#endif
58239+#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
58240+ grsec_enable_chroot_double = 1;
58241+#endif
58242+#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
58243+ grsec_enable_chroot_pivot = 1;
58244+#endif
58245+#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
58246+ grsec_enable_chroot_chdir = 1;
58247+#endif
58248+#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
58249+ grsec_enable_chroot_chmod = 1;
58250+#endif
58251+#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
58252+ grsec_enable_chroot_mknod = 1;
58253+#endif
58254+#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
58255+ grsec_enable_chroot_nice = 1;
58256+#endif
58257+#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
58258+ grsec_enable_chroot_execlog = 1;
58259+#endif
58260+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
58261+ grsec_enable_chroot_caps = 1;
58262+#endif
58263+#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
58264+ grsec_enable_chroot_sysctl = 1;
58265+#endif
58266+#ifdef CONFIG_GRKERNSEC_TPE
58267+ grsec_enable_tpe = 1;
58268+ grsec_tpe_gid = CONFIG_GRKERNSEC_TPE_GID;
58269+#ifdef CONFIG_GRKERNSEC_TPE_ALL
58270+ grsec_enable_tpe_all = 1;
58271+#endif
58272+#endif
58273+#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
58274+ grsec_enable_socket_all = 1;
58275+ grsec_socket_all_gid = CONFIG_GRKERNSEC_SOCKET_ALL_GID;
58276+#endif
58277+#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
58278+ grsec_enable_socket_client = 1;
58279+ grsec_socket_client_gid = CONFIG_GRKERNSEC_SOCKET_CLIENT_GID;
58280+#endif
58281+#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
58282+ grsec_enable_socket_server = 1;
58283+ grsec_socket_server_gid = CONFIG_GRKERNSEC_SOCKET_SERVER_GID;
58284+#endif
58285+#endif
58286+
58287+ return;
58288+}
58289diff -urNp linux-2.6.39/grsecurity/grsec_link.c linux-2.6.39/grsecurity/grsec_link.c
58290--- linux-2.6.39/grsecurity/grsec_link.c 1969-12-31 19:00:00.000000000 -0500
58291+++ linux-2.6.39/grsecurity/grsec_link.c 2011-05-22 19:41:42.000000000 -0400
58292@@ -0,0 +1,43 @@
58293+#include <linux/kernel.h>
58294+#include <linux/sched.h>
58295+#include <linux/fs.h>
58296+#include <linux/file.h>
58297+#include <linux/grinternal.h>
58298+
58299+int
58300+gr_handle_follow_link(const struct inode *parent,
58301+ const struct inode *inode,
58302+ const struct dentry *dentry, const struct vfsmount *mnt)
58303+{
58304+#ifdef CONFIG_GRKERNSEC_LINK
58305+ const struct cred *cred = current_cred();
58306+
58307+ if (grsec_enable_link && S_ISLNK(inode->i_mode) &&
58308+ (parent->i_mode & S_ISVTX) && (parent->i_uid != inode->i_uid) &&
58309+ (parent->i_mode & S_IWOTH) && (cred->fsuid != inode->i_uid)) {
58310+ gr_log_fs_int2(GR_DONT_AUDIT, GR_SYMLINK_MSG, dentry, mnt, inode->i_uid, inode->i_gid);
58311+ return -EACCES;
58312+ }
58313+#endif
58314+ return 0;
58315+}
58316+
58317+int
58318+gr_handle_hardlink(const struct dentry *dentry,
58319+ const struct vfsmount *mnt,
58320+ struct inode *inode, const int mode, const char *to)
58321+{
58322+#ifdef CONFIG_GRKERNSEC_LINK
58323+ const struct cred *cred = current_cred();
58324+
58325+ if (grsec_enable_link && cred->fsuid != inode->i_uid &&
58326+ (!S_ISREG(mode) || (mode & S_ISUID) ||
58327+ ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) ||
58328+ (inode_permission(inode, MAY_READ | MAY_WRITE))) &&
58329+ !capable(CAP_FOWNER) && cred->uid) {
58330+ gr_log_fs_int2_str(GR_DONT_AUDIT, GR_HARDLINK_MSG, dentry, mnt, inode->i_uid, inode->i_gid, to);
58331+ return -EPERM;
58332+ }
58333+#endif
58334+ return 0;
58335+}
58336diff -urNp linux-2.6.39/grsecurity/grsec_log.c linux-2.6.39/grsecurity/grsec_log.c
58337--- linux-2.6.39/grsecurity/grsec_log.c 1969-12-31 19:00:00.000000000 -0500
58338+++ linux-2.6.39/grsecurity/grsec_log.c 2011-05-22 19:41:42.000000000 -0400
58339@@ -0,0 +1,310 @@
58340+#include <linux/kernel.h>
58341+#include <linux/sched.h>
58342+#include <linux/file.h>
58343+#include <linux/tty.h>
58344+#include <linux/fs.h>
58345+#include <linux/grinternal.h>
58346+
58347+#ifdef CONFIG_TREE_PREEMPT_RCU
58348+#define DISABLE_PREEMPT() preempt_disable()
58349+#define ENABLE_PREEMPT() preempt_enable()
58350+#else
58351+#define DISABLE_PREEMPT()
58352+#define ENABLE_PREEMPT()
58353+#endif
58354+
58355+#define BEGIN_LOCKS(x) \
58356+ DISABLE_PREEMPT(); \
58357+ rcu_read_lock(); \
58358+ read_lock(&tasklist_lock); \
58359+ read_lock(&grsec_exec_file_lock); \
58360+ if (x != GR_DO_AUDIT) \
58361+ spin_lock(&grsec_alert_lock); \
58362+ else \
58363+ spin_lock(&grsec_audit_lock)
58364+
58365+#define END_LOCKS(x) \
58366+ if (x != GR_DO_AUDIT) \
58367+ spin_unlock(&grsec_alert_lock); \
58368+ else \
58369+ spin_unlock(&grsec_audit_lock); \
58370+ read_unlock(&grsec_exec_file_lock); \
58371+ read_unlock(&tasklist_lock); \
58372+ rcu_read_unlock(); \
58373+ ENABLE_PREEMPT(); \
58374+ if (x == GR_DONT_AUDIT) \
58375+ gr_handle_alertkill(current)
58376+
58377+enum {
58378+ FLOODING,
58379+ NO_FLOODING
58380+};
58381+
58382+extern char *gr_alert_log_fmt;
58383+extern char *gr_audit_log_fmt;
58384+extern char *gr_alert_log_buf;
58385+extern char *gr_audit_log_buf;
58386+
58387+static int gr_log_start(int audit)
58388+{
58389+ char *loglevel = (audit == GR_DO_AUDIT) ? KERN_INFO : KERN_ALERT;
58390+ char *fmt = (audit == GR_DO_AUDIT) ? gr_audit_log_fmt : gr_alert_log_fmt;
58391+ char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
58392+
58393+ if (audit == GR_DO_AUDIT)
58394+ goto set_fmt;
58395+
58396+ if (!grsec_alert_wtime || jiffies - grsec_alert_wtime > CONFIG_GRKERNSEC_FLOODTIME * HZ) {
58397+ grsec_alert_wtime = jiffies;
58398+ grsec_alert_fyet = 0;
58399+ } else if ((jiffies - grsec_alert_wtime < CONFIG_GRKERNSEC_FLOODTIME * HZ) && (grsec_alert_fyet < CONFIG_GRKERNSEC_FLOODBURST)) {
58400+ grsec_alert_fyet++;
58401+ } else if (grsec_alert_fyet == CONFIG_GRKERNSEC_FLOODBURST) {
58402+ grsec_alert_wtime = jiffies;
58403+ grsec_alert_fyet++;
58404+ printk(KERN_ALERT "grsec: more alerts, logging disabled for %d seconds\n", CONFIG_GRKERNSEC_FLOODTIME);
58405+ return FLOODING;
58406+ } else return FLOODING;
58407+
58408+set_fmt:
58409+ memset(buf, 0, PAGE_SIZE);
58410+ if (current->signal->curr_ip && gr_acl_is_enabled()) {
58411+ sprintf(fmt, "%s%s", loglevel, "grsec: From %pI4: (%.64s:%c:%.950s) ");
58412+ snprintf(buf, PAGE_SIZE - 1, fmt, &current->signal->curr_ip, current->role->rolename, gr_roletype_to_char(), current->acl->filename);
58413+ } else if (current->signal->curr_ip) {
58414+ sprintf(fmt, "%s%s", loglevel, "grsec: From %pI4: ");
58415+ snprintf(buf, PAGE_SIZE - 1, fmt, &current->signal->curr_ip);
58416+ } else if (gr_acl_is_enabled()) {
58417+ sprintf(fmt, "%s%s", loglevel, "grsec: (%.64s:%c:%.950s) ");
58418+ snprintf(buf, PAGE_SIZE - 1, fmt, current->role->rolename, gr_roletype_to_char(), current->acl->filename);
58419+ } else {
58420+ sprintf(fmt, "%s%s", loglevel, "grsec: ");
58421+ strcpy(buf, fmt);
58422+ }
58423+
58424+ return NO_FLOODING;
58425+}
58426+
58427+static void gr_log_middle(int audit, const char *msg, va_list ap)
58428+ __attribute__ ((format (printf, 2, 0)));
58429+
58430+static void gr_log_middle(int audit, const char *msg, va_list ap)
58431+{
58432+ char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
58433+ unsigned int len = strlen(buf);
58434+
58435+ vsnprintf(buf + len, PAGE_SIZE - len - 1, msg, ap);
58436+
58437+ return;
58438+}
58439+
58440+static void gr_log_middle_varargs(int audit, const char *msg, ...)
58441+ __attribute__ ((format (printf, 2, 3)));
58442+
58443+static void gr_log_middle_varargs(int audit, const char *msg, ...)
58444+{
58445+ char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
58446+ unsigned int len = strlen(buf);
58447+ va_list ap;
58448+
58449+ va_start(ap, msg);
58450+ vsnprintf(buf + len, PAGE_SIZE - len - 1, msg, ap);
58451+ va_end(ap);
58452+
58453+ return;
58454+}
58455+
58456+static void gr_log_end(int audit)
58457+{
58458+ char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
58459+ unsigned int len = strlen(buf);
58460+
58461+ snprintf(buf + len, PAGE_SIZE - len - 1, DEFAULTSECMSG, DEFAULTSECARGS(current, current_cred(), __task_cred(current->real_parent)));
58462+ printk("%s\n", buf);
58463+
58464+ return;
58465+}
58466+
58467+void gr_log_varargs(int audit, const char *msg, int argtypes, ...)
58468+{
58469+ int logtype;
58470+ char *result = (audit == GR_DO_AUDIT) ? "successful" : "denied";
58471+ char *str1 = NULL, *str2 = NULL, *str3 = NULL;
58472+ void *voidptr = NULL;
58473+ int num1 = 0, num2 = 0;
58474+ unsigned long ulong1 = 0, ulong2 = 0;
58475+ struct dentry *dentry = NULL;
58476+ struct vfsmount *mnt = NULL;
58477+ struct file *file = NULL;
58478+ struct task_struct *task = NULL;
58479+ const struct cred *cred, *pcred;
58480+ va_list ap;
58481+
58482+ BEGIN_LOCKS(audit);
58483+ logtype = gr_log_start(audit);
58484+ if (logtype == FLOODING) {
58485+ END_LOCKS(audit);
58486+ return;
58487+ }
58488+ va_start(ap, argtypes);
58489+ switch (argtypes) {
58490+ case GR_TTYSNIFF:
58491+ task = va_arg(ap, struct task_struct *);
58492+ gr_log_middle_varargs(audit, msg, &task->signal->curr_ip, gr_task_fullpath0(task), task->comm, task->pid, gr_parent_task_fullpath0(task), task->real_parent->comm, task->real_parent->pid);
58493+ break;
58494+ case GR_SYSCTL_HIDDEN:
58495+ str1 = va_arg(ap, char *);
58496+ gr_log_middle_varargs(audit, msg, result, str1);
58497+ break;
58498+ case GR_RBAC:
58499+ dentry = va_arg(ap, struct dentry *);
58500+ mnt = va_arg(ap, struct vfsmount *);
58501+ gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt));
58502+ break;
58503+ case GR_RBAC_STR:
58504+ dentry = va_arg(ap, struct dentry *);
58505+ mnt = va_arg(ap, struct vfsmount *);
58506+ str1 = va_arg(ap, char *);
58507+ gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1);
58508+ break;
58509+ case GR_STR_RBAC:
58510+ str1 = va_arg(ap, char *);
58511+ dentry = va_arg(ap, struct dentry *);
58512+ mnt = va_arg(ap, struct vfsmount *);
58513+ gr_log_middle_varargs(audit, msg, result, str1, gr_to_filename(dentry, mnt));
58514+ break;
58515+ case GR_RBAC_MODE2:
58516+ dentry = va_arg(ap, struct dentry *);
58517+ mnt = va_arg(ap, struct vfsmount *);
58518+ str1 = va_arg(ap, char *);
58519+ str2 = va_arg(ap, char *);
58520+ gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1, str2);
58521+ break;
58522+ case GR_RBAC_MODE3:
58523+ dentry = va_arg(ap, struct dentry *);
58524+ mnt = va_arg(ap, struct vfsmount *);
58525+ str1 = va_arg(ap, char *);
58526+ str2 = va_arg(ap, char *);
58527+ str3 = va_arg(ap, char *);
58528+ gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1, str2, str3);
58529+ break;
58530+ case GR_FILENAME:
58531+ dentry = va_arg(ap, struct dentry *);
58532+ mnt = va_arg(ap, struct vfsmount *);
58533+ gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt));
58534+ break;
58535+ case GR_STR_FILENAME:
58536+ str1 = va_arg(ap, char *);
58537+ dentry = va_arg(ap, struct dentry *);
58538+ mnt = va_arg(ap, struct vfsmount *);
58539+ gr_log_middle_varargs(audit, msg, str1, gr_to_filename(dentry, mnt));
58540+ break;
58541+ case GR_FILENAME_STR:
58542+ dentry = va_arg(ap, struct dentry *);
58543+ mnt = va_arg(ap, struct vfsmount *);
58544+ str1 = va_arg(ap, char *);
58545+ gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), str1);
58546+ break;
58547+ case GR_FILENAME_TWO_INT:
58548+ dentry = va_arg(ap, struct dentry *);
58549+ mnt = va_arg(ap, struct vfsmount *);
58550+ num1 = va_arg(ap, int);
58551+ num2 = va_arg(ap, int);
58552+ gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), num1, num2);
58553+ break;
58554+ case GR_FILENAME_TWO_INT_STR:
58555+ dentry = va_arg(ap, struct dentry *);
58556+ mnt = va_arg(ap, struct vfsmount *);
58557+ num1 = va_arg(ap, int);
58558+ num2 = va_arg(ap, int);
58559+ str1 = va_arg(ap, char *);
58560+ gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), num1, num2, str1);
58561+ break;
58562+ case GR_TEXTREL:
58563+ file = va_arg(ap, struct file *);
58564+ ulong1 = va_arg(ap, unsigned long);
58565+ ulong2 = va_arg(ap, unsigned long);
58566+ gr_log_middle_varargs(audit, msg, file ? gr_to_filename(file->f_path.dentry, file->f_path.mnt) : "<anonymous mapping>", ulong1, ulong2);
58567+ break;
58568+ case GR_PTRACE:
58569+ task = va_arg(ap, struct task_struct *);
58570+ gr_log_middle_varargs(audit, msg, task->exec_file ? gr_to_filename(task->exec_file->f_path.dentry, task->exec_file->f_path.mnt) : "(none)", task->comm, task->pid);
58571+ break;
58572+ case GR_RESOURCE:
58573+ task = va_arg(ap, struct task_struct *);
58574+ cred = __task_cred(task);
58575+ pcred = __task_cred(task->real_parent);
58576+ ulong1 = va_arg(ap, unsigned long);
58577+ str1 = va_arg(ap, char *);
58578+ ulong2 = va_arg(ap, unsigned long);
58579+ gr_log_middle_varargs(audit, msg, ulong1, str1, ulong2, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
58580+ break;
58581+ case GR_CAP:
58582+ task = va_arg(ap, struct task_struct *);
58583+ cred = __task_cred(task);
58584+ pcred = __task_cred(task->real_parent);
58585+ str1 = va_arg(ap, char *);
58586+ gr_log_middle_varargs(audit, msg, str1, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
58587+ break;
58588+ case GR_SIG:
58589+ str1 = va_arg(ap, char *);
58590+ voidptr = va_arg(ap, void *);
58591+ gr_log_middle_varargs(audit, msg, str1, voidptr);
58592+ break;
58593+ case GR_SIG2:
58594+ task = va_arg(ap, struct task_struct *);
58595+ cred = __task_cred(task);
58596+ pcred = __task_cred(task->real_parent);
58597+ num1 = va_arg(ap, int);
58598+ gr_log_middle_varargs(audit, msg, num1, gr_task_fullpath0(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath0(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
58599+ break;
58600+ case GR_CRASH1:
58601+ task = va_arg(ap, struct task_struct *);
58602+ cred = __task_cred(task);
58603+ pcred = __task_cred(task->real_parent);
58604+ ulong1 = va_arg(ap, unsigned long);
58605+ gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid, cred->uid, ulong1);
58606+ break;
58607+ case GR_CRASH2:
58608+ task = va_arg(ap, struct task_struct *);
58609+ cred = __task_cred(task);
58610+ pcred = __task_cred(task->real_parent);
58611+ ulong1 = va_arg(ap, unsigned long);
58612+ gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid, ulong1);
58613+ break;
58614+ case GR_RWXMAP:
58615+ file = va_arg(ap, struct file *);
58616+ gr_log_middle_varargs(audit, msg, file ? gr_to_filename(file->f_path.dentry, file->f_path.mnt) : "<anonymous mapping>");
58617+ break;
58618+ case GR_PSACCT:
58619+ {
58620+ unsigned int wday, cday;
58621+ __u8 whr, chr;
58622+ __u8 wmin, cmin;
58623+ __u8 wsec, csec;
58624+ char cur_tty[64] = { 0 };
58625+ char parent_tty[64] = { 0 };
58626+
58627+ task = va_arg(ap, struct task_struct *);
58628+ wday = va_arg(ap, unsigned int);
58629+ cday = va_arg(ap, unsigned int);
58630+ whr = va_arg(ap, int);
58631+ chr = va_arg(ap, int);
58632+ wmin = va_arg(ap, int);
58633+ cmin = va_arg(ap, int);
58634+ wsec = va_arg(ap, int);
58635+ csec = va_arg(ap, int);
58636+ ulong1 = va_arg(ap, unsigned long);
58637+ cred = __task_cred(task);
58638+ pcred = __task_cred(task->real_parent);
58639+
58640+ gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, &task->signal->curr_ip, tty_name(task->signal->tty, cur_tty), cred->uid, cred->euid, cred->gid, cred->egid, wday, whr, wmin, wsec, cday, chr, cmin, csec, (task->flags & PF_SIGNALED) ? "killed by signal" : "exited", ulong1, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, &task->real_parent->signal->curr_ip, tty_name(task->real_parent->signal->tty, parent_tty), pcred->uid, pcred->euid, pcred->gid, pcred->egid);
58641+ }
58642+ break;
58643+ default:
58644+ gr_log_middle(audit, msg, ap);
58645+ }
58646+ va_end(ap);
58647+ gr_log_end(audit);
58648+ END_LOCKS(audit);
58649+}
58650diff -urNp linux-2.6.39/grsecurity/grsec_mem.c linux-2.6.39/grsecurity/grsec_mem.c
58651--- linux-2.6.39/grsecurity/grsec_mem.c 1969-12-31 19:00:00.000000000 -0500
58652+++ linux-2.6.39/grsecurity/grsec_mem.c 2011-05-22 19:41:42.000000000 -0400
58653@@ -0,0 +1,33 @@
58654+#include <linux/kernel.h>
58655+#include <linux/sched.h>
58656+#include <linux/mm.h>
58657+#include <linux/mman.h>
58658+#include <linux/grinternal.h>
58659+
58660+void
58661+gr_handle_ioperm(void)
58662+{
58663+ gr_log_noargs(GR_DONT_AUDIT, GR_IOPERM_MSG);
58664+ return;
58665+}
58666+
58667+void
58668+gr_handle_iopl(void)
58669+{
58670+ gr_log_noargs(GR_DONT_AUDIT, GR_IOPL_MSG);
58671+ return;
58672+}
58673+
58674+void
58675+gr_handle_mem_readwrite(u64 from, u64 to)
58676+{
58677+ gr_log_two_u64(GR_DONT_AUDIT, GR_MEM_READWRITE_MSG, from, to);
58678+ return;
58679+}
58680+
58681+void
58682+gr_handle_vm86(void)
58683+{
58684+ gr_log_noargs(GR_DONT_AUDIT, GR_VM86_MSG);
58685+ return;
58686+}
58687diff -urNp linux-2.6.39/grsecurity/grsec_mount.c linux-2.6.39/grsecurity/grsec_mount.c
58688--- linux-2.6.39/grsecurity/grsec_mount.c 1969-12-31 19:00:00.000000000 -0500
58689+++ linux-2.6.39/grsecurity/grsec_mount.c 2011-05-22 19:41:42.000000000 -0400
58690@@ -0,0 +1,62 @@
58691+#include <linux/kernel.h>
58692+#include <linux/sched.h>
58693+#include <linux/mount.h>
58694+#include <linux/grsecurity.h>
58695+#include <linux/grinternal.h>
58696+
58697+void
58698+gr_log_remount(const char *devname, const int retval)
58699+{
58700+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
58701+ if (grsec_enable_mount && (retval >= 0))
58702+ gr_log_str(GR_DO_AUDIT, GR_REMOUNT_AUDIT_MSG, devname ? devname : "none");
58703+#endif
58704+ return;
58705+}
58706+
58707+void
58708+gr_log_unmount(const char *devname, const int retval)
58709+{
58710+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
58711+ if (grsec_enable_mount && (retval >= 0))
58712+ gr_log_str(GR_DO_AUDIT, GR_UNMOUNT_AUDIT_MSG, devname ? devname : "none");
58713+#endif
58714+ return;
58715+}
58716+
58717+void
58718+gr_log_mount(const char *from, const char *to, const int retval)
58719+{
58720+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
58721+ if (grsec_enable_mount && (retval >= 0))
58722+ gr_log_str_str(GR_DO_AUDIT, GR_MOUNT_AUDIT_MSG, from, to);
58723+#endif
58724+ return;
58725+}
58726+
58727+int
58728+gr_handle_rofs_mount(struct dentry *dentry, struct vfsmount *mnt, int mnt_flags)
58729+{
58730+#ifdef CONFIG_GRKERNSEC_ROFS
58731+ if (grsec_enable_rofs && !(mnt_flags & MNT_READONLY)) {
58732+ gr_log_fs_generic(GR_DO_AUDIT, GR_ROFS_MOUNT_MSG, dentry, mnt);
58733+ return -EPERM;
58734+ } else
58735+ return 0;
58736+#endif
58737+ return 0;
58738+}
58739+
58740+int
58741+gr_handle_rofs_blockwrite(struct dentry *dentry, struct vfsmount *mnt, int acc_mode)
58742+{
58743+#ifdef CONFIG_GRKERNSEC_ROFS
58744+ if (grsec_enable_rofs && (acc_mode & MAY_WRITE) &&
58745+ dentry->d_inode && S_ISBLK(dentry->d_inode->i_mode)) {
58746+ gr_log_fs_generic(GR_DO_AUDIT, GR_ROFS_BLOCKWRITE_MSG, dentry, mnt);
58747+ return -EPERM;
58748+ } else
58749+ return 0;
58750+#endif
58751+ return 0;
58752+}
58753diff -urNp linux-2.6.39/grsecurity/grsec_pax.c linux-2.6.39/grsecurity/grsec_pax.c
58754--- linux-2.6.39/grsecurity/grsec_pax.c 1969-12-31 19:00:00.000000000 -0500
58755+++ linux-2.6.39/grsecurity/grsec_pax.c 2011-05-22 19:41:42.000000000 -0400
58756@@ -0,0 +1,36 @@
58757+#include <linux/kernel.h>
58758+#include <linux/sched.h>
58759+#include <linux/mm.h>
58760+#include <linux/file.h>
58761+#include <linux/grinternal.h>
58762+#include <linux/grsecurity.h>
58763+
58764+void
58765+gr_log_textrel(struct vm_area_struct * vma)
58766+{
58767+#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
58768+ if (grsec_enable_audit_textrel)
58769+ gr_log_textrel_ulong_ulong(GR_DO_AUDIT, GR_TEXTREL_AUDIT_MSG, vma->vm_file, vma->vm_start, vma->vm_pgoff);
58770+#endif
58771+ return;
58772+}
58773+
58774+void
58775+gr_log_rwxmmap(struct file *file)
58776+{
58777+#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
58778+ if (grsec_enable_log_rwxmaps)
58779+ gr_log_rwxmap(GR_DONT_AUDIT, GR_RWXMMAP_MSG, file);
58780+#endif
58781+ return;
58782+}
58783+
58784+void
58785+gr_log_rwxmprotect(struct file *file)
58786+{
58787+#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
58788+ if (grsec_enable_log_rwxmaps)
58789+ gr_log_rwxmap(GR_DONT_AUDIT, GR_RWXMPROTECT_MSG, file);
58790+#endif
58791+ return;
58792+}
58793diff -urNp linux-2.6.39/grsecurity/grsec_ptrace.c linux-2.6.39/grsecurity/grsec_ptrace.c
58794--- linux-2.6.39/grsecurity/grsec_ptrace.c 1969-12-31 19:00:00.000000000 -0500
58795+++ linux-2.6.39/grsecurity/grsec_ptrace.c 2011-05-22 19:41:42.000000000 -0400
58796@@ -0,0 +1,14 @@
58797+#include <linux/kernel.h>
58798+#include <linux/sched.h>
58799+#include <linux/grinternal.h>
58800+#include <linux/grsecurity.h>
58801+
58802+void
58803+gr_audit_ptrace(struct task_struct *task)
58804+{
58805+#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
58806+ if (grsec_enable_audit_ptrace)
58807+ gr_log_ptrace(GR_DO_AUDIT, GR_PTRACE_AUDIT_MSG, task);
58808+#endif
58809+ return;
58810+}
58811diff -urNp linux-2.6.39/grsecurity/grsec_sig.c linux-2.6.39/grsecurity/grsec_sig.c
58812--- linux-2.6.39/grsecurity/grsec_sig.c 1969-12-31 19:00:00.000000000 -0500
58813+++ linux-2.6.39/grsecurity/grsec_sig.c 2011-05-22 19:41:42.000000000 -0400
58814@@ -0,0 +1,203 @@
58815+#include <linux/kernel.h>
58816+#include <linux/sched.h>
58817+#include <linux/delay.h>
58818+#include <linux/grsecurity.h>
58819+#include <linux/grinternal.h>
58820+#include <linux/hardirq.h>
58821+
58822+char *signames[] = {
58823+ [SIGSEGV] = "Segmentation fault",
58824+ [SIGILL] = "Illegal instruction",
58825+ [SIGABRT] = "Abort",
58826+ [SIGBUS] = "Invalid alignment/Bus error"
58827+};
58828+
58829+void
58830+gr_log_signal(const int sig, const void *addr, const struct task_struct *t)
58831+{
58832+#ifdef CONFIG_GRKERNSEC_SIGNAL
58833+ if (grsec_enable_signal && ((sig == SIGSEGV) || (sig == SIGILL) ||
58834+ (sig == SIGABRT) || (sig == SIGBUS))) {
58835+ if (t->pid == current->pid) {
58836+ gr_log_sig_addr(GR_DONT_AUDIT_GOOD, GR_UNISIGLOG_MSG, signames[sig], addr);
58837+ } else {
58838+ gr_log_sig_task(GR_DONT_AUDIT_GOOD, GR_DUALSIGLOG_MSG, t, sig);
58839+ }
58840+ }
58841+#endif
58842+ return;
58843+}
58844+
58845+int
58846+gr_handle_signal(const struct task_struct *p, const int sig)
58847+{
58848+#ifdef CONFIG_GRKERNSEC
58849+ if (current->pid > 1 && gr_check_protected_task(p)) {
58850+ gr_log_sig_task(GR_DONT_AUDIT, GR_SIG_ACL_MSG, p, sig);
58851+ return -EPERM;
58852+ } else if (gr_pid_is_chrooted((struct task_struct *)p)) {
58853+ return -EPERM;
58854+ }
58855+#endif
58856+ return 0;
58857+}
58858+
58859+#ifdef CONFIG_GRKERNSEC
58860+extern int specific_send_sig_info(int sig, struct siginfo *info, struct task_struct *t);
58861+
58862+int gr_fake_force_sig(int sig, struct task_struct *t)
58863+{
58864+ unsigned long int flags;
58865+ int ret, blocked, ignored;
58866+ struct k_sigaction *action;
58867+
58868+ spin_lock_irqsave(&t->sighand->siglock, flags);
58869+ action = &t->sighand->action[sig-1];
58870+ ignored = action->sa.sa_handler == SIG_IGN;
58871+ blocked = sigismember(&t->blocked, sig);
58872+ if (blocked || ignored) {
58873+ action->sa.sa_handler = SIG_DFL;
58874+ if (blocked) {
58875+ sigdelset(&t->blocked, sig);
58876+ recalc_sigpending_and_wake(t);
58877+ }
58878+ }
58879+ if (action->sa.sa_handler == SIG_DFL)
58880+ t->signal->flags &= ~SIGNAL_UNKILLABLE;
58881+ ret = specific_send_sig_info(sig, SEND_SIG_PRIV, t);
58882+
58883+ spin_unlock_irqrestore(&t->sighand->siglock, flags);
58884+
58885+ return ret;
58886+}
58887+#endif
58888+
58889+#ifdef CONFIG_GRKERNSEC_BRUTE
58890+#define GR_USER_BAN_TIME (15 * 60)
58891+
58892+static int __get_dumpable(unsigned long mm_flags)
58893+{
58894+ int ret;
58895+
58896+ ret = mm_flags & MMF_DUMPABLE_MASK;
58897+ return (ret >= 2) ? 2 : ret;
58898+}
58899+#endif
58900+
58901+void gr_handle_brute_attach(struct task_struct *p, unsigned long mm_flags)
58902+{
58903+#ifdef CONFIG_GRKERNSEC_BRUTE
58904+ uid_t uid = 0;
58905+
58906+ rcu_read_lock();
58907+ read_lock(&tasklist_lock);
58908+ read_lock(&grsec_exec_file_lock);
58909+ if (p->real_parent && p->real_parent->exec_file == p->exec_file)
58910+ p->real_parent->brute = 1;
58911+ else {
58912+ const struct cred *cred = __task_cred(p), *cred2;
58913+ struct task_struct *tsk, *tsk2;
58914+
58915+ if (!__get_dumpable(mm_flags) && cred->uid) {
58916+ struct user_struct *user;
58917+
58918+ uid = cred->uid;
58919+
58920+ /* this is put upon execution past expiration */
58921+ user = find_user(uid);
58922+ if (user == NULL)
58923+ goto unlock;
58924+ user->banned = 1;
58925+ user->ban_expires = get_seconds() + GR_USER_BAN_TIME;
58926+ if (user->ban_expires == ~0UL)
58927+ user->ban_expires--;
58928+
58929+ do_each_thread(tsk2, tsk) {
58930+ cred2 = __task_cred(tsk);
58931+ if (tsk != p && cred2->uid == uid)
58932+ gr_fake_force_sig(SIGKILL, tsk);
58933+ } while_each_thread(tsk2, tsk);
58934+ }
58935+ }
58936+unlock:
58937+ read_unlock(&grsec_exec_file_lock);
58938+ read_unlock(&tasklist_lock);
58939+ rcu_read_unlock();
58940+
58941+ if (uid)
58942+ printk(KERN_ALERT "grsec: bruteforce prevention initiated against uid %u, banning for %d minutes\n", uid, GR_USER_BAN_TIME / 60);
58943+
58944+#endif
58945+ return;
58946+}
58947+
58948+void gr_handle_brute_check(void)
58949+{
58950+#ifdef CONFIG_GRKERNSEC_BRUTE
58951+ if (current->brute)
58952+ msleep(30 * 1000);
58953+#endif
58954+ return;
58955+}
58956+
58957+void gr_handle_kernel_exploit(void)
58958+{
58959+#ifdef CONFIG_GRKERNSEC_KERN_LOCKOUT
58960+ const struct cred *cred;
58961+ struct task_struct *tsk, *tsk2;
58962+ struct user_struct *user;
58963+ uid_t uid;
58964+
58965+ if (in_irq() || in_serving_softirq() || in_nmi())
58966+ panic("grsec: halting the system due to suspicious kernel crash caused in interrupt context");
58967+
58968+ uid = current_uid();
58969+
58970+ if (uid == 0)
58971+ panic("grsec: halting the system due to suspicious kernel crash caused by root");
58972+ else {
58973+ /* kill all the processes of this user, hold a reference
58974+ to their creds struct, and prevent them from creating
58975+ another process until system reset
58976+ */
58977+ printk(KERN_ALERT "grsec: banning user with uid %u until system restart for suspicious kernel crash\n", uid);
58978+ /* we intentionally leak this ref */
58979+ user = get_uid(current->cred->user);
58980+ if (user) {
58981+ user->banned = 1;
58982+ user->ban_expires = ~0UL;
58983+ }
58984+
58985+ read_lock(&tasklist_lock);
58986+ do_each_thread(tsk2, tsk) {
58987+ cred = __task_cred(tsk);
58988+ if (cred->uid == uid)
58989+ gr_fake_force_sig(SIGKILL, tsk);
58990+ } while_each_thread(tsk2, tsk);
58991+ read_unlock(&tasklist_lock);
58992+ }
58993+#endif
58994+}
58995+
58996+int __gr_process_user_ban(struct user_struct *user)
58997+{
58998+#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
58999+ if (unlikely(user->banned)) {
59000+ if (user->ban_expires != ~0UL && time_after_eq(get_seconds(), user->ban_expires)) {
59001+ user->banned = 0;
59002+ user->ban_expires = 0;
59003+ free_uid(user);
59004+ } else
59005+ return -EPERM;
59006+ }
59007+#endif
59008+ return 0;
59009+}
59010+
59011+int gr_process_user_ban(void)
59012+{
59013+#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
59014+ return __gr_process_user_ban(current->cred->user);
59015+#endif
59016+ return 0;
59017+}
59018diff -urNp linux-2.6.39/grsecurity/grsec_sock.c linux-2.6.39/grsecurity/grsec_sock.c
59019--- linux-2.6.39/grsecurity/grsec_sock.c 1969-12-31 19:00:00.000000000 -0500
59020+++ linux-2.6.39/grsecurity/grsec_sock.c 2011-05-22 20:29:21.000000000 -0400
59021@@ -0,0 +1,244 @@
59022+#include <linux/kernel.h>
59023+#include <linux/module.h>
59024+#include <linux/sched.h>
59025+#include <linux/file.h>
59026+#include <linux/net.h>
59027+#include <linux/in.h>
59028+#include <linux/ip.h>
59029+#include <net/sock.h>
59030+#include <net/inet_sock.h>
59031+#include <linux/grsecurity.h>
59032+#include <linux/grinternal.h>
59033+#include <linux/gracl.h>
59034+
59035+extern int gr_search_udp_recvmsg(const struct sock *sk, const struct sk_buff *skb);
59036+extern int gr_search_udp_sendmsg(const struct sock *sk, const struct sockaddr_in *addr);
59037+
59038+EXPORT_SYMBOL(gr_search_udp_recvmsg);
59039+EXPORT_SYMBOL(gr_search_udp_sendmsg);
59040+
59041+#ifdef CONFIG_UNIX_MODULE
59042+EXPORT_SYMBOL(gr_acl_handle_unix);
59043+EXPORT_SYMBOL(gr_acl_handle_mknod);
59044+EXPORT_SYMBOL(gr_handle_chroot_unix);
59045+EXPORT_SYMBOL(gr_handle_create);
59046+#endif
59047+
59048+#ifdef CONFIG_GRKERNSEC
59049+#define gr_conn_table_size 32749
59050+struct conn_table_entry {
59051+ struct conn_table_entry *next;
59052+ struct signal_struct *sig;
59053+};
59054+
59055+struct conn_table_entry *gr_conn_table[gr_conn_table_size];
59056+DEFINE_SPINLOCK(gr_conn_table_lock);
59057+
59058+extern const char * gr_socktype_to_name(unsigned char type);
59059+extern const char * gr_proto_to_name(unsigned char proto);
59060+extern const char * gr_sockfamily_to_name(unsigned char family);
59061+
59062+static __inline__ int
59063+conn_hash(__u32 saddr, __u32 daddr, __u16 sport, __u16 dport, unsigned int size)
59064+{
59065+ return ((daddr + saddr + (sport << 8) + (dport << 16)) % size);
59066+}
59067+
59068+static __inline__ int
59069+conn_match(const struct signal_struct *sig, __u32 saddr, __u32 daddr,
59070+ __u16 sport, __u16 dport)
59071+{
59072+ if (unlikely(sig->gr_saddr == saddr && sig->gr_daddr == daddr &&
59073+ sig->gr_sport == sport && sig->gr_dport == dport))
59074+ return 1;
59075+ else
59076+ return 0;
59077+}
59078+
59079+static void gr_add_to_task_ip_table_nolock(struct signal_struct *sig, struct conn_table_entry *newent)
59080+{
59081+ struct conn_table_entry **match;
59082+ unsigned int index;
59083+
59084+ index = conn_hash(sig->gr_saddr, sig->gr_daddr,
59085+ sig->gr_sport, sig->gr_dport,
59086+ gr_conn_table_size);
59087+
59088+ newent->sig = sig;
59089+
59090+ match = &gr_conn_table[index];
59091+ newent->next = *match;
59092+ *match = newent;
59093+
59094+ return;
59095+}
59096+
59097+static void gr_del_task_from_ip_table_nolock(struct signal_struct *sig)
59098+{
59099+ struct conn_table_entry *match, *last = NULL;
59100+ unsigned int index;
59101+
59102+ index = conn_hash(sig->gr_saddr, sig->gr_daddr,
59103+ sig->gr_sport, sig->gr_dport,
59104+ gr_conn_table_size);
59105+
59106+ match = gr_conn_table[index];
59107+ while (match && !conn_match(match->sig,
59108+ sig->gr_saddr, sig->gr_daddr, sig->gr_sport,
59109+ sig->gr_dport)) {
59110+ last = match;
59111+ match = match->next;
59112+ }
59113+
59114+ if (match) {
59115+ if (last)
59116+ last->next = match->next;
59117+ else
59118+ gr_conn_table[index] = NULL;
59119+ kfree(match);
59120+ }
59121+
59122+ return;
59123+}
59124+
59125+static struct signal_struct * gr_lookup_task_ip_table(__u32 saddr, __u32 daddr,
59126+ __u16 sport, __u16 dport)
59127+{
59128+ struct conn_table_entry *match;
59129+ unsigned int index;
59130+
59131+ index = conn_hash(saddr, daddr, sport, dport, gr_conn_table_size);
59132+
59133+ match = gr_conn_table[index];
59134+ while (match && !conn_match(match->sig, saddr, daddr, sport, dport))
59135+ match = match->next;
59136+
59137+ if (match)
59138+ return match->sig;
59139+ else
59140+ return NULL;
59141+}
59142+
59143+#endif
59144+
59145+void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet)
59146+{
59147+#ifdef CONFIG_GRKERNSEC
59148+ struct signal_struct *sig = task->signal;
59149+ struct conn_table_entry *newent;
59150+
59151+ newent = kmalloc(sizeof(struct conn_table_entry), GFP_ATOMIC);
59152+ if (newent == NULL)
59153+ return;
59154+ /* no bh lock needed since we are called with bh disabled */
59155+ spin_lock(&gr_conn_table_lock);
59156+ gr_del_task_from_ip_table_nolock(sig);
59157+ sig->gr_saddr = inet->inet_rcv_saddr;
59158+ sig->gr_daddr = inet->inet_daddr;
59159+ sig->gr_sport = inet->inet_sport;
59160+ sig->gr_dport = inet->inet_dport;
59161+ gr_add_to_task_ip_table_nolock(sig, newent);
59162+ spin_unlock(&gr_conn_table_lock);
59163+#endif
59164+ return;
59165+}
59166+
59167+void gr_del_task_from_ip_table(struct task_struct *task)
59168+{
59169+#ifdef CONFIG_GRKERNSEC
59170+ spin_lock_bh(&gr_conn_table_lock);
59171+ gr_del_task_from_ip_table_nolock(task->signal);
59172+ spin_unlock_bh(&gr_conn_table_lock);
59173+#endif
59174+ return;
59175+}
59176+
59177+void
59178+gr_attach_curr_ip(const struct sock *sk)
59179+{
59180+#ifdef CONFIG_GRKERNSEC
59181+ struct signal_struct *p, *set;
59182+ const struct inet_sock *inet = inet_sk(sk);
59183+
59184+ if (unlikely(sk->sk_protocol != IPPROTO_TCP))
59185+ return;
59186+
59187+ set = current->signal;
59188+
59189+ spin_lock_bh(&gr_conn_table_lock);
59190+ p = gr_lookup_task_ip_table(inet->inet_daddr, inet->inet_rcv_saddr,
59191+ inet->inet_dport, inet->inet_sport);
59192+ if (unlikely(p != NULL)) {
59193+ set->curr_ip = p->curr_ip;
59194+ set->used_accept = 1;
59195+ gr_del_task_from_ip_table_nolock(p);
59196+ spin_unlock_bh(&gr_conn_table_lock);
59197+ return;
59198+ }
59199+ spin_unlock_bh(&gr_conn_table_lock);
59200+
59201+ set->curr_ip = inet->inet_daddr;
59202+ set->used_accept = 1;
59203+#endif
59204+ return;
59205+}
59206+
59207+int
59208+gr_handle_sock_all(const int family, const int type, const int protocol)
59209+{
59210+#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
59211+ if (grsec_enable_socket_all && in_group_p(grsec_socket_all_gid) &&
59212+ (family != AF_UNIX)) {
59213+ if (family == AF_INET)
59214+ gr_log_str3(GR_DONT_AUDIT, GR_SOCK_MSG, gr_sockfamily_to_name(family), gr_socktype_to_name(type), gr_proto_to_name(protocol));
59215+ else
59216+ gr_log_str2_int(GR_DONT_AUDIT, GR_SOCK_NOINET_MSG, gr_sockfamily_to_name(family), gr_socktype_to_name(type), protocol);
59217+ return -EACCES;
59218+ }
59219+#endif
59220+ return 0;
59221+}
59222+
59223+int
59224+gr_handle_sock_server(const struct sockaddr *sck)
59225+{
59226+#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
59227+ if (grsec_enable_socket_server &&
59228+ in_group_p(grsec_socket_server_gid) &&
59229+ sck && (sck->sa_family != AF_UNIX) &&
59230+ (sck->sa_family != AF_LOCAL)) {
59231+ gr_log_noargs(GR_DONT_AUDIT, GR_BIND_MSG);
59232+ return -EACCES;
59233+ }
59234+#endif
59235+ return 0;
59236+}
59237+
59238+int
59239+gr_handle_sock_server_other(const struct sock *sck)
59240+{
59241+#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
59242+ if (grsec_enable_socket_server &&
59243+ in_group_p(grsec_socket_server_gid) &&
59244+ sck && (sck->sk_family != AF_UNIX) &&
59245+ (sck->sk_family != AF_LOCAL)) {
59246+ gr_log_noargs(GR_DONT_AUDIT, GR_BIND_MSG);
59247+ return -EACCES;
59248+ }
59249+#endif
59250+ return 0;
59251+}
59252+
59253+int
59254+gr_handle_sock_client(const struct sockaddr *sck)
59255+{
59256+#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
59257+ if (grsec_enable_socket_client && in_group_p(grsec_socket_client_gid) &&
59258+ sck && (sck->sa_family != AF_UNIX) &&
59259+ (sck->sa_family != AF_LOCAL)) {
59260+ gr_log_noargs(GR_DONT_AUDIT, GR_CONNECT_MSG);
59261+ return -EACCES;
59262+ }
59263+#endif
59264+ return 0;
59265+}
59266diff -urNp linux-2.6.39/grsecurity/grsec_sysctl.c linux-2.6.39/grsecurity/grsec_sysctl.c
59267--- linux-2.6.39/grsecurity/grsec_sysctl.c 1969-12-31 19:00:00.000000000 -0500
59268+++ linux-2.6.39/grsecurity/grsec_sysctl.c 2011-05-22 19:41:42.000000000 -0400
59269@@ -0,0 +1,433 @@
59270+#include <linux/kernel.h>
59271+#include <linux/sched.h>
59272+#include <linux/sysctl.h>
59273+#include <linux/grsecurity.h>
59274+#include <linux/grinternal.h>
59275+
59276+int
59277+gr_handle_sysctl_mod(const char *dirname, const char *name, const int op)
59278+{
59279+#ifdef CONFIG_GRKERNSEC_SYSCTL
59280+ if (!strcmp(dirname, "grsecurity") && grsec_lock && (op & MAY_WRITE)) {
59281+ gr_log_str(GR_DONT_AUDIT, GR_SYSCTL_MSG, name);
59282+ return -EACCES;
59283+ }
59284+#endif
59285+ return 0;
59286+}
59287+
59288+#ifdef CONFIG_GRKERNSEC_ROFS
59289+static int __maybe_unused one = 1;
59290+#endif
59291+
59292+#if defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_ROFS)
59293+struct ctl_table grsecurity_table[] = {
59294+#ifdef CONFIG_GRKERNSEC_SYSCTL
59295+#ifdef CONFIG_GRKERNSEC_SYSCTL_DISTRO
59296+#ifdef CONFIG_GRKERNSEC_IO
59297+ {
59298+ .procname = "disable_priv_io",
59299+ .data = &grsec_disable_privio,
59300+ .maxlen = sizeof(int),
59301+ .mode = 0600,
59302+ .proc_handler = &proc_dointvec,
59303+ },
59304+#endif
59305+#endif
59306+#ifdef CONFIG_GRKERNSEC_LINK
59307+ {
59308+ .procname = "linking_restrictions",
59309+ .data = &grsec_enable_link,
59310+ .maxlen = sizeof(int),
59311+ .mode = 0600,
59312+ .proc_handler = &proc_dointvec,
59313+ },
59314+#endif
59315+#ifdef CONFIG_GRKERNSEC_FIFO
59316+ {
59317+ .procname = "fifo_restrictions",
59318+ .data = &grsec_enable_fifo,
59319+ .maxlen = sizeof(int),
59320+ .mode = 0600,
59321+ .proc_handler = &proc_dointvec,
59322+ },
59323+#endif
59324+#ifdef CONFIG_GRKERNSEC_EXECVE
59325+ {
59326+ .procname = "execve_limiting",
59327+ .data = &grsec_enable_execve,
59328+ .maxlen = sizeof(int),
59329+ .mode = 0600,
59330+ .proc_handler = &proc_dointvec,
59331+ },
59332+#endif
59333+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
59334+ {
59335+ .procname = "ip_blackhole",
59336+ .data = &grsec_enable_blackhole,
59337+ .maxlen = sizeof(int),
59338+ .mode = 0600,
59339+ .proc_handler = &proc_dointvec,
59340+ },
59341+ {
59342+ .procname = "lastack_retries",
59343+ .data = &grsec_lastack_retries,
59344+ .maxlen = sizeof(int),
59345+ .mode = 0600,
59346+ .proc_handler = &proc_dointvec,
59347+ },
59348+#endif
59349+#ifdef CONFIG_GRKERNSEC_EXECLOG
59350+ {
59351+ .procname = "exec_logging",
59352+ .data = &grsec_enable_execlog,
59353+ .maxlen = sizeof(int),
59354+ .mode = 0600,
59355+ .proc_handler = &proc_dointvec,
59356+ },
59357+#endif
59358+#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
59359+ {
59360+ .procname = "rwxmap_logging",
59361+ .data = &grsec_enable_log_rwxmaps,
59362+ .maxlen = sizeof(int),
59363+ .mode = 0600,
59364+ .proc_handler = &proc_dointvec,
59365+ },
59366+#endif
59367+#ifdef CONFIG_GRKERNSEC_SIGNAL
59368+ {
59369+ .procname = "signal_logging",
59370+ .data = &grsec_enable_signal,
59371+ .maxlen = sizeof(int),
59372+ .mode = 0600,
59373+ .proc_handler = &proc_dointvec,
59374+ },
59375+#endif
59376+#ifdef CONFIG_GRKERNSEC_FORKFAIL
59377+ {
59378+ .procname = "forkfail_logging",
59379+ .data = &grsec_enable_forkfail,
59380+ .maxlen = sizeof(int),
59381+ .mode = 0600,
59382+ .proc_handler = &proc_dointvec,
59383+ },
59384+#endif
59385+#ifdef CONFIG_GRKERNSEC_TIME
59386+ {
59387+ .procname = "timechange_logging",
59388+ .data = &grsec_enable_time,
59389+ .maxlen = sizeof(int),
59390+ .mode = 0600,
59391+ .proc_handler = &proc_dointvec,
59392+ },
59393+#endif
59394+#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
59395+ {
59396+ .procname = "chroot_deny_shmat",
59397+ .data = &grsec_enable_chroot_shmat,
59398+ .maxlen = sizeof(int),
59399+ .mode = 0600,
59400+ .proc_handler = &proc_dointvec,
59401+ },
59402+#endif
59403+#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
59404+ {
59405+ .procname = "chroot_deny_unix",
59406+ .data = &grsec_enable_chroot_unix,
59407+ .maxlen = sizeof(int),
59408+ .mode = 0600,
59409+ .proc_handler = &proc_dointvec,
59410+ },
59411+#endif
59412+#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
59413+ {
59414+ .procname = "chroot_deny_mount",
59415+ .data = &grsec_enable_chroot_mount,
59416+ .maxlen = sizeof(int),
59417+ .mode = 0600,
59418+ .proc_handler = &proc_dointvec,
59419+ },
59420+#endif
59421+#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
59422+ {
59423+ .procname = "chroot_deny_fchdir",
59424+ .data = &grsec_enable_chroot_fchdir,
59425+ .maxlen = sizeof(int),
59426+ .mode = 0600,
59427+ .proc_handler = &proc_dointvec,
59428+ },
59429+#endif
59430+#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
59431+ {
59432+ .procname = "chroot_deny_chroot",
59433+ .data = &grsec_enable_chroot_double,
59434+ .maxlen = sizeof(int),
59435+ .mode = 0600,
59436+ .proc_handler = &proc_dointvec,
59437+ },
59438+#endif
59439+#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
59440+ {
59441+ .procname = "chroot_deny_pivot",
59442+ .data = &grsec_enable_chroot_pivot,
59443+ .maxlen = sizeof(int),
59444+ .mode = 0600,
59445+ .proc_handler = &proc_dointvec,
59446+ },
59447+#endif
59448+#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
59449+ {
59450+ .procname = "chroot_enforce_chdir",
59451+ .data = &grsec_enable_chroot_chdir,
59452+ .maxlen = sizeof(int),
59453+ .mode = 0600,
59454+ .proc_handler = &proc_dointvec,
59455+ },
59456+#endif
59457+#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
59458+ {
59459+ .procname = "chroot_deny_chmod",
59460+ .data = &grsec_enable_chroot_chmod,
59461+ .maxlen = sizeof(int),
59462+ .mode = 0600,
59463+ .proc_handler = &proc_dointvec,
59464+ },
59465+#endif
59466+#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
59467+ {
59468+ .procname = "chroot_deny_mknod",
59469+ .data = &grsec_enable_chroot_mknod,
59470+ .maxlen = sizeof(int),
59471+ .mode = 0600,
59472+ .proc_handler = &proc_dointvec,
59473+ },
59474+#endif
59475+#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
59476+ {
59477+ .procname = "chroot_restrict_nice",
59478+ .data = &grsec_enable_chroot_nice,
59479+ .maxlen = sizeof(int),
59480+ .mode = 0600,
59481+ .proc_handler = &proc_dointvec,
59482+ },
59483+#endif
59484+#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
59485+ {
59486+ .procname = "chroot_execlog",
59487+ .data = &grsec_enable_chroot_execlog,
59488+ .maxlen = sizeof(int),
59489+ .mode = 0600,
59490+ .proc_handler = &proc_dointvec,
59491+ },
59492+#endif
59493+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
59494+ {
59495+ .procname = "chroot_caps",
59496+ .data = &grsec_enable_chroot_caps,
59497+ .maxlen = sizeof(int),
59498+ .mode = 0600,
59499+ .proc_handler = &proc_dointvec,
59500+ },
59501+#endif
59502+#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
59503+ {
59504+ .procname = "chroot_deny_sysctl",
59505+ .data = &grsec_enable_chroot_sysctl,
59506+ .maxlen = sizeof(int),
59507+ .mode = 0600,
59508+ .proc_handler = &proc_dointvec,
59509+ },
59510+#endif
59511+#ifdef CONFIG_GRKERNSEC_TPE
59512+ {
59513+ .procname = "tpe",
59514+ .data = &grsec_enable_tpe,
59515+ .maxlen = sizeof(int),
59516+ .mode = 0600,
59517+ .proc_handler = &proc_dointvec,
59518+ },
59519+ {
59520+ .procname = "tpe_gid",
59521+ .data = &grsec_tpe_gid,
59522+ .maxlen = sizeof(int),
59523+ .mode = 0600,
59524+ .proc_handler = &proc_dointvec,
59525+ },
59526+#endif
59527+#ifdef CONFIG_GRKERNSEC_TPE_INVERT
59528+ {
59529+ .procname = "tpe_invert",
59530+ .data = &grsec_enable_tpe_invert,
59531+ .maxlen = sizeof(int),
59532+ .mode = 0600,
59533+ .proc_handler = &proc_dointvec,
59534+ },
59535+#endif
59536+#ifdef CONFIG_GRKERNSEC_TPE_ALL
59537+ {
59538+ .procname = "tpe_restrict_all",
59539+ .data = &grsec_enable_tpe_all,
59540+ .maxlen = sizeof(int),
59541+ .mode = 0600,
59542+ .proc_handler = &proc_dointvec,
59543+ },
59544+#endif
59545+#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
59546+ {
59547+ .procname = "socket_all",
59548+ .data = &grsec_enable_socket_all,
59549+ .maxlen = sizeof(int),
59550+ .mode = 0600,
59551+ .proc_handler = &proc_dointvec,
59552+ },
59553+ {
59554+ .procname = "socket_all_gid",
59555+ .data = &grsec_socket_all_gid,
59556+ .maxlen = sizeof(int),
59557+ .mode = 0600,
59558+ .proc_handler = &proc_dointvec,
59559+ },
59560+#endif
59561+#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
59562+ {
59563+ .procname = "socket_client",
59564+ .data = &grsec_enable_socket_client,
59565+ .maxlen = sizeof(int),
59566+ .mode = 0600,
59567+ .proc_handler = &proc_dointvec,
59568+ },
59569+ {
59570+ .procname = "socket_client_gid",
59571+ .data = &grsec_socket_client_gid,
59572+ .maxlen = sizeof(int),
59573+ .mode = 0600,
59574+ .proc_handler = &proc_dointvec,
59575+ },
59576+#endif
59577+#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
59578+ {
59579+ .procname = "socket_server",
59580+ .data = &grsec_enable_socket_server,
59581+ .maxlen = sizeof(int),
59582+ .mode = 0600,
59583+ .proc_handler = &proc_dointvec,
59584+ },
59585+ {
59586+ .procname = "socket_server_gid",
59587+ .data = &grsec_socket_server_gid,
59588+ .maxlen = sizeof(int),
59589+ .mode = 0600,
59590+ .proc_handler = &proc_dointvec,
59591+ },
59592+#endif
59593+#ifdef CONFIG_GRKERNSEC_AUDIT_GROUP
59594+ {
59595+ .procname = "audit_group",
59596+ .data = &grsec_enable_group,
59597+ .maxlen = sizeof(int),
59598+ .mode = 0600,
59599+ .proc_handler = &proc_dointvec,
59600+ },
59601+ {
59602+ .procname = "audit_gid",
59603+ .data = &grsec_audit_gid,
59604+ .maxlen = sizeof(int),
59605+ .mode = 0600,
59606+ .proc_handler = &proc_dointvec,
59607+ },
59608+#endif
59609+#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
59610+ {
59611+ .procname = "audit_chdir",
59612+ .data = &grsec_enable_chdir,
59613+ .maxlen = sizeof(int),
59614+ .mode = 0600,
59615+ .proc_handler = &proc_dointvec,
59616+ },
59617+#endif
59618+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
59619+ {
59620+ .procname = "audit_mount",
59621+ .data = &grsec_enable_mount,
59622+ .maxlen = sizeof(int),
59623+ .mode = 0600,
59624+ .proc_handler = &proc_dointvec,
59625+ },
59626+#endif
59627+#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
59628+ {
59629+ .procname = "audit_textrel",
59630+ .data = &grsec_enable_audit_textrel,
59631+ .maxlen = sizeof(int),
59632+ .mode = 0600,
59633+ .proc_handler = &proc_dointvec,
59634+ },
59635+#endif
59636+#ifdef CONFIG_GRKERNSEC_DMESG
59637+ {
59638+ .procname = "dmesg",
59639+ .data = &grsec_enable_dmesg,
59640+ .maxlen = sizeof(int),
59641+ .mode = 0600,
59642+ .proc_handler = &proc_dointvec,
59643+ },
59644+#endif
59645+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
59646+ {
59647+ .procname = "chroot_findtask",
59648+ .data = &grsec_enable_chroot_findtask,
59649+ .maxlen = sizeof(int),
59650+ .mode = 0600,
59651+ .proc_handler = &proc_dointvec,
59652+ },
59653+#endif
59654+#ifdef CONFIG_GRKERNSEC_RESLOG
59655+ {
59656+ .procname = "resource_logging",
59657+ .data = &grsec_resource_logging,
59658+ .maxlen = sizeof(int),
59659+ .mode = 0600,
59660+ .proc_handler = &proc_dointvec,
59661+ },
59662+#endif
59663+#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
59664+ {
59665+ .procname = "audit_ptrace",
59666+ .data = &grsec_enable_audit_ptrace,
59667+ .maxlen = sizeof(int),
59668+ .mode = 0600,
59669+ .proc_handler = &proc_dointvec,
59670+ },
59671+#endif
59672+#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
59673+ {
59674+ .procname = "harden_ptrace",
59675+ .data = &grsec_enable_harden_ptrace,
59676+ .maxlen = sizeof(int),
59677+ .mode = 0600,
59678+ .proc_handler = &proc_dointvec,
59679+ },
59680+#endif
59681+ {
59682+ .procname = "grsec_lock",
59683+ .data = &grsec_lock,
59684+ .maxlen = sizeof(int),
59685+ .mode = 0600,
59686+ .proc_handler = &proc_dointvec,
59687+ },
59688+#endif
59689+#ifdef CONFIG_GRKERNSEC_ROFS
59690+ {
59691+ .procname = "romount_protect",
59692+ .data = &grsec_enable_rofs,
59693+ .maxlen = sizeof(int),
59694+ .mode = 0600,
59695+ .proc_handler = &proc_dointvec_minmax,
59696+ .extra1 = &one,
59697+ .extra2 = &one,
59698+ },
59699+#endif
59700+ { }
59701+};
59702+#endif
59703diff -urNp linux-2.6.39/grsecurity/grsec_time.c linux-2.6.39/grsecurity/grsec_time.c
59704--- linux-2.6.39/grsecurity/grsec_time.c 1969-12-31 19:00:00.000000000 -0500
59705+++ linux-2.6.39/grsecurity/grsec_time.c 2011-05-22 19:41:42.000000000 -0400
59706@@ -0,0 +1,16 @@
59707+#include <linux/kernel.h>
59708+#include <linux/sched.h>
59709+#include <linux/grinternal.h>
59710+#include <linux/module.h>
59711+
59712+void
59713+gr_log_timechange(void)
59714+{
59715+#ifdef CONFIG_GRKERNSEC_TIME
59716+ if (grsec_enable_time)
59717+ gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_TIME_MSG);
59718+#endif
59719+ return;
59720+}
59721+
59722+EXPORT_SYMBOL(gr_log_timechange);
59723diff -urNp linux-2.6.39/grsecurity/grsec_tpe.c linux-2.6.39/grsecurity/grsec_tpe.c
59724--- linux-2.6.39/grsecurity/grsec_tpe.c 1969-12-31 19:00:00.000000000 -0500
59725+++ linux-2.6.39/grsecurity/grsec_tpe.c 2011-05-22 19:41:42.000000000 -0400
59726@@ -0,0 +1,39 @@
59727+#include <linux/kernel.h>
59728+#include <linux/sched.h>
59729+#include <linux/file.h>
59730+#include <linux/fs.h>
59731+#include <linux/grinternal.h>
59732+
59733+extern int gr_acl_tpe_check(void);
59734+
59735+int
59736+gr_tpe_allow(const struct file *file)
59737+{
59738+#ifdef CONFIG_GRKERNSEC
59739+ struct inode *inode = file->f_path.dentry->d_parent->d_inode;
59740+ const struct cred *cred = current_cred();
59741+
59742+ if (cred->uid && ((grsec_enable_tpe &&
59743+#ifdef CONFIG_GRKERNSEC_TPE_INVERT
59744+ ((grsec_enable_tpe_invert && !in_group_p(grsec_tpe_gid)) ||
59745+ (!grsec_enable_tpe_invert && in_group_p(grsec_tpe_gid)))
59746+#else
59747+ in_group_p(grsec_tpe_gid)
59748+#endif
59749+ ) || gr_acl_tpe_check()) &&
59750+ (inode->i_uid || (!inode->i_uid && ((inode->i_mode & S_IWGRP) ||
59751+ (inode->i_mode & S_IWOTH))))) {
59752+ gr_log_fs_generic(GR_DONT_AUDIT, GR_EXEC_TPE_MSG, file->f_path.dentry, file->f_path.mnt);
59753+ return 0;
59754+ }
59755+#ifdef CONFIG_GRKERNSEC_TPE_ALL
59756+ if (cred->uid && grsec_enable_tpe && grsec_enable_tpe_all &&
59757+ ((inode->i_uid && (inode->i_uid != cred->uid)) ||
59758+ (inode->i_mode & S_IWGRP) || (inode->i_mode & S_IWOTH))) {
59759+ gr_log_fs_generic(GR_DONT_AUDIT, GR_EXEC_TPE_MSG, file->f_path.dentry, file->f_path.mnt);
59760+ return 0;
59761+ }
59762+#endif
59763+#endif
59764+ return 1;
59765+}
59766diff -urNp linux-2.6.39/grsecurity/grsum.c linux-2.6.39/grsecurity/grsum.c
59767--- linux-2.6.39/grsecurity/grsum.c 1969-12-31 19:00:00.000000000 -0500
59768+++ linux-2.6.39/grsecurity/grsum.c 2011-05-22 19:41:42.000000000 -0400
59769@@ -0,0 +1,61 @@
59770+#include <linux/err.h>
59771+#include <linux/kernel.h>
59772+#include <linux/sched.h>
59773+#include <linux/mm.h>
59774+#include <linux/scatterlist.h>
59775+#include <linux/crypto.h>
59776+#include <linux/gracl.h>
59777+
59778+
59779+#if !defined(CONFIG_CRYPTO) || defined(CONFIG_CRYPTO_MODULE) || !defined(CONFIG_CRYPTO_SHA256) || defined(CONFIG_CRYPTO_SHA256_MODULE)
59780+#error "crypto and sha256 must be built into the kernel"
59781+#endif
59782+
59783+int
59784+chkpw(struct gr_arg *entry, unsigned char *salt, unsigned char *sum)
59785+{
59786+ char *p;
59787+ struct crypto_hash *tfm;
59788+ struct hash_desc desc;
59789+ struct scatterlist sg;
59790+ unsigned char temp_sum[GR_SHA_LEN];
59791+ volatile int retval = 0;
59792+ volatile int dummy = 0;
59793+ unsigned int i;
59794+
59795+ sg_init_table(&sg, 1);
59796+
59797+ tfm = crypto_alloc_hash("sha256", 0, CRYPTO_ALG_ASYNC);
59798+ if (IS_ERR(tfm)) {
59799+ /* should never happen, since sha256 should be built in */
59800+ return 1;
59801+ }
59802+
59803+ desc.tfm = tfm;
59804+ desc.flags = 0;
59805+
59806+ crypto_hash_init(&desc);
59807+
59808+ p = salt;
59809+ sg_set_buf(&sg, p, GR_SALT_LEN);
59810+ crypto_hash_update(&desc, &sg, sg.length);
59811+
59812+ p = entry->pw;
59813+ sg_set_buf(&sg, p, strlen(p));
59814+
59815+ crypto_hash_update(&desc, &sg, sg.length);
59816+
59817+ crypto_hash_final(&desc, temp_sum);
59818+
59819+ memset(entry->pw, 0, GR_PW_LEN);
59820+
59821+ for (i = 0; i < GR_SHA_LEN; i++)
59822+ if (sum[i] != temp_sum[i])
59823+ retval = 1;
59824+ else
59825+ dummy = 1; // waste a cycle
59826+
59827+ crypto_free_hash(tfm);
59828+
59829+ return retval;
59830+}
59831diff -urNp linux-2.6.39/grsecurity/Kconfig linux-2.6.39/grsecurity/Kconfig
59832--- linux-2.6.39/grsecurity/Kconfig 1969-12-31 19:00:00.000000000 -0500
59833+++ linux-2.6.39/grsecurity/Kconfig 2011-05-22 19:41:42.000000000 -0400
59834@@ -0,0 +1,1045 @@
59835+#
59836+# grecurity configuration
59837+#
59838+
59839+menu "Grsecurity"
59840+
59841+config GRKERNSEC
59842+ bool "Grsecurity"
59843+ select CRYPTO
59844+ select CRYPTO_SHA256
59845+ help
59846+ If you say Y here, you will be able to configure many features
59847+ that will enhance the security of your system. It is highly
59848+ recommended that you say Y here and read through the help
59849+ for each option so that you fully understand the features and
59850+ can evaluate their usefulness for your machine.
59851+
59852+choice
59853+ prompt "Security Level"
59854+ depends on GRKERNSEC
59855+ default GRKERNSEC_CUSTOM
59856+
59857+config GRKERNSEC_LOW
59858+ bool "Low"
59859+ select GRKERNSEC_LINK
59860+ select GRKERNSEC_FIFO
59861+ select GRKERNSEC_EXECVE
59862+ select GRKERNSEC_RANDNET
59863+ select GRKERNSEC_DMESG
59864+ select GRKERNSEC_CHROOT
59865+ select GRKERNSEC_CHROOT_CHDIR
59866+
59867+ help
59868+ If you choose this option, several of the grsecurity options will
59869+ be enabled that will give you greater protection against a number
59870+ of attacks, while assuring that none of your software will have any
59871+ conflicts with the additional security measures. If you run a lot
59872+ of unusual software, or you are having problems with the higher
59873+ security levels, you should say Y here. With this option, the
59874+ following features are enabled:
59875+
59876+ - Linking restrictions
59877+ - FIFO restrictions
59878+ - Enforcing RLIMIT_NPROC on execve
59879+ - Restricted dmesg
59880+ - Enforced chdir("/") on chroot
59881+ - Runtime module disabling
59882+
59883+config GRKERNSEC_MEDIUM
59884+ bool "Medium"
59885+ select PAX
59886+ select PAX_EI_PAX
59887+ select PAX_PT_PAX_FLAGS
59888+ select PAX_HAVE_ACL_FLAGS
59889+ select GRKERNSEC_PROC_MEMMAP if (PAX_NOEXEC || PAX_ASLR)
59890+ select GRKERNSEC_CHROOT
59891+ select GRKERNSEC_CHROOT_SYSCTL
59892+ select GRKERNSEC_LINK
59893+ select GRKERNSEC_FIFO
59894+ select GRKERNSEC_EXECVE
59895+ select GRKERNSEC_DMESG
59896+ select GRKERNSEC_RANDNET
59897+ select GRKERNSEC_FORKFAIL
59898+ select GRKERNSEC_TIME
59899+ select GRKERNSEC_SIGNAL
59900+ select GRKERNSEC_CHROOT
59901+ select GRKERNSEC_CHROOT_UNIX
59902+ select GRKERNSEC_CHROOT_MOUNT
59903+ select GRKERNSEC_CHROOT_PIVOT
59904+ select GRKERNSEC_CHROOT_DOUBLE
59905+ select GRKERNSEC_CHROOT_CHDIR
59906+ select GRKERNSEC_CHROOT_MKNOD
59907+ select GRKERNSEC_PROC
59908+ select GRKERNSEC_PROC_USERGROUP
59909+ select PAX_RANDUSTACK
59910+ select PAX_ASLR
59911+ select PAX_RANDMMAP
59912+ select PAX_REFCOUNT if (X86 || SPARC64)
59913+ select PAX_USERCOPY if ((X86 || SPARC32 || SPARC64 || PPC) && (SLAB || SLUB || SLOB))
59914+
59915+ help
59916+ If you say Y here, several features in addition to those included
59917+ in the low additional security level will be enabled. These
59918+ features provide even more security to your system, though in rare
59919+ cases they may be incompatible with very old or poorly written
59920+ software. If you enable this option, make sure that your auth
59921+ service (identd) is running as gid 1001. With this option,
59922+ the following features (in addition to those provided in the
59923+ low additional security level) will be enabled:
59924+
59925+ - Failed fork logging
59926+ - Time change logging
59927+ - Signal logging
59928+ - Deny mounts in chroot
59929+ - Deny double chrooting
59930+ - Deny sysctl writes in chroot
59931+ - Deny mknod in chroot
59932+ - Deny access to abstract AF_UNIX sockets out of chroot
59933+ - Deny pivot_root in chroot
59934+ - Denied writes of /dev/kmem, /dev/mem, and /dev/port
59935+ - /proc restrictions with special GID set to 10 (usually wheel)
59936+ - Address Space Layout Randomization (ASLR)
59937+ - Prevent exploitation of most refcount overflows
59938+ - Bounds checking of copying between the kernel and userland
59939+
59940+config GRKERNSEC_HIGH
59941+ bool "High"
59942+ select GRKERNSEC_LINK
59943+ select GRKERNSEC_FIFO
59944+ select GRKERNSEC_EXECVE
59945+ select GRKERNSEC_DMESG
59946+ select GRKERNSEC_FORKFAIL
59947+ select GRKERNSEC_TIME
59948+ select GRKERNSEC_SIGNAL
59949+ select GRKERNSEC_CHROOT
59950+ select GRKERNSEC_CHROOT_SHMAT
59951+ select GRKERNSEC_CHROOT_UNIX
59952+ select GRKERNSEC_CHROOT_MOUNT
59953+ select GRKERNSEC_CHROOT_FCHDIR
59954+ select GRKERNSEC_CHROOT_PIVOT
59955+ select GRKERNSEC_CHROOT_DOUBLE
59956+ select GRKERNSEC_CHROOT_CHDIR
59957+ select GRKERNSEC_CHROOT_MKNOD
59958+ select GRKERNSEC_CHROOT_CAPS
59959+ select GRKERNSEC_CHROOT_SYSCTL
59960+ select GRKERNSEC_CHROOT_FINDTASK
59961+ select GRKERNSEC_SYSFS_RESTRICT
59962+ select GRKERNSEC_PROC
59963+ select GRKERNSEC_PROC_MEMMAP if (PAX_NOEXEC || PAX_ASLR)
59964+ select GRKERNSEC_HIDESYM
59965+ select GRKERNSEC_BRUTE
59966+ select GRKERNSEC_PROC_USERGROUP
59967+ select GRKERNSEC_KMEM
59968+ select GRKERNSEC_RESLOG
59969+ select GRKERNSEC_RANDNET
59970+ select GRKERNSEC_PROC_ADD
59971+ select GRKERNSEC_CHROOT_CHMOD
59972+ select GRKERNSEC_CHROOT_NICE
59973+ select GRKERNSEC_AUDIT_MOUNT
59974+ select GRKERNSEC_MODHARDEN if (MODULES)
59975+ select GRKERNSEC_HARDEN_PTRACE
59976+ select GRKERNSEC_VM86 if (X86_32)
59977+ select GRKERNSEC_KERN_LOCKOUT if (X86)
59978+ select PAX
59979+ select PAX_RANDUSTACK
59980+ select PAX_ASLR
59981+ select PAX_RANDMMAP
59982+ select PAX_NOEXEC
59983+ select PAX_MPROTECT
59984+ select PAX_EI_PAX
59985+ select PAX_PT_PAX_FLAGS
59986+ select PAX_HAVE_ACL_FLAGS
59987+ select PAX_KERNEXEC if ((PPC || X86) && (!X86_32 || X86_WP_WORKS_OK) && !XEN)
59988+ select PAX_MEMORY_UDEREF if (X86 && !XEN)
59989+ select PAX_RANDKSTACK if (X86_TSC && X86)
59990+ select PAX_SEGMEXEC if (X86_32)
59991+ select PAX_PAGEEXEC
59992+ select PAX_EMUPLT if (ALPHA || PARISC || SPARC32 || SPARC64)
59993+ select PAX_EMUTRAMP if (PARISC)
59994+ select PAX_EMUSIGRT if (PARISC)
59995+ select PAX_ETEXECRELOCS if (ALPHA || IA64 || PARISC)
59996+ select PAX_ELFRELOCS if (PAX_ETEXECRELOCS || (IA64 || PPC || X86))
59997+ select PAX_REFCOUNT if (X86 || SPARC64)
59998+ select PAX_USERCOPY if ((X86 || PPC || SPARC32 || SPARC64) && (SLAB || SLUB || SLOB))
59999+ help
60000+ If you say Y here, many of the features of grsecurity will be
60001+ enabled, which will protect you against many kinds of attacks
60002+ against your system. The heightened security comes at a cost
60003+ of an increased chance of incompatibilities with rare software
60004+ on your machine. Since this security level enables PaX, you should
60005+ view <http://pax.grsecurity.net> and read about the PaX
60006+ project. While you are there, download chpax and run it on
60007+ binaries that cause problems with PaX. Also remember that
60008+ since the /proc restrictions are enabled, you must run your
60009+ identd as gid 1001. This security level enables the following
60010+ features in addition to those listed in the low and medium
60011+ security levels:
60012+
60013+ - Additional /proc restrictions
60014+ - Chmod restrictions in chroot
60015+ - No signals, ptrace, or viewing of processes outside of chroot
60016+ - Capability restrictions in chroot
60017+ - Deny fchdir out of chroot
60018+ - Priority restrictions in chroot
60019+ - Segmentation-based implementation of PaX
60020+ - Mprotect restrictions
60021+ - Removal of addresses from /proc/<pid>/[smaps|maps|stat]
60022+ - Kernel stack randomization
60023+ - Mount/unmount/remount logging
60024+ - Kernel symbol hiding
60025+ - Prevention of memory exhaustion-based exploits
60026+ - Hardening of module auto-loading
60027+ - Ptrace restrictions
60028+ - Restricted vm86 mode
60029+ - Restricted sysfs/debugfs
60030+ - Active kernel exploit response
60031+
60032+config GRKERNSEC_CUSTOM
60033+ bool "Custom"
60034+ help
60035+ If you say Y here, you will be able to configure every grsecurity
60036+ option, which allows you to enable many more features that aren't
60037+ covered in the basic security levels. These additional features
60038+ include TPE, socket restrictions, and the sysctl system for
60039+ grsecurity. It is advised that you read through the help for
60040+ each option to determine its usefulness in your situation.
60041+
60042+endchoice
60043+
60044+menu "Address Space Protection"
60045+depends on GRKERNSEC
60046+
60047+config GRKERNSEC_KMEM
60048+ bool "Deny writing to /dev/kmem, /dev/mem, and /dev/port"
60049+ select STRICT_DEVMEM if (X86 || ARM || TILE || S390)
60050+ help
60051+ If you say Y here, /dev/kmem and /dev/mem won't be allowed to
60052+ be written to via mmap or otherwise to modify the running kernel.
60053+ /dev/port will also not be allowed to be opened. If you have module
60054+ support disabled, enabling this will close up four ways that are
60055+ currently used to insert malicious code into the running kernel.
60056+ Even with all these features enabled, we still highly recommend that
60057+ you use the RBAC system, as it is still possible for an attacker to
60058+ modify the running kernel through privileged I/O granted by ioperm/iopl.
60059+ If you are not using XFree86, you may be able to stop this additional
60060+ case by enabling the 'Disable privileged I/O' option. Though nothing
60061+ legitimately writes to /dev/kmem, XFree86 does need to write to /dev/mem,
60062+ but only to video memory, which is the only writing we allow in this
60063+ case. If /dev/kmem or /dev/mem are mmaped without PROT_WRITE, they will
60064+ not be allowed to mprotect it with PROT_WRITE later.
60065+ It is highly recommended that you say Y here if you meet all the
60066+ conditions above.
60067+
60068+config GRKERNSEC_VM86
60069+ bool "Restrict VM86 mode"
60070+ depends on X86_32
60071+
60072+ help
60073+ If you say Y here, only processes with CAP_SYS_RAWIO will be able to
60074+ make use of a special execution mode on 32bit x86 processors called
60075+ Virtual 8086 (VM86) mode. XFree86 may need vm86 mode for certain
60076+ video cards and will still work with this option enabled. The purpose
60077+ of the option is to prevent exploitation of emulation errors in
60078+ virtualization of vm86 mode like the one discovered in VMWare in 2009.
60079+ Nearly all users should be able to enable this option.
60080+
60081+config GRKERNSEC_IO
60082+ bool "Disable privileged I/O"
60083+ depends on X86
60084+ select RTC_CLASS
60085+ select RTC_INTF_DEV
60086+ select RTC_DRV_CMOS
60087+
60088+ help
60089+ If you say Y here, all ioperm and iopl calls will return an error.
60090+ Ioperm and iopl can be used to modify the running kernel.
60091+ Unfortunately, some programs need this access to operate properly,
60092+ the most notable of which are XFree86 and hwclock. hwclock can be
60093+ remedied by having RTC support in the kernel, so real-time
60094+ clock support is enabled if this option is enabled, to ensure
60095+ that hwclock operates correctly. XFree86 still will not
60096+ operate correctly with this option enabled, so DO NOT CHOOSE Y
60097+ IF YOU USE XFree86. If you use XFree86 and you still want to
60098+ protect your kernel against modification, use the RBAC system.
60099+
60100+config GRKERNSEC_PROC_MEMMAP
60101+ bool "Remove addresses from /proc/<pid>/[smaps|maps|stat]"
60102+ default y if (PAX_NOEXEC || PAX_ASLR)
60103+ depends on PAX_NOEXEC || PAX_ASLR
60104+ help
60105+ If you say Y here, the /proc/<pid>/maps and /proc/<pid>/stat files will
60106+ give no information about the addresses of its mappings if
60107+ PaX features that rely on random addresses are enabled on the task.
60108+ If you use PaX it is greatly recommended that you say Y here as it
60109+ closes up a hole that makes the full ASLR useless for suid
60110+ binaries.
60111+
60112+config GRKERNSEC_BRUTE
60113+ bool "Deter exploit bruteforcing"
60114+ help
60115+ If you say Y here, attempts to bruteforce exploits against forking
60116+ daemons such as apache or sshd, as well as against suid/sgid binaries
60117+ will be deterred. When a child of a forking daemon is killed by PaX
60118+ or crashes due to an illegal instruction or other suspicious signal,
60119+ the parent process will be delayed 30 seconds upon every subsequent
60120+ fork until the administrator is able to assess the situation and
60121+ restart the daemon.
60122+ In the suid/sgid case, the attempt is logged, the user has all their
60123+ processes terminated, and they are prevented from executing any further
60124+ processes for 15 minutes.
60125+ It is recommended that you also enable signal logging in the auditing
60126+ section so that logs are generated when a process triggers a suspicious
60127+ signal.
60128+
60129+config GRKERNSEC_MODHARDEN
60130+ bool "Harden module auto-loading"
60131+ depends on MODULES
60132+ help
60133+ If you say Y here, module auto-loading in response to use of some
60134+ feature implemented by an unloaded module will be restricted to
60135+ root users. Enabling this option helps defend against attacks
60136+ by unprivileged users who abuse the auto-loading behavior to
60137+ cause a vulnerable module to load that is then exploited.
60138+
60139+ If this option prevents a legitimate use of auto-loading for a
60140+ non-root user, the administrator can execute modprobe manually
60141+ with the exact name of the module mentioned in the alert log.
60142+ Alternatively, the administrator can add the module to the list
60143+ of modules loaded at boot by modifying init scripts.
60144+
60145+ Modification of init scripts will most likely be needed on
60146+ Ubuntu servers with encrypted home directory support enabled,
60147+ as the first non-root user logging in will cause the ecb(aes),
60148+ ecb(aes)-all, cbc(aes), and cbc(aes)-all modules to be loaded.
60149+
60150+config GRKERNSEC_HIDESYM
60151+ bool "Hide kernel symbols"
60152+ help
60153+ If you say Y here, getting information on loaded modules, and
60154+ displaying all kernel symbols through a syscall will be restricted
60155+ to users with CAP_SYS_MODULE. For software compatibility reasons,
60156+ /proc/kallsyms will be restricted to the root user. The RBAC
60157+ system can hide that entry even from root.
60158+
60159+ This option also prevents leaking of kernel addresses through
60160+ several /proc entries.
60161+
60162+ Note that this option is only effective provided the following
60163+ conditions are met:
60164+ 1) The kernel using grsecurity is not precompiled by some distribution
60165+ 2) You have also enabled GRKERNSEC_DMESG
60166+ 3) You are using the RBAC system and hiding other files such as your
60167+ kernel image and System.map. Alternatively, enabling this option
60168+ causes the permissions on /boot, /lib/modules, and the kernel
60169+ source directory to change at compile time to prevent
60170+ reading by non-root users.
60171+ If the above conditions are met, this option will aid in providing a
60172+ useful protection against local kernel exploitation of overflows
60173+ and arbitrary read/write vulnerabilities.
60174+
60175+config GRKERNSEC_KERN_LOCKOUT
60176+ bool "Active kernel exploit response"
60177+ depends on X86
60178+ help
60179+ If you say Y here, when a PaX alert is triggered due to suspicious
60180+ activity in the kernel (from KERNEXEC/UDEREF/USERCOPY)
60181+ or an OOPs occurs due to bad memory accesses, instead of just
60182+ terminating the offending process (and potentially allowing
60183+ a subsequent exploit from the same user), we will take one of two
60184+ actions:
60185+ If the user was root, we will panic the system
60186+ If the user was non-root, we will log the attempt, terminate
60187+ all processes owned by the user, then prevent them from creating
60188+ any new processes until the system is restarted
60189+ This deters repeated kernel exploitation/bruteforcing attempts
60190+ and is useful for later forensics.
60191+
60192+endmenu
60193+menu "Role Based Access Control Options"
60194+depends on GRKERNSEC
60195+
60196+config GRKERNSEC_RBAC_DEBUG
60197+ bool
60198+
60199+config GRKERNSEC_NO_RBAC
60200+ bool "Disable RBAC system"
60201+ help
60202+ If you say Y here, the /dev/grsec device will be removed from the kernel,
60203+ preventing the RBAC system from being enabled. You should only say Y
60204+ here if you have no intention of using the RBAC system, so as to prevent
60205+ an attacker with root access from misusing the RBAC system to hide files
60206+ and processes when loadable module support and /dev/[k]mem have been
60207+ locked down.
60208+
60209+config GRKERNSEC_ACL_HIDEKERN
60210+ bool "Hide kernel processes"
60211+ help
60212+ If you say Y here, all kernel threads will be hidden to all
60213+ processes but those whose subject has the "view hidden processes"
60214+ flag.
60215+
60216+config GRKERNSEC_ACL_MAXTRIES
60217+ int "Maximum tries before password lockout"
60218+ default 3
60219+ help
60220+ This option enforces the maximum number of times a user can attempt
60221+ to authorize themselves with the grsecurity RBAC system before being
60222+ denied the ability to attempt authorization again for a specified time.
60223+ The lower the number, the harder it will be to brute-force a password.
60224+
60225+config GRKERNSEC_ACL_TIMEOUT
60226+ int "Time to wait after max password tries, in seconds"
60227+ default 30
60228+ help
60229+ This option specifies the time the user must wait after attempting to
60230+ authorize to the RBAC system with the maximum number of invalid
60231+ passwords. The higher the number, the harder it will be to brute-force
60232+ a password.
60233+
60234+endmenu
60235+menu "Filesystem Protections"
60236+depends on GRKERNSEC
60237+
60238+config GRKERNSEC_PROC
60239+ bool "Proc restrictions"
60240+ help
60241+ If you say Y here, the permissions of the /proc filesystem
60242+ will be altered to enhance system security and privacy. You MUST
60243+ choose either a user only restriction or a user and group restriction.
60244+ Depending upon the option you choose, you can either restrict users to
60245+ see only the processes they themselves run, or choose a group that can
60246+ view all processes and files normally restricted to root if you choose
60247+ the "restrict to user only" option. NOTE: If you're running identd as
60248+ a non-root user, you will have to run it as the group you specify here.
60249+
60250+config GRKERNSEC_PROC_USER
60251+ bool "Restrict /proc to user only"
60252+ depends on GRKERNSEC_PROC
60253+ help
60254+ If you say Y here, non-root users will only be able to view their own
60255+ processes, and restricts them from viewing network-related information,
60256+ and viewing kernel symbol and module information.
60257+
60258+config GRKERNSEC_PROC_USERGROUP
60259+ bool "Allow special group"
60260+ depends on GRKERNSEC_PROC && !GRKERNSEC_PROC_USER
60261+ help
60262+ If you say Y here, you will be able to select a group that will be
60263+ able to view all processes and network-related information. If you've
60264+ enabled GRKERNSEC_HIDESYM, kernel and symbol information may still
60265+ remain hidden. This option is useful if you want to run identd as
60266+ a non-root user.
60267+
60268+config GRKERNSEC_PROC_GID
60269+ int "GID for special group"
60270+ depends on GRKERNSEC_PROC_USERGROUP
60271+ default 1001
60272+
60273+config GRKERNSEC_PROC_ADD
60274+ bool "Additional restrictions"
60275+ depends on GRKERNSEC_PROC_USER || GRKERNSEC_PROC_USERGROUP
60276+ help
60277+ If you say Y here, additional restrictions will be placed on
60278+ /proc that keep normal users from viewing device information and
60279+ slabinfo information that could be useful for exploits.
60280+
60281+config GRKERNSEC_LINK
60282+ bool "Linking restrictions"
60283+ help
60284+ If you say Y here, /tmp race exploits will be prevented, since users
60285+ will no longer be able to follow symlinks owned by other users in
60286+ world-writable +t directories (e.g. /tmp), unless the owner of the
60287+ symlink is the owner of the directory. users will also not be
60288+ able to hardlink to files they do not own. If the sysctl option is
60289+ enabled, a sysctl option with name "linking_restrictions" is created.
60290+
60291+config GRKERNSEC_FIFO
60292+ bool "FIFO restrictions"
60293+ help
60294+ If you say Y here, users will not be able to write to FIFOs they don't
60295+ own in world-writable +t directories (e.g. /tmp), unless the owner of
60296+ the FIFO is the same owner of the directory it's held in. If the sysctl
60297+ option is enabled, a sysctl option with name "fifo_restrictions" is
60298+ created.
60299+
60300+config GRKERNSEC_SYSFS_RESTRICT
60301+ bool "Sysfs/debugfs restriction"
60302+ depends on SYSFS
60303+ help
60304+ If you say Y here, sysfs (the pseudo-filesystem mounted at /sys) and
60305+ any filesystem normally mounted under it (e.g. debugfs) will only
60306+ be accessible by root. These filesystems generally provide access
60307+ to hardware and debug information that isn't appropriate for unprivileged
60308+ users of the system. Sysfs and debugfs have also become a large source
60309+ of new vulnerabilities, ranging from infoleaks to local compromise.
60310+ There has been very little oversight with an eye toward security involved
60311+ in adding new exporters of information to these filesystems, so their
60312+ use is discouraged.
60313+ This option is equivalent to a chmod 0700 of the mount paths.
60314+
60315+config GRKERNSEC_ROFS
60316+ bool "Runtime read-only mount protection"
60317+ help
60318+ If you say Y here, a sysctl option with name "romount_protect" will
60319+ be created. By setting this option to 1 at runtime, filesystems
60320+ will be protected in the following ways:
60321+ * No new writable mounts will be allowed
60322+ * Existing read-only mounts won't be able to be remounted read/write
60323+ * Write operations will be denied on all block devices
60324+ This option acts independently of grsec_lock: once it is set to 1,
60325+ it cannot be turned off. Therefore, please be mindful of the resulting
60326+ behavior if this option is enabled in an init script on a read-only
60327+ filesystem. This feature is mainly intended for secure embedded systems.
60328+
60329+config GRKERNSEC_CHROOT
60330+ bool "Chroot jail restrictions"
60331+ help
60332+ If you say Y here, you will be able to choose several options that will
60333+ make breaking out of a chrooted jail much more difficult. If you
60334+ encounter no software incompatibilities with the following options, it
60335+ is recommended that you enable each one.
60336+
60337+config GRKERNSEC_CHROOT_MOUNT
60338+ bool "Deny mounts"
60339+ depends on GRKERNSEC_CHROOT
60340+ help
60341+ If you say Y here, processes inside a chroot will not be able to
60342+ mount or remount filesystems. If the sysctl option is enabled, a
60343+ sysctl option with name "chroot_deny_mount" is created.
60344+
60345+config GRKERNSEC_CHROOT_DOUBLE
60346+ bool "Deny double-chroots"
60347+ depends on GRKERNSEC_CHROOT
60348+ help
60349+ If you say Y here, processes inside a chroot will not be able to chroot
60350+ again outside the chroot. This is a widely used method of breaking
60351+ out of a chroot jail and should not be allowed. If the sysctl
60352+ option is enabled, a sysctl option with name
60353+ "chroot_deny_chroot" is created.
60354+
60355+config GRKERNSEC_CHROOT_PIVOT
60356+ bool "Deny pivot_root in chroot"
60357+ depends on GRKERNSEC_CHROOT
60358+ help
60359+ If you say Y here, processes inside a chroot will not be able to use
60360+ a function called pivot_root() that was introduced in Linux 2.3.41. It
60361+ works similar to chroot in that it changes the root filesystem. This
60362+ function could be misused in a chrooted process to attempt to break out
60363+ of the chroot, and therefore should not be allowed. If the sysctl
60364+ option is enabled, a sysctl option with name "chroot_deny_pivot" is
60365+ created.
60366+
60367+config GRKERNSEC_CHROOT_CHDIR
60368+ bool "Enforce chdir(\"/\") on all chroots"
60369+ depends on GRKERNSEC_CHROOT
60370+ help
60371+ If you say Y here, the current working directory of all newly-chrooted
60372+ applications will be set to the the root directory of the chroot.
60373+ The man page on chroot(2) states:
60374+ Note that this call does not change the current working
60375+ directory, so that `.' can be outside the tree rooted at
60376+ `/'. In particular, the super-user can escape from a
60377+ `chroot jail' by doing `mkdir foo; chroot foo; cd ..'.
60378+
60379+ It is recommended that you say Y here, since it's not known to break
60380+ any software. If the sysctl option is enabled, a sysctl option with
60381+ name "chroot_enforce_chdir" is created.
60382+
60383+config GRKERNSEC_CHROOT_CHMOD
60384+ bool "Deny (f)chmod +s"
60385+ depends on GRKERNSEC_CHROOT
60386+ help
60387+ If you say Y here, processes inside a chroot will not be able to chmod
60388+ or fchmod files to make them have suid or sgid bits. This protects
60389+ against another published method of breaking a chroot. If the sysctl
60390+ option is enabled, a sysctl option with name "chroot_deny_chmod" is
60391+ created.
60392+
60393+config GRKERNSEC_CHROOT_FCHDIR
60394+ bool "Deny fchdir out of chroot"
60395+ depends on GRKERNSEC_CHROOT
60396+ help
60397+ If you say Y here, a well-known method of breaking chroots by fchdir'ing
60398+ to a file descriptor of the chrooting process that points to a directory
60399+ outside the filesystem will be stopped. If the sysctl option
60400+ is enabled, a sysctl option with name "chroot_deny_fchdir" is created.
60401+
60402+config GRKERNSEC_CHROOT_MKNOD
60403+ bool "Deny mknod"
60404+ depends on GRKERNSEC_CHROOT
60405+ help
60406+ If you say Y here, processes inside a chroot will not be allowed to
60407+ mknod. The problem with using mknod inside a chroot is that it
60408+ would allow an attacker to create a device entry that is the same
60409+ as one on the physical root of your system, which could range from
60410+ anything from the console device to a device for your harddrive (which
60411+ they could then use to wipe the drive or steal data). It is recommended
60412+ that you say Y here, unless you run into software incompatibilities.
60413+ If the sysctl option is enabled, a sysctl option with name
60414+ "chroot_deny_mknod" is created.
60415+
60416+config GRKERNSEC_CHROOT_SHMAT
60417+ bool "Deny shmat() out of chroot"
60418+ depends on GRKERNSEC_CHROOT
60419+ help
60420+ If you say Y here, processes inside a chroot will not be able to attach
60421+ to shared memory segments that were created outside of the chroot jail.
60422+ It is recommended that you say Y here. If the sysctl option is enabled,
60423+ a sysctl option with name "chroot_deny_shmat" is created.
60424+
60425+config GRKERNSEC_CHROOT_UNIX
60426+ bool "Deny access to abstract AF_UNIX sockets out of chroot"
60427+ depends on GRKERNSEC_CHROOT
60428+ help
60429+ If you say Y here, processes inside a chroot will not be able to
60430+ connect to abstract (meaning not belonging to a filesystem) Unix
60431+ domain sockets that were bound outside of a chroot. It is recommended
60432+ that you say Y here. If the sysctl option is enabled, a sysctl option
60433+ with name "chroot_deny_unix" is created.
60434+
60435+config GRKERNSEC_CHROOT_FINDTASK
60436+ bool "Protect outside processes"
60437+ depends on GRKERNSEC_CHROOT
60438+ help
60439+ If you say Y here, processes inside a chroot will not be able to
60440+ kill, send signals with fcntl, ptrace, capget, getpgid, setpgid,
60441+ getsid, or view any process outside of the chroot. If the sysctl
60442+ option is enabled, a sysctl option with name "chroot_findtask" is
60443+ created.
60444+
60445+config GRKERNSEC_CHROOT_NICE
60446+ bool "Restrict priority changes"
60447+ depends on GRKERNSEC_CHROOT
60448+ help
60449+ If you say Y here, processes inside a chroot will not be able to raise
60450+ the priority of processes in the chroot, or alter the priority of
60451+ processes outside the chroot. This provides more security than simply
60452+ removing CAP_SYS_NICE from the process' capability set. If the
60453+ sysctl option is enabled, a sysctl option with name "chroot_restrict_nice"
60454+ is created.
60455+
60456+config GRKERNSEC_CHROOT_SYSCTL
60457+ bool "Deny sysctl writes"
60458+ depends on GRKERNSEC_CHROOT
60459+ help
60460+ If you say Y here, an attacker in a chroot will not be able to
60461+ write to sysctl entries, either by sysctl(2) or through a /proc
60462+ interface. It is strongly recommended that you say Y here. If the
60463+ sysctl option is enabled, a sysctl option with name
60464+ "chroot_deny_sysctl" is created.
60465+
60466+config GRKERNSEC_CHROOT_CAPS
60467+ bool "Capability restrictions"
60468+ depends on GRKERNSEC_CHROOT
60469+ help
60470+ If you say Y here, the capabilities on all root processes within a
60471+ chroot jail will be lowered to stop module insertion, raw i/o,
60472+ system and net admin tasks, rebooting the system, modifying immutable
60473+ files, modifying IPC owned by another, and changing the system time.
60474+ This is left an option because it can break some apps. Disable this
60475+ if your chrooted apps are having problems performing those kinds of
60476+ tasks. If the sysctl option is enabled, a sysctl option with
60477+ name "chroot_caps" is created.
60478+
60479+endmenu
60480+menu "Kernel Auditing"
60481+depends on GRKERNSEC
60482+
60483+config GRKERNSEC_AUDIT_GROUP
60484+ bool "Single group for auditing"
60485+ help
60486+ If you say Y here, the exec, chdir, and (un)mount logging features
60487+ will only operate on a group you specify. This option is recommended
60488+ if you only want to watch certain users instead of having a large
60489+ amount of logs from the entire system. If the sysctl option is enabled,
60490+ a sysctl option with name "audit_group" is created.
60491+
60492+config GRKERNSEC_AUDIT_GID
60493+ int "GID for auditing"
60494+ depends on GRKERNSEC_AUDIT_GROUP
60495+ default 1007
60496+
60497+config GRKERNSEC_EXECLOG
60498+ bool "Exec logging"
60499+ help
60500+ If you say Y here, all execve() calls will be logged (since the
60501+ other exec*() calls are frontends to execve(), all execution
60502+ will be logged). Useful for shell-servers that like to keep track
60503+ of their users. If the sysctl option is enabled, a sysctl option with
60504+ name "exec_logging" is created.
60505+ WARNING: This option when enabled will produce a LOT of logs, especially
60506+ on an active system.
60507+
60508+config GRKERNSEC_RESLOG
60509+ bool "Resource logging"
60510+ help
60511+ If you say Y here, all attempts to overstep resource limits will
60512+ be logged with the resource name, the requested size, and the current
60513+ limit. It is highly recommended that you say Y here. If the sysctl
60514+ option is enabled, a sysctl option with name "resource_logging" is
60515+ created. If the RBAC system is enabled, the sysctl value is ignored.
60516+
60517+config GRKERNSEC_CHROOT_EXECLOG
60518+ bool "Log execs within chroot"
60519+ help
60520+ If you say Y here, all executions inside a chroot jail will be logged
60521+ to syslog. This can cause a large amount of logs if certain
60522+ applications (eg. djb's daemontools) are installed on the system, and
60523+ is therefore left as an option. If the sysctl option is enabled, a
60524+ sysctl option with name "chroot_execlog" is created.
60525+
60526+config GRKERNSEC_AUDIT_PTRACE
60527+ bool "Ptrace logging"
60528+ help
60529+ If you say Y here, all attempts to attach to a process via ptrace
60530+ will be logged. If the sysctl option is enabled, a sysctl option
60531+ with name "audit_ptrace" is created.
60532+
60533+config GRKERNSEC_AUDIT_CHDIR
60534+ bool "Chdir logging"
60535+ help
60536+ If you say Y here, all chdir() calls will be logged. If the sysctl
60537+ option is enabled, a sysctl option with name "audit_chdir" is created.
60538+
60539+config GRKERNSEC_AUDIT_MOUNT
60540+ bool "(Un)Mount logging"
60541+ help
60542+ If you say Y here, all mounts and unmounts will be logged. If the
60543+ sysctl option is enabled, a sysctl option with name "audit_mount" is
60544+ created.
60545+
60546+config GRKERNSEC_SIGNAL
60547+ bool "Signal logging"
60548+ help
60549+ If you say Y here, certain important signals will be logged, such as
60550+ SIGSEGV, which will as a result inform you of when a error in a program
60551+ occurred, which in some cases could mean a possible exploit attempt.
60552+ If the sysctl option is enabled, a sysctl option with name
60553+ "signal_logging" is created.
60554+
60555+config GRKERNSEC_FORKFAIL
60556+ bool "Fork failure logging"
60557+ help
60558+ If you say Y here, all failed fork() attempts will be logged.
60559+ This could suggest a fork bomb, or someone attempting to overstep
60560+ their process limit. If the sysctl option is enabled, a sysctl option
60561+ with name "forkfail_logging" is created.
60562+
60563+config GRKERNSEC_TIME
60564+ bool "Time change logging"
60565+ help
60566+ If you say Y here, any changes of the system clock will be logged.
60567+ If the sysctl option is enabled, a sysctl option with name
60568+ "timechange_logging" is created.
60569+
60570+config GRKERNSEC_PROC_IPADDR
60571+ bool "/proc/<pid>/ipaddr support"
60572+ help
60573+ If you say Y here, a new entry will be added to each /proc/<pid>
60574+ directory that contains the IP address of the person using the task.
60575+ The IP is carried across local TCP and AF_UNIX stream sockets.
60576+ This information can be useful for IDS/IPSes to perform remote response
60577+ to a local attack. The entry is readable by only the owner of the
60578+ process (and root if he has CAP_DAC_OVERRIDE, which can be removed via
60579+ the RBAC system), and thus does not create privacy concerns.
60580+
60581+config GRKERNSEC_RWXMAP_LOG
60582+ bool 'Denied RWX mmap/mprotect logging'
60583+ depends on PAX_MPROTECT && !PAX_EMUPLT && !PAX_EMUSIGRT
60584+ help
60585+ If you say Y here, calls to mmap() and mprotect() with explicit
60586+ usage of PROT_WRITE and PROT_EXEC together will be logged when
60587+ denied by the PAX_MPROTECT feature. If the sysctl option is
60588+ enabled, a sysctl option with name "rwxmap_logging" is created.
60589+
60590+config GRKERNSEC_AUDIT_TEXTREL
60591+ bool 'ELF text relocations logging (READ HELP)'
60592+ depends on PAX_MPROTECT
60593+ help
60594+ If you say Y here, text relocations will be logged with the filename
60595+ of the offending library or binary. The purpose of the feature is
60596+ to help Linux distribution developers get rid of libraries and
60597+ binaries that need text relocations which hinder the future progress
60598+ of PaX. Only Linux distribution developers should say Y here, and
60599+ never on a production machine, as this option creates an information
60600+ leak that could aid an attacker in defeating the randomization of
60601+ a single memory region. If the sysctl option is enabled, a sysctl
60602+ option with name "audit_textrel" is created.
60603+
60604+endmenu
60605+
60606+menu "Executable Protections"
60607+depends on GRKERNSEC
60608+
60609+config GRKERNSEC_EXECVE
60610+ bool "Enforce RLIMIT_NPROC on execs"
60611+ help
60612+ If you say Y here, users with a resource limit on processes will
60613+ have the value checked during execve() calls. The current system
60614+ only checks the system limit during fork() calls. If the sysctl option
60615+ is enabled, a sysctl option with name "execve_limiting" is created.
60616+
60617+config GRKERNSEC_DMESG
60618+ bool "Dmesg(8) restriction"
60619+ help
60620+ If you say Y here, non-root users will not be able to use dmesg(8)
60621+ to view up to the last 4kb of messages in the kernel's log buffer.
60622+ The kernel's log buffer often contains kernel addresses and other
60623+ identifying information useful to an attacker in fingerprinting a
60624+ system for a targeted exploit.
60625+ If the sysctl option is enabled, a sysctl option with name "dmesg" is
60626+ created.
60627+
60628+config GRKERNSEC_HARDEN_PTRACE
60629+ bool "Deter ptrace-based process snooping"
60630+ help
60631+ If you say Y here, TTY sniffers and other malicious monitoring
60632+ programs implemented through ptrace will be defeated. If you
60633+ have been using the RBAC system, this option has already been
60634+ enabled for several years for all users, with the ability to make
60635+ fine-grained exceptions.
60636+
60637+ This option only affects the ability of non-root users to ptrace
60638+ processes that are not a descendent of the ptracing process.
60639+ This means that strace ./binary and gdb ./binary will still work,
60640+ but attaching to arbitrary processes will not. If the sysctl
60641+ option is enabled, a sysctl option with name "harden_ptrace" is
60642+ created.
60643+
60644+config GRKERNSEC_TPE
60645+ bool "Trusted Path Execution (TPE)"
60646+ help
60647+ If you say Y here, you will be able to choose a gid to add to the
60648+ supplementary groups of users you want to mark as "untrusted."
60649+ These users will not be able to execute any files that are not in
60650+ root-owned directories writable only by root. If the sysctl option
60651+ is enabled, a sysctl option with name "tpe" is created.
60652+
60653+config GRKERNSEC_TPE_ALL
60654+ bool "Partially restrict all non-root users"
60655+ depends on GRKERNSEC_TPE
60656+ help
60657+ If you say Y here, all non-root users will be covered under
60658+ a weaker TPE restriction. This is separate from, and in addition to,
60659+ the main TPE options that you have selected elsewhere. Thus, if a
60660+ "trusted" GID is chosen, this restriction applies to even that GID.
60661+ Under this restriction, all non-root users will only be allowed to
60662+ execute files in directories they own that are not group or
60663+ world-writable, or in directories owned by root and writable only by
60664+ root. If the sysctl option is enabled, a sysctl option with name
60665+ "tpe_restrict_all" is created.
60666+
60667+config GRKERNSEC_TPE_INVERT
60668+ bool "Invert GID option"
60669+ depends on GRKERNSEC_TPE
60670+ help
60671+ If you say Y here, the group you specify in the TPE configuration will
60672+ decide what group TPE restrictions will be *disabled* for. This
60673+ option is useful if you want TPE restrictions to be applied to most
60674+ users on the system. If the sysctl option is enabled, a sysctl option
60675+ with name "tpe_invert" is created. Unlike other sysctl options, this
60676+ entry will default to on for backward-compatibility.
60677+
60678+config GRKERNSEC_TPE_GID
60679+ int "GID for untrusted users"
60680+ depends on GRKERNSEC_TPE && !GRKERNSEC_TPE_INVERT
60681+ default 1005
60682+ help
60683+ Setting this GID determines what group TPE restrictions will be
60684+ *enabled* for. If the sysctl option is enabled, a sysctl option
60685+ with name "tpe_gid" is created.
60686+
60687+config GRKERNSEC_TPE_GID
60688+ int "GID for trusted users"
60689+ depends on GRKERNSEC_TPE && GRKERNSEC_TPE_INVERT
60690+ default 1005
60691+ help
60692+ Setting this GID determines what group TPE restrictions will be
60693+ *disabled* for. If the sysctl option is enabled, a sysctl option
60694+ with name "tpe_gid" is created.
60695+
60696+endmenu
60697+menu "Network Protections"
60698+depends on GRKERNSEC
60699+
60700+config GRKERNSEC_RANDNET
60701+ bool "Larger entropy pools"
60702+ help
60703+ If you say Y here, the entropy pools used for many features of Linux
60704+ and grsecurity will be doubled in size. Since several grsecurity
60705+ features use additional randomness, it is recommended that you say Y
60706+ here. Saying Y here has a similar effect as modifying
60707+ /proc/sys/kernel/random/poolsize.
60708+
60709+config GRKERNSEC_BLACKHOLE
60710+ bool "TCP/UDP blackhole and LAST_ACK DoS prevention"
60711+ help
60712+ If you say Y here, neither TCP resets nor ICMP
60713+ destination-unreachable packets will be sent in response to packets
60714+ sent to ports for which no associated listening process exists.
60715+ This feature supports both IPV4 and IPV6 and exempts the
60716+ loopback interface from blackholing. Enabling this feature
60717+ makes a host more resilient to DoS attacks and reduces network
60718+ visibility against scanners.
60719+
60720+ The blackhole feature as-implemented is equivalent to the FreeBSD
60721+ blackhole feature, as it prevents RST responses to all packets, not
60722+ just SYNs. Under most application behavior this causes no
60723+ problems, but applications (like haproxy) may not close certain
60724+ connections in a way that cleanly terminates them on the remote
60725+ end, leaving the remote host in LAST_ACK state. Because of this
60726+ side-effect and to prevent intentional LAST_ACK DoSes, this
60727+ feature also adds automatic mitigation against such attacks.
60728+ The mitigation drastically reduces the amount of time a socket
60729+ can spend in LAST_ACK state. If you're using haproxy and not
60730+ all servers it connects to have this option enabled, consider
60731+ disabling this feature on the haproxy host.
60732+
60733+ If the sysctl option is enabled, two sysctl options with names
60734+ "ip_blackhole" and "lastack_retries" will be created.
60735+ While "ip_blackhole" takes the standard zero/non-zero on/off
60736+ toggle, "lastack_retries" uses the same kinds of values as
60737+ "tcp_retries1" and "tcp_retries2". The default value of 4
60738+ prevents a socket from lasting more than 45 seconds in LAST_ACK
60739+ state.
60740+
60741+config GRKERNSEC_SOCKET
60742+ bool "Socket restrictions"
60743+ help
60744+ If you say Y here, you will be able to choose from several options.
60745+ If you assign a GID on your system and add it to the supplementary
60746+ groups of users you want to restrict socket access to, this patch
60747+ will perform up to three things, based on the option(s) you choose.
60748+
60749+config GRKERNSEC_SOCKET_ALL
60750+ bool "Deny any sockets to group"
60751+ depends on GRKERNSEC_SOCKET
60752+ help
60753+ If you say Y here, you will be able to choose a GID of whose users will
60754+ be unable to connect to other hosts from your machine or run server
60755+ applications from your machine. If the sysctl option is enabled, a
60756+ sysctl option with name "socket_all" is created.
60757+
60758+config GRKERNSEC_SOCKET_ALL_GID
60759+ int "GID to deny all sockets for"
60760+ depends on GRKERNSEC_SOCKET_ALL
60761+ default 1004
60762+ help
60763+ Here you can choose the GID to disable socket access for. Remember to
60764+ add the users you want socket access disabled for to the GID
60765+ specified here. If the sysctl option is enabled, a sysctl option
60766+ with name "socket_all_gid" is created.
60767+
60768+config GRKERNSEC_SOCKET_CLIENT
60769+ bool "Deny client sockets to group"
60770+ depends on GRKERNSEC_SOCKET
60771+ help
60772+ If you say Y here, you will be able to choose a GID of whose users will
60773+ be unable to connect to other hosts from your machine, but will be
60774+ able to run servers. If this option is enabled, all users in the group
60775+ you specify will have to use passive mode when initiating ftp transfers
60776+ from the shell on your machine. If the sysctl option is enabled, a
60777+ sysctl option with name "socket_client" is created.
60778+
60779+config GRKERNSEC_SOCKET_CLIENT_GID
60780+ int "GID to deny client sockets for"
60781+ depends on GRKERNSEC_SOCKET_CLIENT
60782+ default 1003
60783+ help
60784+ Here you can choose the GID to disable client socket access for.
60785+ Remember to add the users you want client socket access disabled for to
60786+ the GID specified here. If the sysctl option is enabled, a sysctl
60787+ option with name "socket_client_gid" is created.
60788+
60789+config GRKERNSEC_SOCKET_SERVER
60790+ bool "Deny server sockets to group"
60791+ depends on GRKERNSEC_SOCKET
60792+ help
60793+ If you say Y here, you will be able to choose a GID of whose users will
60794+ be unable to run server applications from your machine. If the sysctl
60795+ option is enabled, a sysctl option with name "socket_server" is created.
60796+
60797+config GRKERNSEC_SOCKET_SERVER_GID
60798+ int "GID to deny server sockets for"
60799+ depends on GRKERNSEC_SOCKET_SERVER
60800+ default 1002
60801+ help
60802+ Here you can choose the GID to disable server socket access for.
60803+ Remember to add the users you want server socket access disabled for to
60804+ the GID specified here. If the sysctl option is enabled, a sysctl
60805+ option with name "socket_server_gid" is created.
60806+
60807+endmenu
60808+menu "Sysctl support"
60809+depends on GRKERNSEC && SYSCTL
60810+
60811+config GRKERNSEC_SYSCTL
60812+ bool "Sysctl support"
60813+ help
60814+ If you say Y here, you will be able to change the options that
60815+ grsecurity runs with at bootup, without having to recompile your
60816+ kernel. You can echo values to files in /proc/sys/kernel/grsecurity
60817+ to enable (1) or disable (0) various features. All the sysctl entries
60818+ are mutable until the "grsec_lock" entry is set to a non-zero value.
60819+ All features enabled in the kernel configuration are disabled at boot
60820+ if you do not say Y to the "Turn on features by default" option.
60821+ All options should be set at startup, and the grsec_lock entry should
60822+ be set to a non-zero value after all the options are set.
60823+ *THIS IS EXTREMELY IMPORTANT*
60824+
60825+config GRKERNSEC_SYSCTL_DISTRO
60826+ bool "Extra sysctl support for distro makers (READ HELP)"
60827+ depends on GRKERNSEC_SYSCTL && GRKERNSEC_IO
60828+ help
60829+ If you say Y here, additional sysctl options will be created
60830+ for features that affect processes running as root. Therefore,
60831+ it is critical when using this option that the grsec_lock entry be
60832+ enabled after boot. Only distros with prebuilt kernel packages
60833+ with this option enabled that can ensure grsec_lock is enabled
60834+ after boot should use this option.
60835+ *Failure to set grsec_lock after boot makes all grsec features
60836+ this option covers useless*
60837+
60838+ Currently this option creates the following sysctl entries:
60839+ "Disable Privileged I/O": "disable_priv_io"
60840+
60841+config GRKERNSEC_SYSCTL_ON
60842+ bool "Turn on features by default"
60843+ depends on GRKERNSEC_SYSCTL
60844+ help
60845+ If you say Y here, instead of having all features enabled in the
60846+ kernel configuration disabled at boot time, the features will be
60847+ enabled at boot time. It is recommended you say Y here unless
60848+ there is some reason you would want all sysctl-tunable features to
60849+ be disabled by default. As mentioned elsewhere, it is important
60850+ to enable the grsec_lock entry once you have finished modifying
60851+ the sysctl entries.
60852+
60853+endmenu
60854+menu "Logging Options"
60855+depends on GRKERNSEC
60856+
60857+config GRKERNSEC_FLOODTIME
60858+ int "Seconds in between log messages (minimum)"
60859+ default 10
60860+ help
60861+ This option allows you to enforce the number of seconds between
60862+ grsecurity log messages. The default should be suitable for most
60863+ people, however, if you choose to change it, choose a value small enough
60864+ to allow informative logs to be produced, but large enough to
60865+ prevent flooding.
60866+
60867+config GRKERNSEC_FLOODBURST
60868+ int "Number of messages in a burst (maximum)"
60869+ default 4
60870+ help
60871+ This option allows you to choose the maximum number of messages allowed
60872+ within the flood time interval you chose in a separate option. The
60873+ default should be suitable for most people, however if you find that
60874+ many of your logs are being interpreted as flooding, you may want to
60875+ raise this value.
60876+
60877+endmenu
60878+
60879+endmenu
60880diff -urNp linux-2.6.39/grsecurity/Makefile linux-2.6.39/grsecurity/Makefile
60881--- linux-2.6.39/grsecurity/Makefile 1969-12-31 19:00:00.000000000 -0500
60882+++ linux-2.6.39/grsecurity/Makefile 2011-05-24 20:26:54.000000000 -0400
60883@@ -0,0 +1,33 @@
60884+# grsecurity's ACL system was originally written in 2001 by Michael Dalton
60885+# during 2001-2009 it has been completely redesigned by Brad Spengler
60886+# into an RBAC system
60887+#
60888+# All code in this directory and various hooks inserted throughout the kernel
60889+# are copyright Brad Spengler - Open Source Security, Inc., and released
60890+# under the GPL v2 or higher
60891+
60892+obj-y = grsec_chdir.o grsec_chroot.o grsec_exec.o grsec_fifo.o grsec_fork.o \
60893+ grsec_mount.o grsec_sig.o grsec_sock.o grsec_sysctl.o \
60894+ grsec_time.o grsec_tpe.o grsec_link.o grsec_pax.o grsec_ptrace.o
60895+
60896+obj-$(CONFIG_GRKERNSEC) += grsec_init.o grsum.o gracl.o gracl_segv.o \
60897+ gracl_cap.o gracl_alloc.o gracl_shm.o grsec_mem.o gracl_fs.o \
60898+ gracl_learn.o grsec_log.o
60899+obj-$(CONFIG_GRKERNSEC_RESLOG) += gracl_res.o
60900+
60901+ifdef CONFIG_NET
60902+obj-$(CONFIG_GRKERNSEC) += gracl_ip.o
60903+endif
60904+
60905+ifndef CONFIG_GRKERNSEC
60906+obj-y += grsec_disabled.o
60907+endif
60908+
60909+ifdef CONFIG_GRKERNSEC_HIDESYM
60910+extra-y := grsec_hidesym.o
60911+$(obj)/grsec_hidesym.o:
60912+ @-chmod -f 500 /boot
60913+ @-chmod -f 500 /lib/modules
60914+ @-chmod -f 700 .
60915+ @echo ' grsec: protected kernel image paths'
60916+endif
60917diff -urNp linux-2.6.39/include/acpi/acpi_drivers.h linux-2.6.39/include/acpi/acpi_drivers.h
60918--- linux-2.6.39/include/acpi/acpi_drivers.h 2011-05-19 00:06:34.000000000 -0400
60919+++ linux-2.6.39/include/acpi/acpi_drivers.h 2011-05-22 19:36:32.000000000 -0400
60920@@ -119,8 +119,8 @@ void pci_acpi_crs_quirks(void);
60921 Dock Station
60922 -------------------------------------------------------------------------- */
60923 struct acpi_dock_ops {
60924- acpi_notify_handler handler;
60925- acpi_notify_handler uevent;
60926+ const acpi_notify_handler handler;
60927+ const acpi_notify_handler uevent;
60928 };
60929
60930 #if defined(CONFIG_ACPI_DOCK) || defined(CONFIG_ACPI_DOCK_MODULE)
60931@@ -128,7 +128,7 @@ extern int is_dock_device(acpi_handle ha
60932 extern int register_dock_notifier(struct notifier_block *nb);
60933 extern void unregister_dock_notifier(struct notifier_block *nb);
60934 extern int register_hotplug_dock_device(acpi_handle handle,
60935- struct acpi_dock_ops *ops,
60936+ const struct acpi_dock_ops *ops,
60937 void *context);
60938 extern void unregister_hotplug_dock_device(acpi_handle handle);
60939 #else
60940@@ -144,7 +144,7 @@ static inline void unregister_dock_notif
60941 {
60942 }
60943 static inline int register_hotplug_dock_device(acpi_handle handle,
60944- struct acpi_dock_ops *ops,
60945+ const struct acpi_dock_ops *ops,
60946 void *context)
60947 {
60948 return -ENODEV;
60949diff -urNp linux-2.6.39/include/acpi/processor.h linux-2.6.39/include/acpi/processor.h
60950--- linux-2.6.39/include/acpi/processor.h 2011-05-19 00:06:34.000000000 -0400
60951+++ linux-2.6.39/include/acpi/processor.h 2011-05-22 19:36:32.000000000 -0400
60952@@ -344,7 +344,7 @@ extern struct cpuidle_driver acpi_idle_d
60953
60954 /* in processor_thermal.c */
60955 int acpi_processor_get_limit_info(struct acpi_processor *pr);
60956-extern struct thermal_cooling_device_ops processor_cooling_ops;
60957+extern const struct thermal_cooling_device_ops processor_cooling_ops;
60958 #ifdef CONFIG_CPU_FREQ
60959 void acpi_thermal_cpufreq_init(void);
60960 void acpi_thermal_cpufreq_exit(void);
60961diff -urNp linux-2.6.39/include/asm-generic/atomic-long.h linux-2.6.39/include/asm-generic/atomic-long.h
60962--- linux-2.6.39/include/asm-generic/atomic-long.h 2011-05-19 00:06:34.000000000 -0400
60963+++ linux-2.6.39/include/asm-generic/atomic-long.h 2011-05-22 19:36:32.000000000 -0400
60964@@ -22,6 +22,12 @@
60965
60966 typedef atomic64_t atomic_long_t;
60967
60968+#ifdef CONFIG_PAX_REFCOUNT
60969+typedef atomic64_unchecked_t atomic_long_unchecked_t;
60970+#else
60971+typedef atomic64_t atomic_long_unchecked_t;
60972+#endif
60973+
60974 #define ATOMIC_LONG_INIT(i) ATOMIC64_INIT(i)
60975
60976 static inline long atomic_long_read(atomic_long_t *l)
60977@@ -31,6 +37,15 @@ static inline long atomic_long_read(atom
60978 return (long)atomic64_read(v);
60979 }
60980
60981+#ifdef CONFIG_PAX_REFCOUNT
60982+static inline long atomic_long_read_unchecked(atomic_long_unchecked_t *l)
60983+{
60984+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
60985+
60986+ return (long)atomic64_read_unchecked(v);
60987+}
60988+#endif
60989+
60990 static inline void atomic_long_set(atomic_long_t *l, long i)
60991 {
60992 atomic64_t *v = (atomic64_t *)l;
60993@@ -38,6 +53,15 @@ static inline void atomic_long_set(atomi
60994 atomic64_set(v, i);
60995 }
60996
60997+#ifdef CONFIG_PAX_REFCOUNT
60998+static inline void atomic_long_set_unchecked(atomic_long_unchecked_t *l, long i)
60999+{
61000+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
61001+
61002+ atomic64_set_unchecked(v, i);
61003+}
61004+#endif
61005+
61006 static inline void atomic_long_inc(atomic_long_t *l)
61007 {
61008 atomic64_t *v = (atomic64_t *)l;
61009@@ -45,6 +69,15 @@ static inline void atomic_long_inc(atomi
61010 atomic64_inc(v);
61011 }
61012
61013+#ifdef CONFIG_PAX_REFCOUNT
61014+static inline void atomic_long_inc_unchecked(atomic_long_unchecked_t *l)
61015+{
61016+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
61017+
61018+ atomic64_inc_unchecked(v);
61019+}
61020+#endif
61021+
61022 static inline void atomic_long_dec(atomic_long_t *l)
61023 {
61024 atomic64_t *v = (atomic64_t *)l;
61025@@ -52,6 +85,15 @@ static inline void atomic_long_dec(atomi
61026 atomic64_dec(v);
61027 }
61028
61029+#ifdef CONFIG_PAX_REFCOUNT
61030+static inline void atomic_long_dec_unchecked(atomic_long_unchecked_t *l)
61031+{
61032+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
61033+
61034+ atomic64_dec_unchecked(v);
61035+}
61036+#endif
61037+
61038 static inline void atomic_long_add(long i, atomic_long_t *l)
61039 {
61040 atomic64_t *v = (atomic64_t *)l;
61041@@ -59,6 +101,15 @@ static inline void atomic_long_add(long
61042 atomic64_add(i, v);
61043 }
61044
61045+#ifdef CONFIG_PAX_REFCOUNT
61046+static inline void atomic_long_add_unchecked(long i, atomic_long_unchecked_t *l)
61047+{
61048+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
61049+
61050+ atomic64_add_unchecked(i, v);
61051+}
61052+#endif
61053+
61054 static inline void atomic_long_sub(long i, atomic_long_t *l)
61055 {
61056 atomic64_t *v = (atomic64_t *)l;
61057@@ -66,6 +117,15 @@ static inline void atomic_long_sub(long
61058 atomic64_sub(i, v);
61059 }
61060
61061+#ifdef CONFIG_PAX_REFCOUNT
61062+static inline void atomic_long_sub_unchecked(long i, atomic_long_unchecked_t *l)
61063+{
61064+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
61065+
61066+ atomic64_sub_unchecked(i, v);
61067+}
61068+#endif
61069+
61070 static inline int atomic_long_sub_and_test(long i, atomic_long_t *l)
61071 {
61072 atomic64_t *v = (atomic64_t *)l;
61073@@ -115,6 +175,15 @@ static inline long atomic_long_inc_retur
61074 return (long)atomic64_inc_return(v);
61075 }
61076
61077+#ifdef CONFIG_PAX_REFCOUNT
61078+static inline long atomic_long_inc_return_unchecked(atomic_long_unchecked_t *l)
61079+{
61080+ atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
61081+
61082+ return (long)atomic64_inc_return_unchecked(v);
61083+}
61084+#endif
61085+
61086 static inline long atomic_long_dec_return(atomic_long_t *l)
61087 {
61088 atomic64_t *v = (atomic64_t *)l;
61089@@ -140,6 +209,12 @@ static inline long atomic_long_add_unles
61090
61091 typedef atomic_t atomic_long_t;
61092
61093+#ifdef CONFIG_PAX_REFCOUNT
61094+typedef atomic_unchecked_t atomic_long_unchecked_t;
61095+#else
61096+typedef atomic_t atomic_long_unchecked_t;
61097+#endif
61098+
61099 #define ATOMIC_LONG_INIT(i) ATOMIC_INIT(i)
61100 static inline long atomic_long_read(atomic_long_t *l)
61101 {
61102@@ -148,6 +223,15 @@ static inline long atomic_long_read(atom
61103 return (long)atomic_read(v);
61104 }
61105
61106+#ifdef CONFIG_PAX_REFCOUNT
61107+static inline long atomic_long_read_unchecked(atomic_long_unchecked_t *l)
61108+{
61109+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
61110+
61111+ return (long)atomic_read_unchecked(v);
61112+}
61113+#endif
61114+
61115 static inline void atomic_long_set(atomic_long_t *l, long i)
61116 {
61117 atomic_t *v = (atomic_t *)l;
61118@@ -155,6 +239,15 @@ static inline void atomic_long_set(atomi
61119 atomic_set(v, i);
61120 }
61121
61122+#ifdef CONFIG_PAX_REFCOUNT
61123+static inline void atomic_long_set_unchecked(atomic_long_unchecked_t *l, long i)
61124+{
61125+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
61126+
61127+ atomic_set_unchecked(v, i);
61128+}
61129+#endif
61130+
61131 static inline void atomic_long_inc(atomic_long_t *l)
61132 {
61133 atomic_t *v = (atomic_t *)l;
61134@@ -162,6 +255,15 @@ static inline void atomic_long_inc(atomi
61135 atomic_inc(v);
61136 }
61137
61138+#ifdef CONFIG_PAX_REFCOUNT
61139+static inline void atomic_long_inc_unchecked(atomic_long_unchecked_t *l)
61140+{
61141+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
61142+
61143+ atomic_inc_unchecked(v);
61144+}
61145+#endif
61146+
61147 static inline void atomic_long_dec(atomic_long_t *l)
61148 {
61149 atomic_t *v = (atomic_t *)l;
61150@@ -169,6 +271,15 @@ static inline void atomic_long_dec(atomi
61151 atomic_dec(v);
61152 }
61153
61154+#ifdef CONFIG_PAX_REFCOUNT
61155+static inline void atomic_long_dec_unchecked(atomic_long_unchecked_t *l)
61156+{
61157+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
61158+
61159+ atomic_dec_unchecked(v);
61160+}
61161+#endif
61162+
61163 static inline void atomic_long_add(long i, atomic_long_t *l)
61164 {
61165 atomic_t *v = (atomic_t *)l;
61166@@ -176,6 +287,15 @@ static inline void atomic_long_add(long
61167 atomic_add(i, v);
61168 }
61169
61170+#ifdef CONFIG_PAX_REFCOUNT
61171+static inline void atomic_long_add_unchecked(long i, atomic_long_unchecked_t *l)
61172+{
61173+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
61174+
61175+ atomic_add_unchecked(i, v);
61176+}
61177+#endif
61178+
61179 static inline void atomic_long_sub(long i, atomic_long_t *l)
61180 {
61181 atomic_t *v = (atomic_t *)l;
61182@@ -183,6 +303,15 @@ static inline void atomic_long_sub(long
61183 atomic_sub(i, v);
61184 }
61185
61186+#ifdef CONFIG_PAX_REFCOUNT
61187+static inline void atomic_long_sub_unchecked(long i, atomic_long_unchecked_t *l)
61188+{
61189+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
61190+
61191+ atomic_sub_unchecked(i, v);
61192+}
61193+#endif
61194+
61195 static inline int atomic_long_sub_and_test(long i, atomic_long_t *l)
61196 {
61197 atomic_t *v = (atomic_t *)l;
61198@@ -232,6 +361,15 @@ static inline long atomic_long_inc_retur
61199 return (long)atomic_inc_return(v);
61200 }
61201
61202+#ifdef CONFIG_PAX_REFCOUNT
61203+static inline long atomic_long_inc_return_unchecked(atomic_long_unchecked_t *l)
61204+{
61205+ atomic_unchecked_t *v = (atomic_unchecked_t *)l;
61206+
61207+ return (long)atomic_inc_return_unchecked(v);
61208+}
61209+#endif
61210+
61211 static inline long atomic_long_dec_return(atomic_long_t *l)
61212 {
61213 atomic_t *v = (atomic_t *)l;
61214@@ -255,4 +393,49 @@ static inline long atomic_long_add_unles
61215
61216 #endif /* BITS_PER_LONG == 64 */
61217
61218+#ifdef CONFIG_PAX_REFCOUNT
61219+static inline void pax_refcount_needs_these_functions(void)
61220+{
61221+ atomic_read_unchecked((atomic_unchecked_t *)NULL);
61222+ atomic_set_unchecked((atomic_unchecked_t *)NULL, 0);
61223+ atomic_add_unchecked(0, (atomic_unchecked_t *)NULL);
61224+ atomic_sub_unchecked(0, (atomic_unchecked_t *)NULL);
61225+ atomic_inc_unchecked((atomic_unchecked_t *)NULL);
61226+ atomic_inc_and_test_unchecked((atomic_unchecked_t *)NULL);
61227+ atomic_inc_return_unchecked((atomic_unchecked_t *)NULL);
61228+ atomic_add_return_unchecked(0, (atomic_unchecked_t *)NULL);
61229+ atomic_dec_unchecked((atomic_unchecked_t *)NULL);
61230+ atomic_cmpxchg_unchecked((atomic_unchecked_t *)NULL, 0, 0);
61231+ atomic_xchg_unchecked((atomic_unchecked_t *)NULL, 0);
61232+
61233+ atomic_long_read_unchecked((atomic_long_unchecked_t *)NULL);
61234+ atomic_long_set_unchecked((atomic_long_unchecked_t *)NULL, 0);
61235+ atomic_long_add_unchecked(0, (atomic_long_unchecked_t *)NULL);
61236+ atomic_long_sub_unchecked(0, (atomic_long_unchecked_t *)NULL);
61237+ atomic_long_inc_unchecked((atomic_long_unchecked_t *)NULL);
61238+ atomic_long_inc_return_unchecked((atomic_long_unchecked_t *)NULL);
61239+ atomic_long_dec_unchecked((atomic_long_unchecked_t *)NULL);
61240+}
61241+#else
61242+#define atomic_read_unchecked(v) atomic_read(v)
61243+#define atomic_set_unchecked(v, i) atomic_set((v), (i))
61244+#define atomic_add_unchecked(i, v) atomic_add((i), (v))
61245+#define atomic_sub_unchecked(i, v) atomic_sub((i), (v))
61246+#define atomic_inc_unchecked(v) atomic_inc(v)
61247+#define atomic_inc_and_test_unchecked(v) atomic_inc_and_test(v)
61248+#define atomic_inc_return_unchecked(v) atomic_inc_return(v)
61249+#define atomic_add_return_unchecked(i, v) atomic_add_return((i), (v))
61250+#define atomic_dec_unchecked(v) atomic_dec(v)
61251+#define atomic_cmpxchg_unchecked(v, o, n) atomic_cmpxchg((v), (o), (n))
61252+#define atomic_xchg_unchecked(v, i) atomic_xchg((v), (i))
61253+
61254+#define atomic_long_read_unchecked(v) atomic_long_read(v)
61255+#define atomic_long_set_unchecked(v, i) atomic_long_set((v), (i))
61256+#define atomic_long_add_unchecked(i, v) atomic_long_add((i), (v))
61257+#define atomic_long_sub_unchecked(i, v) atomic_long_sub((i), (v))
61258+#define atomic_long_inc_unchecked(v) atomic_long_inc(v)
61259+#define atomic_long_inc_return_unchecked(v) atomic_long_inc_return(v)
61260+#define atomic_long_dec_unchecked(v) atomic_long_dec(v)
61261+#endif
61262+
61263 #endif /* _ASM_GENERIC_ATOMIC_LONG_H */
61264diff -urNp linux-2.6.39/include/asm-generic/cache.h linux-2.6.39/include/asm-generic/cache.h
61265--- linux-2.6.39/include/asm-generic/cache.h 2011-05-19 00:06:34.000000000 -0400
61266+++ linux-2.6.39/include/asm-generic/cache.h 2011-05-22 19:36:32.000000000 -0400
61267@@ -6,7 +6,7 @@
61268 * cache lines need to provide their own cache.h.
61269 */
61270
61271-#define L1_CACHE_SHIFT 5
61272-#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
61273+#define L1_CACHE_SHIFT 5U
61274+#define L1_CACHE_BYTES (1U << L1_CACHE_SHIFT)
61275
61276 #endif /* __ASM_GENERIC_CACHE_H */
61277diff -urNp linux-2.6.39/include/asm-generic/dma-mapping-common.h linux-2.6.39/include/asm-generic/dma-mapping-common.h
61278--- linux-2.6.39/include/asm-generic/dma-mapping-common.h 2011-05-19 00:06:34.000000000 -0400
61279+++ linux-2.6.39/include/asm-generic/dma-mapping-common.h 2011-05-22 19:36:32.000000000 -0400
61280@@ -11,7 +11,7 @@ static inline dma_addr_t dma_map_single_
61281 enum dma_data_direction dir,
61282 struct dma_attrs *attrs)
61283 {
61284- struct dma_map_ops *ops = get_dma_ops(dev);
61285+ const struct dma_map_ops *ops = get_dma_ops(dev);
61286 dma_addr_t addr;
61287
61288 kmemcheck_mark_initialized(ptr, size);
61289@@ -30,7 +30,7 @@ static inline void dma_unmap_single_attr
61290 enum dma_data_direction dir,
61291 struct dma_attrs *attrs)
61292 {
61293- struct dma_map_ops *ops = get_dma_ops(dev);
61294+ const struct dma_map_ops *ops = get_dma_ops(dev);
61295
61296 BUG_ON(!valid_dma_direction(dir));
61297 if (ops->unmap_page)
61298@@ -42,7 +42,7 @@ static inline int dma_map_sg_attrs(struc
61299 int nents, enum dma_data_direction dir,
61300 struct dma_attrs *attrs)
61301 {
61302- struct dma_map_ops *ops = get_dma_ops(dev);
61303+ const struct dma_map_ops *ops = get_dma_ops(dev);
61304 int i, ents;
61305 struct scatterlist *s;
61306
61307@@ -59,7 +59,7 @@ static inline void dma_unmap_sg_attrs(st
61308 int nents, enum dma_data_direction dir,
61309 struct dma_attrs *attrs)
61310 {
61311- struct dma_map_ops *ops = get_dma_ops(dev);
61312+ const struct dma_map_ops *ops = get_dma_ops(dev);
61313
61314 BUG_ON(!valid_dma_direction(dir));
61315 debug_dma_unmap_sg(dev, sg, nents, dir);
61316@@ -71,7 +71,7 @@ static inline dma_addr_t dma_map_page(st
61317 size_t offset, size_t size,
61318 enum dma_data_direction dir)
61319 {
61320- struct dma_map_ops *ops = get_dma_ops(dev);
61321+ const struct dma_map_ops *ops = get_dma_ops(dev);
61322 dma_addr_t addr;
61323
61324 kmemcheck_mark_initialized(page_address(page) + offset, size);
61325@@ -85,7 +85,7 @@ static inline dma_addr_t dma_map_page(st
61326 static inline void dma_unmap_page(struct device *dev, dma_addr_t addr,
61327 size_t size, enum dma_data_direction dir)
61328 {
61329- struct dma_map_ops *ops = get_dma_ops(dev);
61330+ const struct dma_map_ops *ops = get_dma_ops(dev);
61331
61332 BUG_ON(!valid_dma_direction(dir));
61333 if (ops->unmap_page)
61334@@ -97,7 +97,7 @@ static inline void dma_sync_single_for_c
61335 size_t size,
61336 enum dma_data_direction dir)
61337 {
61338- struct dma_map_ops *ops = get_dma_ops(dev);
61339+ const struct dma_map_ops *ops = get_dma_ops(dev);
61340
61341 BUG_ON(!valid_dma_direction(dir));
61342 if (ops->sync_single_for_cpu)
61343@@ -109,7 +109,7 @@ static inline void dma_sync_single_for_d
61344 dma_addr_t addr, size_t size,
61345 enum dma_data_direction dir)
61346 {
61347- struct dma_map_ops *ops = get_dma_ops(dev);
61348+ const struct dma_map_ops *ops = get_dma_ops(dev);
61349
61350 BUG_ON(!valid_dma_direction(dir));
61351 if (ops->sync_single_for_device)
61352@@ -139,7 +139,7 @@ static inline void
61353 dma_sync_sg_for_cpu(struct device *dev, struct scatterlist *sg,
61354 int nelems, enum dma_data_direction dir)
61355 {
61356- struct dma_map_ops *ops = get_dma_ops(dev);
61357+ const struct dma_map_ops *ops = get_dma_ops(dev);
61358
61359 BUG_ON(!valid_dma_direction(dir));
61360 if (ops->sync_sg_for_cpu)
61361@@ -151,7 +151,7 @@ static inline void
61362 dma_sync_sg_for_device(struct device *dev, struct scatterlist *sg,
61363 int nelems, enum dma_data_direction dir)
61364 {
61365- struct dma_map_ops *ops = get_dma_ops(dev);
61366+ const struct dma_map_ops *ops = get_dma_ops(dev);
61367
61368 BUG_ON(!valid_dma_direction(dir));
61369 if (ops->sync_sg_for_device)
61370diff -urNp linux-2.6.39/include/asm-generic/int-l64.h linux-2.6.39/include/asm-generic/int-l64.h
61371--- linux-2.6.39/include/asm-generic/int-l64.h 2011-05-19 00:06:34.000000000 -0400
61372+++ linux-2.6.39/include/asm-generic/int-l64.h 2011-05-22 19:36:32.000000000 -0400
61373@@ -46,6 +46,8 @@ typedef unsigned int u32;
61374 typedef signed long s64;
61375 typedef unsigned long u64;
61376
61377+typedef unsigned int intoverflow_t __attribute__ ((mode(TI)));
61378+
61379 #define S8_C(x) x
61380 #define U8_C(x) x ## U
61381 #define S16_C(x) x
61382diff -urNp linux-2.6.39/include/asm-generic/int-ll64.h linux-2.6.39/include/asm-generic/int-ll64.h
61383--- linux-2.6.39/include/asm-generic/int-ll64.h 2011-05-19 00:06:34.000000000 -0400
61384+++ linux-2.6.39/include/asm-generic/int-ll64.h 2011-05-22 19:36:32.000000000 -0400
61385@@ -51,6 +51,8 @@ typedef unsigned int u32;
61386 typedef signed long long s64;
61387 typedef unsigned long long u64;
61388
61389+typedef unsigned long long intoverflow_t;
61390+
61391 #define S8_C(x) x
61392 #define U8_C(x) x ## U
61393 #define S16_C(x) x
61394diff -urNp linux-2.6.39/include/asm-generic/kmap_types.h linux-2.6.39/include/asm-generic/kmap_types.h
61395--- linux-2.6.39/include/asm-generic/kmap_types.h 2011-05-19 00:06:34.000000000 -0400
61396+++ linux-2.6.39/include/asm-generic/kmap_types.h 2011-05-22 19:36:32.000000000 -0400
61397@@ -29,10 +29,11 @@ KMAP_D(16) KM_IRQ_PTE,
61398 KMAP_D(17) KM_NMI,
61399 KMAP_D(18) KM_NMI_PTE,
61400 KMAP_D(19) KM_KDB,
61401+KMAP_D(20) KM_CLEARPAGE,
61402 /*
61403 * Remember to update debug_kmap_atomic() when adding new kmap types!
61404 */
61405-KMAP_D(20) KM_TYPE_NR
61406+KMAP_D(21) KM_TYPE_NR
61407 };
61408
61409 #undef KMAP_D
61410diff -urNp linux-2.6.39/include/asm-generic/pgtable.h linux-2.6.39/include/asm-generic/pgtable.h
61411--- linux-2.6.39/include/asm-generic/pgtable.h 2011-05-19 00:06:34.000000000 -0400
61412+++ linux-2.6.39/include/asm-generic/pgtable.h 2011-05-22 19:36:32.000000000 -0400
61413@@ -447,6 +447,14 @@ static inline int pmd_write(pmd_t pmd)
61414 #endif /* __HAVE_ARCH_PMD_WRITE */
61415 #endif
61416
61417+#ifndef __HAVE_ARCH_PAX_OPEN_KERNEL
61418+static inline unsigned long pax_open_kernel(void) { return 0; }
61419+#endif
61420+
61421+#ifndef __HAVE_ARCH_PAX_CLOSE_KERNEL
61422+static inline unsigned long pax_close_kernel(void) { return 0; }
61423+#endif
61424+
61425 #endif /* !__ASSEMBLY__ */
61426
61427 #endif /* _ASM_GENERIC_PGTABLE_H */
61428diff -urNp linux-2.6.39/include/asm-generic/pgtable-nopmd.h linux-2.6.39/include/asm-generic/pgtable-nopmd.h
61429--- linux-2.6.39/include/asm-generic/pgtable-nopmd.h 2011-05-19 00:06:34.000000000 -0400
61430+++ linux-2.6.39/include/asm-generic/pgtable-nopmd.h 2011-05-22 19:36:32.000000000 -0400
61431@@ -1,14 +1,19 @@
61432 #ifndef _PGTABLE_NOPMD_H
61433 #define _PGTABLE_NOPMD_H
61434
61435-#ifndef __ASSEMBLY__
61436-
61437 #include <asm-generic/pgtable-nopud.h>
61438
61439-struct mm_struct;
61440-
61441 #define __PAGETABLE_PMD_FOLDED
61442
61443+#define PMD_SHIFT PUD_SHIFT
61444+#define PTRS_PER_PMD 1
61445+#define PMD_SIZE (_AC(1,UL) << PMD_SHIFT)
61446+#define PMD_MASK (~(PMD_SIZE-1))
61447+
61448+#ifndef __ASSEMBLY__
61449+
61450+struct mm_struct;
61451+
61452 /*
61453 * Having the pmd type consist of a pud gets the size right, and allows
61454 * us to conceptually access the pud entry that this pmd is folded into
61455@@ -16,11 +21,6 @@ struct mm_struct;
61456 */
61457 typedef struct { pud_t pud; } pmd_t;
61458
61459-#define PMD_SHIFT PUD_SHIFT
61460-#define PTRS_PER_PMD 1
61461-#define PMD_SIZE (1UL << PMD_SHIFT)
61462-#define PMD_MASK (~(PMD_SIZE-1))
61463-
61464 /*
61465 * The "pud_xxx()" functions here are trivial for a folded two-level
61466 * setup: the pmd is never bad, and a pmd always exists (as it's folded
61467diff -urNp linux-2.6.39/include/asm-generic/pgtable-nopud.h linux-2.6.39/include/asm-generic/pgtable-nopud.h
61468--- linux-2.6.39/include/asm-generic/pgtable-nopud.h 2011-05-19 00:06:34.000000000 -0400
61469+++ linux-2.6.39/include/asm-generic/pgtable-nopud.h 2011-05-22 19:36:32.000000000 -0400
61470@@ -1,10 +1,15 @@
61471 #ifndef _PGTABLE_NOPUD_H
61472 #define _PGTABLE_NOPUD_H
61473
61474-#ifndef __ASSEMBLY__
61475-
61476 #define __PAGETABLE_PUD_FOLDED
61477
61478+#define PUD_SHIFT PGDIR_SHIFT
61479+#define PTRS_PER_PUD 1
61480+#define PUD_SIZE (_AC(1,UL) << PUD_SHIFT)
61481+#define PUD_MASK (~(PUD_SIZE-1))
61482+
61483+#ifndef __ASSEMBLY__
61484+
61485 /*
61486 * Having the pud type consist of a pgd gets the size right, and allows
61487 * us to conceptually access the pgd entry that this pud is folded into
61488@@ -12,11 +17,6 @@
61489 */
61490 typedef struct { pgd_t pgd; } pud_t;
61491
61492-#define PUD_SHIFT PGDIR_SHIFT
61493-#define PTRS_PER_PUD 1
61494-#define PUD_SIZE (1UL << PUD_SHIFT)
61495-#define PUD_MASK (~(PUD_SIZE-1))
61496-
61497 /*
61498 * The "pgd_xxx()" functions here are trivial for a folded two-level
61499 * setup: the pud is never bad, and a pud always exists (as it's folded
61500diff -urNp linux-2.6.39/include/asm-generic/vmlinux.lds.h linux-2.6.39/include/asm-generic/vmlinux.lds.h
61501--- linux-2.6.39/include/asm-generic/vmlinux.lds.h 2011-05-19 00:06:34.000000000 -0400
61502+++ linux-2.6.39/include/asm-generic/vmlinux.lds.h 2011-05-22 19:36:32.000000000 -0400
61503@@ -213,6 +213,7 @@
61504 .rodata : AT(ADDR(.rodata) - LOAD_OFFSET) { \
61505 VMLINUX_SYMBOL(__start_rodata) = .; \
61506 *(.rodata) *(.rodata.*) \
61507+ *(.data..read_only) \
61508 *(__vermagic) /* Kernel version magic */ \
61509 . = ALIGN(8); \
61510 VMLINUX_SYMBOL(__start___tracepoints_ptrs) = .; \
61511@@ -707,14 +708,15 @@
61512 * section in the linker script will go there too. @phdr should have
61513 * a leading colon.
61514 *
61515- * Note that this macros defines __per_cpu_load as an absolute symbol.
61516+ * Note that this macros defines per_cpu_load as an absolute symbol.
61517 * If there is no need to put the percpu section at a predetermined
61518 * address, use PERCPU().
61519 */
61520 #define PERCPU_VADDR(cacheline, vaddr, phdr) \
61521- VMLINUX_SYMBOL(__per_cpu_load) = .; \
61522- .data..percpu vaddr : AT(VMLINUX_SYMBOL(__per_cpu_load) \
61523+ per_cpu_load = .; \
61524+ .data..percpu vaddr : AT(VMLINUX_SYMBOL(per_cpu_load) \
61525 - LOAD_OFFSET) { \
61526+ VMLINUX_SYMBOL(__per_cpu_load) = . + per_cpu_load; \
61527 VMLINUX_SYMBOL(__per_cpu_start) = .; \
61528 *(.data..percpu..first) \
61529 . = ALIGN(PAGE_SIZE); \
61530@@ -726,7 +728,7 @@
61531 *(.data..percpu..shared_aligned) \
61532 VMLINUX_SYMBOL(__per_cpu_end) = .; \
61533 } phdr \
61534- . = VMLINUX_SYMBOL(__per_cpu_load) + SIZEOF(.data..percpu);
61535+ . = VMLINUX_SYMBOL(per_cpu_load) + SIZEOF(.data..percpu);
61536
61537 /**
61538 * PERCPU - define output section for percpu area, simple version
61539diff -urNp linux-2.6.39/include/drm/drmP.h linux-2.6.39/include/drm/drmP.h
61540--- linux-2.6.39/include/drm/drmP.h 2011-05-19 00:06:34.000000000 -0400
61541+++ linux-2.6.39/include/drm/drmP.h 2011-05-22 19:41:42.000000000 -0400
61542@@ -73,6 +73,7 @@
61543 #include <linux/workqueue.h>
61544 #include <linux/poll.h>
61545 #include <asm/pgalloc.h>
61546+#include <asm/local.h>
61547 #include "drm.h"
61548
61549 #include <linux/idr.h>
61550@@ -908,7 +909,7 @@ struct drm_driver {
61551 uint32_t handle);
61552
61553 /* Driver private ops for this object */
61554- struct vm_operations_struct *gem_vm_ops;
61555+ const struct vm_operations_struct *gem_vm_ops;
61556
61557 int major;
61558 int minor;
61559@@ -1023,7 +1024,7 @@ struct drm_device {
61560
61561 /** \name Usage Counters */
61562 /*@{ */
61563- int open_count; /**< Outstanding files open */
61564+ local_t open_count; /**< Outstanding files open */
61565 atomic_t ioctl_count; /**< Outstanding IOCTLs pending */
61566 atomic_t vma_count; /**< Outstanding vma areas open */
61567 int buf_use; /**< Buffers in use -- cannot alloc */
61568@@ -1034,7 +1035,7 @@ struct drm_device {
61569 /*@{ */
61570 unsigned long counters;
61571 enum drm_stat_type types[15];
61572- atomic_t counts[15];
61573+ atomic_unchecked_t counts[15];
61574 /*@} */
61575
61576 struct list_head filelist;
61577diff -urNp linux-2.6.39/include/linux/a.out.h linux-2.6.39/include/linux/a.out.h
61578--- linux-2.6.39/include/linux/a.out.h 2011-05-19 00:06:34.000000000 -0400
61579+++ linux-2.6.39/include/linux/a.out.h 2011-05-22 19:36:32.000000000 -0400
61580@@ -39,6 +39,14 @@ enum machine_type {
61581 M_MIPS2 = 152 /* MIPS R6000/R4000 binary */
61582 };
61583
61584+/* Constants for the N_FLAGS field */
61585+#define F_PAX_PAGEEXEC 1 /* Paging based non-executable pages */
61586+#define F_PAX_EMUTRAMP 2 /* Emulate trampolines */
61587+#define F_PAX_MPROTECT 4 /* Restrict mprotect() */
61588+#define F_PAX_RANDMMAP 8 /* Randomize mmap() base */
61589+/*#define F_PAX_RANDEXEC 16*/ /* Randomize ET_EXEC base */
61590+#define F_PAX_SEGMEXEC 32 /* Segmentation based non-executable pages */
61591+
61592 #if !defined (N_MAGIC)
61593 #define N_MAGIC(exec) ((exec).a_info & 0xffff)
61594 #endif
61595diff -urNp linux-2.6.39/include/linux/atmdev.h linux-2.6.39/include/linux/atmdev.h
61596--- linux-2.6.39/include/linux/atmdev.h 2011-05-19 00:06:34.000000000 -0400
61597+++ linux-2.6.39/include/linux/atmdev.h 2011-05-22 19:36:32.000000000 -0400
61598@@ -237,7 +237,7 @@ struct compat_atm_iobuf {
61599 #endif
61600
61601 struct k_atm_aal_stats {
61602-#define __HANDLE_ITEM(i) atomic_t i
61603+#define __HANDLE_ITEM(i) atomic_unchecked_t i
61604 __AAL_STAT_ITEMS
61605 #undef __HANDLE_ITEM
61606 };
61607diff -urNp linux-2.6.39/include/linux/binfmts.h linux-2.6.39/include/linux/binfmts.h
61608--- linux-2.6.39/include/linux/binfmts.h 2011-05-19 00:06:34.000000000 -0400
61609+++ linux-2.6.39/include/linux/binfmts.h 2011-05-22 19:36:32.000000000 -0400
61610@@ -92,6 +92,7 @@ struct linux_binfmt {
61611 int (*load_binary)(struct linux_binprm *, struct pt_regs * regs);
61612 int (*load_shlib)(struct file *);
61613 int (*core_dump)(struct coredump_params *cprm);
61614+ void (*handle_mprotect)(struct vm_area_struct *vma, unsigned long newflags);
61615 unsigned long min_coredump; /* minimal dump size */
61616 };
61617
61618diff -urNp linux-2.6.39/include/linux/blkdev.h linux-2.6.39/include/linux/blkdev.h
61619--- linux-2.6.39/include/linux/blkdev.h 2011-05-19 00:06:34.000000000 -0400
61620+++ linux-2.6.39/include/linux/blkdev.h 2011-05-22 19:36:32.000000000 -0400
61621@@ -1281,22 +1281,22 @@ queue_max_integrity_segments(struct requ
61622 #endif /* CONFIG_BLK_DEV_INTEGRITY */
61623
61624 struct block_device_operations {
61625- int (*open) (struct block_device *, fmode_t);
61626- int (*release) (struct gendisk *, fmode_t);
61627- int (*ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
61628- int (*compat_ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
61629- int (*direct_access) (struct block_device *, sector_t,
61630+ int (* const open) (struct block_device *, fmode_t);
61631+ int (* const release) (struct gendisk *, fmode_t);
61632+ int (* const ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
61633+ int (* const compat_ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
61634+ int (* const direct_access) (struct block_device *, sector_t,
61635 void **, unsigned long *);
61636- unsigned int (*check_events) (struct gendisk *disk,
61637+ unsigned int (* const check_events) (struct gendisk *disk,
61638 unsigned int clearing);
61639 /* ->media_changed() is DEPRECATED, use ->check_events() instead */
61640- int (*media_changed) (struct gendisk *);
61641- void (*unlock_native_capacity) (struct gendisk *);
61642- int (*revalidate_disk) (struct gendisk *);
61643- int (*getgeo)(struct block_device *, struct hd_geometry *);
61644+ int (* const media_changed) (struct gendisk *);
61645+ void (* const unlock_native_capacity) (struct gendisk *);
61646+ int (* const revalidate_disk) (struct gendisk *);
61647+ int (* const getgeo)(struct block_device *, struct hd_geometry *);
61648 /* this callback is with swap_lock and sometimes page table lock held */
61649- void (*swap_slot_free_notify) (struct block_device *, unsigned long);
61650- struct module *owner;
61651+ void (* const swap_slot_free_notify) (struct block_device *, unsigned long);
61652+ struct module * const owner;
61653 };
61654
61655 extern int __blkdev_driver_ioctl(struct block_device *, fmode_t, unsigned int,
61656diff -urNp linux-2.6.39/include/linux/blktrace_api.h linux-2.6.39/include/linux/blktrace_api.h
61657--- linux-2.6.39/include/linux/blktrace_api.h 2011-05-19 00:06:34.000000000 -0400
61658+++ linux-2.6.39/include/linux/blktrace_api.h 2011-05-22 19:36:32.000000000 -0400
61659@@ -161,7 +161,7 @@ struct blk_trace {
61660 struct dentry *dir;
61661 struct dentry *dropped_file;
61662 struct dentry *msg_file;
61663- atomic_t dropped;
61664+ atomic_unchecked_t dropped;
61665 };
61666
61667 extern int blk_trace_ioctl(struct block_device *, unsigned, char __user *);
61668diff -urNp linux-2.6.39/include/linux/byteorder/little_endian.h linux-2.6.39/include/linux/byteorder/little_endian.h
61669--- linux-2.6.39/include/linux/byteorder/little_endian.h 2011-05-19 00:06:34.000000000 -0400
61670+++ linux-2.6.39/include/linux/byteorder/little_endian.h 2011-05-22 19:36:32.000000000 -0400
61671@@ -42,51 +42,51 @@
61672
61673 static inline __le64 __cpu_to_le64p(const __u64 *p)
61674 {
61675- return (__force __le64)*p;
61676+ return (__force const __le64)*p;
61677 }
61678 static inline __u64 __le64_to_cpup(const __le64 *p)
61679 {
61680- return (__force __u64)*p;
61681+ return (__force const __u64)*p;
61682 }
61683 static inline __le32 __cpu_to_le32p(const __u32 *p)
61684 {
61685- return (__force __le32)*p;
61686+ return (__force const __le32)*p;
61687 }
61688 static inline __u32 __le32_to_cpup(const __le32 *p)
61689 {
61690- return (__force __u32)*p;
61691+ return (__force const __u32)*p;
61692 }
61693 static inline __le16 __cpu_to_le16p(const __u16 *p)
61694 {
61695- return (__force __le16)*p;
61696+ return (__force const __le16)*p;
61697 }
61698 static inline __u16 __le16_to_cpup(const __le16 *p)
61699 {
61700- return (__force __u16)*p;
61701+ return (__force const __u16)*p;
61702 }
61703 static inline __be64 __cpu_to_be64p(const __u64 *p)
61704 {
61705- return (__force __be64)__swab64p(p);
61706+ return (__force const __be64)__swab64p(p);
61707 }
61708 static inline __u64 __be64_to_cpup(const __be64 *p)
61709 {
61710- return __swab64p((__u64 *)p);
61711+ return __swab64p((const __u64 *)p);
61712 }
61713 static inline __be32 __cpu_to_be32p(const __u32 *p)
61714 {
61715- return (__force __be32)__swab32p(p);
61716+ return (__force const __be32)__swab32p(p);
61717 }
61718 static inline __u32 __be32_to_cpup(const __be32 *p)
61719 {
61720- return __swab32p((__u32 *)p);
61721+ return __swab32p((const __u32 *)p);
61722 }
61723 static inline __be16 __cpu_to_be16p(const __u16 *p)
61724 {
61725- return (__force __be16)__swab16p(p);
61726+ return (__force const __be16)__swab16p(p);
61727 }
61728 static inline __u16 __be16_to_cpup(const __be16 *p)
61729 {
61730- return __swab16p((__u16 *)p);
61731+ return __swab16p((const __u16 *)p);
61732 }
61733 #define __cpu_to_le64s(x) do { (void)(x); } while (0)
61734 #define __le64_to_cpus(x) do { (void)(x); } while (0)
61735diff -urNp linux-2.6.39/include/linux/cache.h linux-2.6.39/include/linux/cache.h
61736--- linux-2.6.39/include/linux/cache.h 2011-05-19 00:06:34.000000000 -0400
61737+++ linux-2.6.39/include/linux/cache.h 2011-05-22 19:36:32.000000000 -0400
61738@@ -16,6 +16,10 @@
61739 #define __read_mostly
61740 #endif
61741
61742+#ifndef __read_only
61743+#define __read_only __read_mostly
61744+#endif
61745+
61746 #ifndef ____cacheline_aligned
61747 #define ____cacheline_aligned __attribute__((__aligned__(SMP_CACHE_BYTES)))
61748 #endif
61749diff -urNp linux-2.6.39/include/linux/capability.h linux-2.6.39/include/linux/capability.h
61750--- linux-2.6.39/include/linux/capability.h 2011-05-19 00:06:34.000000000 -0400
61751+++ linux-2.6.39/include/linux/capability.h 2011-05-22 21:02:47.000000000 -0400
61752@@ -547,6 +547,9 @@ extern bool capable(int cap);
61753 extern bool ns_capable(struct user_namespace *ns, int cap);
61754 extern bool task_ns_capable(struct task_struct *t, int cap);
61755 extern bool nsown_capable(int cap);
61756+extern bool task_ns_capable_nolog(struct task_struct *t, int cap);
61757+extern bool ns_capable_nolog(struct user_namespace *ns, int cap);
61758+extern bool capable_nolog(int cap);
61759
61760 /* audit system wants to get cap info from files as well */
61761 extern int get_vfs_caps_from_disk(const struct dentry *dentry, struct cpu_vfs_cap_data *cpu_caps);
61762diff -urNp linux-2.6.39/include/linux/compiler-gcc4.h linux-2.6.39/include/linux/compiler-gcc4.h
61763--- linux-2.6.39/include/linux/compiler-gcc4.h 2011-05-19 00:06:34.000000000 -0400
61764+++ linux-2.6.39/include/linux/compiler-gcc4.h 2011-05-22 19:36:32.000000000 -0400
61765@@ -46,6 +46,11 @@
61766 #define __noclone __attribute__((__noclone__))
61767
61768 #endif
61769+
61770+#define __alloc_size(...) __attribute((alloc_size(__VA_ARGS__)))
61771+#define __bos(ptr, arg) __builtin_object_size((ptr), (arg))
61772+#define __bos0(ptr) __bos((ptr), 0)
61773+#define __bos1(ptr) __bos((ptr), 1)
61774 #endif
61775
61776 #if __GNUC_MINOR__ > 0
61777diff -urNp linux-2.6.39/include/linux/compiler.h linux-2.6.39/include/linux/compiler.h
61778--- linux-2.6.39/include/linux/compiler.h 2011-05-19 00:06:34.000000000 -0400
61779+++ linux-2.6.39/include/linux/compiler.h 2011-05-22 19:36:32.000000000 -0400
61780@@ -273,6 +273,22 @@ void ftrace_likely_update(struct ftrace_
61781 #define __cold
61782 #endif
61783
61784+#ifndef __alloc_size
61785+#define __alloc_size
61786+#endif
61787+
61788+#ifndef __bos
61789+#define __bos
61790+#endif
61791+
61792+#ifndef __bos0
61793+#define __bos0
61794+#endif
61795+
61796+#ifndef __bos1
61797+#define __bos1
61798+#endif
61799+
61800 /* Simple shorthand for a section definition */
61801 #ifndef __section
61802 # define __section(S) __attribute__ ((__section__(#S)))
61803@@ -306,6 +322,7 @@ void ftrace_likely_update(struct ftrace_
61804 * use is to mediate communication between process-level code and irq/NMI
61805 * handlers, all running on the same CPU.
61806 */
61807-#define ACCESS_ONCE(x) (*(volatile typeof(x) *)&(x))
61808+#define ACCESS_ONCE(x) (*(volatile const typeof(x) *)&(x))
61809+#define ACCESS_ONCE_RW(x) (*(volatile typeof(x) *)&(x))
61810
61811 #endif /* __LINUX_COMPILER_H */
61812diff -urNp linux-2.6.39/include/linux/concap.h linux-2.6.39/include/linux/concap.h
61813--- linux-2.6.39/include/linux/concap.h 2011-05-19 00:06:34.000000000 -0400
61814+++ linux-2.6.39/include/linux/concap.h 2011-05-22 19:36:32.000000000 -0400
61815@@ -30,7 +30,7 @@ struct concap_device_ops;
61816 struct concap_proto{
61817 struct net_device *net_dev; /* net device using our service */
61818 struct concap_device_ops *dops; /* callbacks provided by device */
61819- struct concap_proto_ops *pops; /* callbacks provided by us */
61820+ const struct concap_proto_ops *pops; /* callbacks provided by us */
61821 spinlock_t lock;
61822 int flags;
61823 void *proto_data; /* protocol specific private data, to
61824diff -urNp linux-2.6.39/include/linux/configfs.h linux-2.6.39/include/linux/configfs.h
61825--- linux-2.6.39/include/linux/configfs.h 2011-05-19 00:06:34.000000000 -0400
61826+++ linux-2.6.39/include/linux/configfs.h 2011-05-22 19:36:32.000000000 -0400
61827@@ -82,7 +82,7 @@ extern void config_item_put(struct confi
61828 struct config_item_type {
61829 struct module *ct_owner;
61830 struct configfs_item_operations *ct_item_ops;
61831- struct configfs_group_operations *ct_group_ops;
61832+ const struct configfs_group_operations *ct_group_ops;
61833 struct configfs_attribute **ct_attrs;
61834 };
61835
61836diff -urNp linux-2.6.39/include/linux/cpuset.h linux-2.6.39/include/linux/cpuset.h
61837--- linux-2.6.39/include/linux/cpuset.h 2011-05-19 00:06:34.000000000 -0400
61838+++ linux-2.6.39/include/linux/cpuset.h 2011-05-22 19:36:32.000000000 -0400
61839@@ -118,7 +118,7 @@ static inline void put_mems_allowed(void
61840 * nodemask.
61841 */
61842 smp_mb();
61843- --ACCESS_ONCE(current->mems_allowed_change_disable);
61844+ --ACCESS_ONCE_RW(current->mems_allowed_change_disable);
61845 }
61846
61847 static inline void set_mems_allowed(nodemask_t nodemask)
61848diff -urNp linux-2.6.39/include/linux/dca.h linux-2.6.39/include/linux/dca.h
61849--- linux-2.6.39/include/linux/dca.h 2011-05-19 00:06:34.000000000 -0400
61850+++ linux-2.6.39/include/linux/dca.h 2011-05-22 19:36:32.000000000 -0400
61851@@ -34,7 +34,7 @@ void dca_unregister_notify(struct notifi
61852
61853 struct dca_provider {
61854 struct list_head node;
61855- struct dca_ops *ops;
61856+ const struct dca_ops *ops;
61857 struct device *cd;
61858 int id;
61859 };
61860@@ -53,7 +53,7 @@ struct dca_ops {
61861 int (*dev_managed) (struct dca_provider *, struct device *);
61862 };
61863
61864-struct dca_provider *alloc_dca_provider(struct dca_ops *ops, int priv_size);
61865+struct dca_provider *alloc_dca_provider(const struct dca_ops *ops, int priv_size);
61866 void free_dca_provider(struct dca_provider *dca);
61867 int register_dca_provider(struct dca_provider *dca, struct device *dev);
61868 void unregister_dca_provider(struct dca_provider *dca, struct device *dev);
61869diff -urNp linux-2.6.39/include/linux/decompress/mm.h linux-2.6.39/include/linux/decompress/mm.h
61870--- linux-2.6.39/include/linux/decompress/mm.h 2011-05-19 00:06:34.000000000 -0400
61871+++ linux-2.6.39/include/linux/decompress/mm.h 2011-05-22 19:36:33.000000000 -0400
61872@@ -77,7 +77,7 @@ static void free(void *where)
61873 * warnings when not needed (indeed large_malloc / large_free are not
61874 * needed by inflate */
61875
61876-#define malloc(a) kmalloc(a, GFP_KERNEL)
61877+#define malloc(a) kmalloc((a), GFP_KERNEL)
61878 #define free(a) kfree(a)
61879
61880 #define large_malloc(a) vmalloc(a)
61881diff -urNp linux-2.6.39/include/linux/dma-mapping.h linux-2.6.39/include/linux/dma-mapping.h
61882--- linux-2.6.39/include/linux/dma-mapping.h 2011-05-19 00:06:34.000000000 -0400
61883+++ linux-2.6.39/include/linux/dma-mapping.h 2011-05-22 19:36:33.000000000 -0400
61884@@ -16,40 +16,40 @@ enum dma_data_direction {
61885 };
61886
61887 struct dma_map_ops {
61888- void* (*alloc_coherent)(struct device *dev, size_t size,
61889+ void* (* const alloc_coherent)(struct device *dev, size_t size,
61890 dma_addr_t *dma_handle, gfp_t gfp);
61891- void (*free_coherent)(struct device *dev, size_t size,
61892+ void (* const free_coherent)(struct device *dev, size_t size,
61893 void *vaddr, dma_addr_t dma_handle);
61894- dma_addr_t (*map_page)(struct device *dev, struct page *page,
61895+ dma_addr_t (* const map_page)(struct device *dev, struct page *page,
61896 unsigned long offset, size_t size,
61897 enum dma_data_direction dir,
61898 struct dma_attrs *attrs);
61899- void (*unmap_page)(struct device *dev, dma_addr_t dma_handle,
61900+ void (* const unmap_page)(struct device *dev, dma_addr_t dma_handle,
61901 size_t size, enum dma_data_direction dir,
61902 struct dma_attrs *attrs);
61903- int (*map_sg)(struct device *dev, struct scatterlist *sg,
61904+ int (* const map_sg)(struct device *dev, struct scatterlist *sg,
61905 int nents, enum dma_data_direction dir,
61906 struct dma_attrs *attrs);
61907- void (*unmap_sg)(struct device *dev,
61908+ void (* const unmap_sg)(struct device *dev,
61909 struct scatterlist *sg, int nents,
61910 enum dma_data_direction dir,
61911 struct dma_attrs *attrs);
61912- void (*sync_single_for_cpu)(struct device *dev,
61913+ void (* const sync_single_for_cpu)(struct device *dev,
61914 dma_addr_t dma_handle, size_t size,
61915 enum dma_data_direction dir);
61916- void (*sync_single_for_device)(struct device *dev,
61917+ void (* const sync_single_for_device)(struct device *dev,
61918 dma_addr_t dma_handle, size_t size,
61919 enum dma_data_direction dir);
61920- void (*sync_sg_for_cpu)(struct device *dev,
61921+ void (* const sync_sg_for_cpu)(struct device *dev,
61922 struct scatterlist *sg, int nents,
61923 enum dma_data_direction dir);
61924- void (*sync_sg_for_device)(struct device *dev,
61925+ void (* const sync_sg_for_device)(struct device *dev,
61926 struct scatterlist *sg, int nents,
61927 enum dma_data_direction dir);
61928- int (*mapping_error)(struct device *dev, dma_addr_t dma_addr);
61929- int (*dma_supported)(struct device *dev, u64 mask);
61930- int (*set_dma_mask)(struct device *dev, u64 mask);
61931- int is_phys;
61932+ int (* const mapping_error)(struct device *dev, dma_addr_t dma_addr);
61933+ int (* const dma_supported)(struct device *dev, u64 mask);
61934+ int (* set_dma_mask)(struct device *dev, u64 mask);
61935+ const int is_phys;
61936 };
61937
61938 #define DMA_BIT_MASK(n) (((n) == 64) ? ~0ULL : ((1ULL<<(n))-1))
61939diff -urNp linux-2.6.39/include/linux/elf.h linux-2.6.39/include/linux/elf.h
61940--- linux-2.6.39/include/linux/elf.h 2011-05-19 00:06:34.000000000 -0400
61941+++ linux-2.6.39/include/linux/elf.h 2011-05-22 19:36:33.000000000 -0400
61942@@ -49,6 +49,17 @@ typedef __s64 Elf64_Sxword;
61943 #define PT_GNU_EH_FRAME 0x6474e550
61944
61945 #define PT_GNU_STACK (PT_LOOS + 0x474e551)
61946+#define PT_GNU_RELRO (PT_LOOS + 0x474e552)
61947+
61948+#define PT_PAX_FLAGS (PT_LOOS + 0x5041580)
61949+
61950+/* Constants for the e_flags field */
61951+#define EF_PAX_PAGEEXEC 1 /* Paging based non-executable pages */
61952+#define EF_PAX_EMUTRAMP 2 /* Emulate trampolines */
61953+#define EF_PAX_MPROTECT 4 /* Restrict mprotect() */
61954+#define EF_PAX_RANDMMAP 8 /* Randomize mmap() base */
61955+/*#define EF_PAX_RANDEXEC 16*/ /* Randomize ET_EXEC base */
61956+#define EF_PAX_SEGMEXEC 32 /* Segmentation based non-executable pages */
61957
61958 /*
61959 * Extended Numbering
61960@@ -106,6 +117,8 @@ typedef __s64 Elf64_Sxword;
61961 #define DT_DEBUG 21
61962 #define DT_TEXTREL 22
61963 #define DT_JMPREL 23
61964+#define DT_FLAGS 30
61965+ #define DF_TEXTREL 0x00000004
61966 #define DT_ENCODING 32
61967 #define OLD_DT_LOOS 0x60000000
61968 #define DT_LOOS 0x6000000d
61969@@ -252,6 +265,19 @@ typedef struct elf64_hdr {
61970 #define PF_W 0x2
61971 #define PF_X 0x1
61972
61973+#define PF_PAGEEXEC (1U << 4) /* Enable PAGEEXEC */
61974+#define PF_NOPAGEEXEC (1U << 5) /* Disable PAGEEXEC */
61975+#define PF_SEGMEXEC (1U << 6) /* Enable SEGMEXEC */
61976+#define PF_NOSEGMEXEC (1U << 7) /* Disable SEGMEXEC */
61977+#define PF_MPROTECT (1U << 8) /* Enable MPROTECT */
61978+#define PF_NOMPROTECT (1U << 9) /* Disable MPROTECT */
61979+/*#define PF_RANDEXEC (1U << 10)*/ /* Enable RANDEXEC */
61980+/*#define PF_NORANDEXEC (1U << 11)*/ /* Disable RANDEXEC */
61981+#define PF_EMUTRAMP (1U << 12) /* Enable EMUTRAMP */
61982+#define PF_NOEMUTRAMP (1U << 13) /* Disable EMUTRAMP */
61983+#define PF_RANDMMAP (1U << 14) /* Enable RANDMMAP */
61984+#define PF_NORANDMMAP (1U << 15) /* Disable RANDMMAP */
61985+
61986 typedef struct elf32_phdr{
61987 Elf32_Word p_type;
61988 Elf32_Off p_offset;
61989@@ -344,6 +370,8 @@ typedef struct elf64_shdr {
61990 #define EI_OSABI 7
61991 #define EI_PAD 8
61992
61993+#define EI_PAX 14
61994+
61995 #define ELFMAG0 0x7f /* EI_MAG */
61996 #define ELFMAG1 'E'
61997 #define ELFMAG2 'L'
61998@@ -421,6 +449,7 @@ extern Elf32_Dyn _DYNAMIC [];
61999 #define elf_note elf32_note
62000 #define elf_addr_t Elf32_Off
62001 #define Elf_Half Elf32_Half
62002+#define elf_dyn Elf32_Dyn
62003
62004 #else
62005
62006@@ -431,6 +460,7 @@ extern Elf64_Dyn _DYNAMIC [];
62007 #define elf_note elf64_note
62008 #define elf_addr_t Elf64_Off
62009 #define Elf_Half Elf64_Half
62010+#define elf_dyn Elf64_Dyn
62011
62012 #endif
62013
62014diff -urNp linux-2.6.39/include/linux/enclosure.h linux-2.6.39/include/linux/enclosure.h
62015--- linux-2.6.39/include/linux/enclosure.h 2011-05-19 00:06:34.000000000 -0400
62016+++ linux-2.6.39/include/linux/enclosure.h 2011-05-22 19:36:33.000000000 -0400
62017@@ -98,7 +98,7 @@ struct enclosure_device {
62018 void *scratch;
62019 struct list_head node;
62020 struct device edev;
62021- struct enclosure_component_callbacks *cb;
62022+ const struct enclosure_component_callbacks *cb;
62023 int components;
62024 struct enclosure_component component[0];
62025 };
62026diff -urNp linux-2.6.39/include/linux/fscache-cache.h linux-2.6.39/include/linux/fscache-cache.h
62027--- linux-2.6.39/include/linux/fscache-cache.h 2011-05-19 00:06:34.000000000 -0400
62028+++ linux-2.6.39/include/linux/fscache-cache.h 2011-05-22 19:36:33.000000000 -0400
62029@@ -113,7 +113,7 @@ struct fscache_operation {
62030 #endif
62031 };
62032
62033-extern atomic_t fscache_op_debug_id;
62034+extern atomic_unchecked_t fscache_op_debug_id;
62035 extern void fscache_op_work_func(struct work_struct *work);
62036
62037 extern void fscache_enqueue_operation(struct fscache_operation *);
62038@@ -133,7 +133,7 @@ static inline void fscache_operation_ini
62039 {
62040 INIT_WORK(&op->work, fscache_op_work_func);
62041 atomic_set(&op->usage, 1);
62042- op->debug_id = atomic_inc_return(&fscache_op_debug_id);
62043+ op->debug_id = atomic_inc_return_unchecked(&fscache_op_debug_id);
62044 op->processor = processor;
62045 op->release = release;
62046 INIT_LIST_HEAD(&op->pend_link);
62047diff -urNp linux-2.6.39/include/linux/fs.h linux-2.6.39/include/linux/fs.h
62048--- linux-2.6.39/include/linux/fs.h 2011-05-19 00:06:34.000000000 -0400
62049+++ linux-2.6.39/include/linux/fs.h 2011-05-22 19:41:42.000000000 -0400
62050@@ -108,6 +108,11 @@ struct inodes_stat_t {
62051 /* File was opened by fanotify and shouldn't generate fanotify events */
62052 #define FMODE_NONOTIFY ((__force fmode_t)0x1000000)
62053
62054+/* Hack for grsec so as not to require read permission simply to execute
62055+ * a binary
62056+ */
62057+#define FMODE_GREXEC ((__force fmode_t)0x2000000)
62058+
62059 /*
62060 * The below are the various read and write types that we support. Some of
62061 * them include behavioral modifiers that send information down to the
62062@@ -575,41 +580,41 @@ typedef int (*read_actor_t)(read_descrip
62063 unsigned long, unsigned long);
62064
62065 struct address_space_operations {
62066- int (*writepage)(struct page *page, struct writeback_control *wbc);
62067- int (*readpage)(struct file *, struct page *);
62068+ int (* const writepage)(struct page *page, struct writeback_control *wbc);
62069+ int (* const readpage)(struct file *, struct page *);
62070
62071 /* Write back some dirty pages from this mapping. */
62072- int (*writepages)(struct address_space *, struct writeback_control *);
62073+ int (* const writepages)(struct address_space *, struct writeback_control *);
62074
62075 /* Set a page dirty. Return true if this dirtied it */
62076- int (*set_page_dirty)(struct page *page);
62077+ int (* const set_page_dirty)(struct page *page);
62078
62079- int (*readpages)(struct file *filp, struct address_space *mapping,
62080+ int (* const readpages)(struct file *filp, struct address_space *mapping,
62081 struct list_head *pages, unsigned nr_pages);
62082
62083- int (*write_begin)(struct file *, struct address_space *mapping,
62084+ int (* const write_begin)(struct file *, struct address_space *mapping,
62085 loff_t pos, unsigned len, unsigned flags,
62086 struct page **pagep, void **fsdata);
62087- int (*write_end)(struct file *, struct address_space *mapping,
62088+ int (* const write_end)(struct file *, struct address_space *mapping,
62089 loff_t pos, unsigned len, unsigned copied,
62090 struct page *page, void *fsdata);
62091
62092 /* Unfortunately this kludge is needed for FIBMAP. Don't use it */
62093- sector_t (*bmap)(struct address_space *, sector_t);
62094- void (*invalidatepage) (struct page *, unsigned long);
62095- int (*releasepage) (struct page *, gfp_t);
62096- void (*freepage)(struct page *);
62097- ssize_t (*direct_IO)(int, struct kiocb *, const struct iovec *iov,
62098+ sector_t (* const bmap)(struct address_space *, sector_t);
62099+ void (* const invalidatepage) (struct page *, unsigned long);
62100+ int (* const releasepage) (struct page *, gfp_t);
62101+ void (* const freepage)(struct page *);
62102+ ssize_t (* const direct_IO)(int, struct kiocb *, const struct iovec *iov,
62103 loff_t offset, unsigned long nr_segs);
62104- int (*get_xip_mem)(struct address_space *, pgoff_t, int,
62105+ int (* const get_xip_mem)(struct address_space *, pgoff_t, int,
62106 void **, unsigned long *);
62107 /* migrate the contents of a page to the specified target */
62108- int (*migratepage) (struct address_space *,
62109+ int (* const migratepage) (struct address_space *,
62110 struct page *, struct page *);
62111- int (*launder_page) (struct page *);
62112- int (*is_partially_uptodate) (struct page *, read_descriptor_t *,
62113+ int (* const launder_page) (struct page *);
62114+ int (* const is_partially_uptodate) (struct page *, read_descriptor_t *,
62115 unsigned long);
62116- int (*error_remove_page)(struct address_space *, struct page *);
62117+ int (* const error_remove_page)(struct address_space *, struct page *);
62118 };
62119
62120 extern const struct address_space_operations empty_aops;
62121@@ -1060,17 +1065,17 @@ static inline int file_check_writeable(s
62122 typedef struct files_struct *fl_owner_t;
62123
62124 struct file_lock_operations {
62125- void (*fl_copy_lock)(struct file_lock *, struct file_lock *);
62126- void (*fl_release_private)(struct file_lock *);
62127+ void (* const fl_copy_lock)(struct file_lock *, struct file_lock *);
62128+ void (* const fl_release_private)(struct file_lock *);
62129 };
62130
62131 struct lock_manager_operations {
62132- int (*fl_compare_owner)(struct file_lock *, struct file_lock *);
62133- void (*fl_notify)(struct file_lock *); /* unblock callback */
62134- int (*fl_grant)(struct file_lock *, struct file_lock *, int);
62135- void (*fl_release_private)(struct file_lock *);
62136- void (*fl_break)(struct file_lock *);
62137- int (*fl_change)(struct file_lock **, int);
62138+ int (* const fl_compare_owner)(struct file_lock *, struct file_lock *);
62139+ void (* const fl_notify)(struct file_lock *); /* unblock callback */
62140+ int (* const fl_grant)(struct file_lock *, struct file_lock *, int);
62141+ void (* const fl_release_private)(struct file_lock *);
62142+ void (* const fl_break)(struct file_lock *);
62143+ int (* const fl_change)(struct file_lock **, int);
62144 };
62145
62146 struct lock_manager {
62147@@ -1611,31 +1616,31 @@ extern ssize_t vfs_writev(struct file *,
62148 unsigned long, loff_t *);
62149
62150 struct super_operations {
62151- struct inode *(*alloc_inode)(struct super_block *sb);
62152- void (*destroy_inode)(struct inode *);
62153+ struct inode *(* const alloc_inode)(struct super_block *sb);
62154+ void (* const destroy_inode)(struct inode *);
62155
62156- void (*dirty_inode) (struct inode *);
62157- int (*write_inode) (struct inode *, struct writeback_control *wbc);
62158- int (*drop_inode) (struct inode *);
62159- void (*evict_inode) (struct inode *);
62160- void (*put_super) (struct super_block *);
62161- void (*write_super) (struct super_block *);
62162- int (*sync_fs)(struct super_block *sb, int wait);
62163- int (*freeze_fs) (struct super_block *);
62164- int (*unfreeze_fs) (struct super_block *);
62165- int (*statfs) (struct dentry *, struct kstatfs *);
62166- int (*remount_fs) (struct super_block *, int *, char *);
62167- void (*umount_begin) (struct super_block *);
62168-
62169- int (*show_options)(struct seq_file *, struct vfsmount *);
62170- int (*show_devname)(struct seq_file *, struct vfsmount *);
62171- int (*show_path)(struct seq_file *, struct vfsmount *);
62172- int (*show_stats)(struct seq_file *, struct vfsmount *);
62173+ void (* const dirty_inode) (struct inode *);
62174+ int (* const write_inode) (struct inode *, struct writeback_control *wbc);
62175+ int (* const drop_inode) (struct inode *);
62176+ void (* const evict_inode) (struct inode *);
62177+ void (* const put_super) (struct super_block *);
62178+ void (* const write_super) (struct super_block *);
62179+ int (* const sync_fs)(struct super_block *sb, int wait);
62180+ int (* const freeze_fs) (struct super_block *);
62181+ int (* const unfreeze_fs) (struct super_block *);
62182+ int (* const statfs) (struct dentry *, struct kstatfs *);
62183+ int (* const remount_fs) (struct super_block *, int *, char *);
62184+ void (* const umount_begin) (struct super_block *);
62185+
62186+ int (* const show_options)(struct seq_file *, struct vfsmount *);
62187+ int (* const show_devname)(struct seq_file *, struct vfsmount *);
62188+ int (* const show_path)(struct seq_file *, struct vfsmount *);
62189+ int (* const show_stats)(struct seq_file *, struct vfsmount *);
62190 #ifdef CONFIG_QUOTA
62191- ssize_t (*quota_read)(struct super_block *, int, char *, size_t, loff_t);
62192- ssize_t (*quota_write)(struct super_block *, int, const char *, size_t, loff_t);
62193+ ssize_t (* const quota_read)(struct super_block *, int, char *, size_t, loff_t);
62194+ ssize_t (* const quota_write)(struct super_block *, int, const char *, size_t, loff_t);
62195 #endif
62196- int (*bdev_try_to_free_page)(struct super_block*, struct page*, gfp_t);
62197+ int (* const bdev_try_to_free_page)(struct super_block*, struct page*, gfp_t);
62198 };
62199
62200 /*
62201diff -urNp linux-2.6.39/include/linux/fs_struct.h linux-2.6.39/include/linux/fs_struct.h
62202--- linux-2.6.39/include/linux/fs_struct.h 2011-05-19 00:06:34.000000000 -0400
62203+++ linux-2.6.39/include/linux/fs_struct.h 2011-05-22 19:36:33.000000000 -0400
62204@@ -6,7 +6,7 @@
62205 #include <linux/seqlock.h>
62206
62207 struct fs_struct {
62208- int users;
62209+ atomic_t users;
62210 spinlock_t lock;
62211 seqcount_t seq;
62212 int umask;
62213diff -urNp linux-2.6.39/include/linux/ftrace_event.h linux-2.6.39/include/linux/ftrace_event.h
62214--- linux-2.6.39/include/linux/ftrace_event.h 2011-05-19 00:06:34.000000000 -0400
62215+++ linux-2.6.39/include/linux/ftrace_event.h 2011-05-22 19:36:33.000000000 -0400
62216@@ -235,7 +235,7 @@ extern int trace_define_field(struct ftr
62217 extern int trace_add_event_call(struct ftrace_event_call *call);
62218 extern void trace_remove_event_call(struct ftrace_event_call *call);
62219
62220-#define is_signed_type(type) (((type)(-1)) < 0)
62221+#define is_signed_type(type) (((type)(-1)) < (type)1)
62222
62223 int trace_set_clr_event(const char *system, const char *event, int set);
62224
62225diff -urNp linux-2.6.39/include/linux/ftrace.h linux-2.6.39/include/linux/ftrace.h
62226--- linux-2.6.39/include/linux/ftrace.h 2011-05-19 00:06:34.000000000 -0400
62227+++ linux-2.6.39/include/linux/ftrace.h 2011-05-22 19:36:33.000000000 -0400
62228@@ -140,7 +140,7 @@ extern void
62229 unregister_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops,
62230 void *data);
62231 extern void
62232-unregister_ftrace_function_probe_func(char *glob, struct ftrace_probe_ops *ops);
62233+unregister_ftrace_function_probe_func(char *glob, const struct ftrace_probe_ops *ops);
62234 extern void unregister_ftrace_function_probe_all(char *glob);
62235
62236 extern int ftrace_text_reserved(void *start, void *end);
62237diff -urNp linux-2.6.39/include/linux/genhd.h linux-2.6.39/include/linux/genhd.h
62238--- linux-2.6.39/include/linux/genhd.h 2011-05-19 00:06:34.000000000 -0400
62239+++ linux-2.6.39/include/linux/genhd.h 2011-05-22 19:36:33.000000000 -0400
62240@@ -183,7 +183,7 @@ struct gendisk {
62241 struct kobject *slave_dir;
62242
62243 struct timer_rand_state *random;
62244- atomic_t sync_io; /* RAID */
62245+ atomic_unchecked_t sync_io; /* RAID */
62246 struct disk_events *ev;
62247 #ifdef CONFIG_BLK_DEV_INTEGRITY
62248 struct blk_integrity *integrity;
62249diff -urNp linux-2.6.39/include/linux/gracl.h linux-2.6.39/include/linux/gracl.h
62250--- linux-2.6.39/include/linux/gracl.h 1969-12-31 19:00:00.000000000 -0500
62251+++ linux-2.6.39/include/linux/gracl.h 2011-05-22 19:41:42.000000000 -0400
62252@@ -0,0 +1,317 @@
62253+#ifndef GR_ACL_H
62254+#define GR_ACL_H
62255+
62256+#include <linux/grdefs.h>
62257+#include <linux/resource.h>
62258+#include <linux/capability.h>
62259+#include <linux/dcache.h>
62260+#include <asm/resource.h>
62261+
62262+/* Major status information */
62263+
62264+#define GR_VERSION "grsecurity 2.2.2"
62265+#define GRSECURITY_VERSION 0x2202
62266+
62267+enum {
62268+ GR_SHUTDOWN = 0,
62269+ GR_ENABLE = 1,
62270+ GR_SPROLE = 2,
62271+ GR_RELOAD = 3,
62272+ GR_SEGVMOD = 4,
62273+ GR_STATUS = 5,
62274+ GR_UNSPROLE = 6,
62275+ GR_PASSSET = 7,
62276+ GR_SPROLEPAM = 8,
62277+};
62278+
62279+/* Password setup definitions
62280+ * kernel/grhash.c */
62281+enum {
62282+ GR_PW_LEN = 128,
62283+ GR_SALT_LEN = 16,
62284+ GR_SHA_LEN = 32,
62285+};
62286+
62287+enum {
62288+ GR_SPROLE_LEN = 64,
62289+};
62290+
62291+enum {
62292+ GR_NO_GLOB = 0,
62293+ GR_REG_GLOB,
62294+ GR_CREATE_GLOB
62295+};
62296+
62297+#define GR_NLIMITS 32
62298+
62299+/* Begin Data Structures */
62300+
62301+struct sprole_pw {
62302+ unsigned char *rolename;
62303+ unsigned char salt[GR_SALT_LEN];
62304+ unsigned char sum[GR_SHA_LEN]; /* 256-bit SHA hash of the password */
62305+};
62306+
62307+struct name_entry {
62308+ __u32 key;
62309+ ino_t inode;
62310+ dev_t device;
62311+ char *name;
62312+ __u16 len;
62313+ __u8 deleted;
62314+ struct name_entry *prev;
62315+ struct name_entry *next;
62316+};
62317+
62318+struct inodev_entry {
62319+ struct name_entry *nentry;
62320+ struct inodev_entry *prev;
62321+ struct inodev_entry *next;
62322+};
62323+
62324+struct acl_role_db {
62325+ struct acl_role_label **r_hash;
62326+ __u32 r_size;
62327+};
62328+
62329+struct inodev_db {
62330+ struct inodev_entry **i_hash;
62331+ __u32 i_size;
62332+};
62333+
62334+struct name_db {
62335+ struct name_entry **n_hash;
62336+ __u32 n_size;
62337+};
62338+
62339+struct crash_uid {
62340+ uid_t uid;
62341+ unsigned long expires;
62342+};
62343+
62344+struct gr_hash_struct {
62345+ void **table;
62346+ void **nametable;
62347+ void *first;
62348+ __u32 table_size;
62349+ __u32 used_size;
62350+ int type;
62351+};
62352+
62353+/* Userspace Grsecurity ACL data structures */
62354+
62355+struct acl_subject_label {
62356+ char *filename;
62357+ ino_t inode;
62358+ dev_t device;
62359+ __u32 mode;
62360+ kernel_cap_t cap_mask;
62361+ kernel_cap_t cap_lower;
62362+ kernel_cap_t cap_invert_audit;
62363+
62364+ struct rlimit res[GR_NLIMITS];
62365+ __u32 resmask;
62366+
62367+ __u8 user_trans_type;
62368+ __u8 group_trans_type;
62369+ uid_t *user_transitions;
62370+ gid_t *group_transitions;
62371+ __u16 user_trans_num;
62372+ __u16 group_trans_num;
62373+
62374+ __u32 sock_families[2];
62375+ __u32 ip_proto[8];
62376+ __u32 ip_type;
62377+ struct acl_ip_label **ips;
62378+ __u32 ip_num;
62379+ __u32 inaddr_any_override;
62380+
62381+ __u32 crashes;
62382+ unsigned long expires;
62383+
62384+ struct acl_subject_label *parent_subject;
62385+ struct gr_hash_struct *hash;
62386+ struct acl_subject_label *prev;
62387+ struct acl_subject_label *next;
62388+
62389+ struct acl_object_label **obj_hash;
62390+ __u32 obj_hash_size;
62391+ __u16 pax_flags;
62392+};
62393+
62394+struct role_allowed_ip {
62395+ __u32 addr;
62396+ __u32 netmask;
62397+
62398+ struct role_allowed_ip *prev;
62399+ struct role_allowed_ip *next;
62400+};
62401+
62402+struct role_transition {
62403+ char *rolename;
62404+
62405+ struct role_transition *prev;
62406+ struct role_transition *next;
62407+};
62408+
62409+struct acl_role_label {
62410+ char *rolename;
62411+ uid_t uidgid;
62412+ __u16 roletype;
62413+
62414+ __u16 auth_attempts;
62415+ unsigned long expires;
62416+
62417+ struct acl_subject_label *root_label;
62418+ struct gr_hash_struct *hash;
62419+
62420+ struct acl_role_label *prev;
62421+ struct acl_role_label *next;
62422+
62423+ struct role_transition *transitions;
62424+ struct role_allowed_ip *allowed_ips;
62425+ uid_t *domain_children;
62426+ __u16 domain_child_num;
62427+
62428+ struct acl_subject_label **subj_hash;
62429+ __u32 subj_hash_size;
62430+};
62431+
62432+struct user_acl_role_db {
62433+ struct acl_role_label **r_table;
62434+ __u32 num_pointers; /* Number of allocations to track */
62435+ __u32 num_roles; /* Number of roles */
62436+ __u32 num_domain_children; /* Number of domain children */
62437+ __u32 num_subjects; /* Number of subjects */
62438+ __u32 num_objects; /* Number of objects */
62439+};
62440+
62441+struct acl_object_label {
62442+ char *filename;
62443+ ino_t inode;
62444+ dev_t device;
62445+ __u32 mode;
62446+
62447+ struct acl_subject_label *nested;
62448+ struct acl_object_label *globbed;
62449+
62450+ /* next two structures not used */
62451+
62452+ struct acl_object_label *prev;
62453+ struct acl_object_label *next;
62454+};
62455+
62456+struct acl_ip_label {
62457+ char *iface;
62458+ __u32 addr;
62459+ __u32 netmask;
62460+ __u16 low, high;
62461+ __u8 mode;
62462+ __u32 type;
62463+ __u32 proto[8];
62464+
62465+ /* next two structures not used */
62466+
62467+ struct acl_ip_label *prev;
62468+ struct acl_ip_label *next;
62469+};
62470+
62471+struct gr_arg {
62472+ struct user_acl_role_db role_db;
62473+ unsigned char pw[GR_PW_LEN];
62474+ unsigned char salt[GR_SALT_LEN];
62475+ unsigned char sum[GR_SHA_LEN];
62476+ unsigned char sp_role[GR_SPROLE_LEN];
62477+ struct sprole_pw *sprole_pws;
62478+ dev_t segv_device;
62479+ ino_t segv_inode;
62480+ uid_t segv_uid;
62481+ __u16 num_sprole_pws;
62482+ __u16 mode;
62483+};
62484+
62485+struct gr_arg_wrapper {
62486+ struct gr_arg *arg;
62487+ __u32 version;
62488+ __u32 size;
62489+};
62490+
62491+struct subject_map {
62492+ struct acl_subject_label *user;
62493+ struct acl_subject_label *kernel;
62494+ struct subject_map *prev;
62495+ struct subject_map *next;
62496+};
62497+
62498+struct acl_subj_map_db {
62499+ struct subject_map **s_hash;
62500+ __u32 s_size;
62501+};
62502+
62503+/* End Data Structures Section */
62504+
62505+/* Hash functions generated by empirical testing by Brad Spengler
62506+ Makes good use of the low bits of the inode. Generally 0-1 times
62507+ in loop for successful match. 0-3 for unsuccessful match.
62508+ Shift/add algorithm with modulus of table size and an XOR*/
62509+
62510+static __inline__ unsigned int
62511+rhash(const uid_t uid, const __u16 type, const unsigned int sz)
62512+{
62513+ return ((((uid + type) << (16 + type)) ^ uid) % sz);
62514+}
62515+
62516+ static __inline__ unsigned int
62517+shash(const struct acl_subject_label *userp, const unsigned int sz)
62518+{
62519+ return ((const unsigned long)userp % sz);
62520+}
62521+
62522+static __inline__ unsigned int
62523+fhash(const ino_t ino, const dev_t dev, const unsigned int sz)
62524+{
62525+ return (((ino + dev) ^ ((ino << 13) + (ino << 23) + (dev << 9))) % sz);
62526+}
62527+
62528+static __inline__ unsigned int
62529+nhash(const char *name, const __u16 len, const unsigned int sz)
62530+{
62531+ return full_name_hash((const unsigned char *)name, len) % sz;
62532+}
62533+
62534+#define FOR_EACH_ROLE_START(role) \
62535+ role = role_list; \
62536+ while (role) {
62537+
62538+#define FOR_EACH_ROLE_END(role) \
62539+ role = role->prev; \
62540+ }
62541+
62542+#define FOR_EACH_SUBJECT_START(role,subj,iter) \
62543+ subj = NULL; \
62544+ iter = 0; \
62545+ while (iter < role->subj_hash_size) { \
62546+ if (subj == NULL) \
62547+ subj = role->subj_hash[iter]; \
62548+ if (subj == NULL) { \
62549+ iter++; \
62550+ continue; \
62551+ }
62552+
62553+#define FOR_EACH_SUBJECT_END(subj,iter) \
62554+ subj = subj->next; \
62555+ if (subj == NULL) \
62556+ iter++; \
62557+ }
62558+
62559+
62560+#define FOR_EACH_NESTED_SUBJECT_START(role,subj) \
62561+ subj = role->hash->first; \
62562+ while (subj != NULL) {
62563+
62564+#define FOR_EACH_NESTED_SUBJECT_END(subj) \
62565+ subj = subj->next; \
62566+ }
62567+
62568+#endif
62569+
62570diff -urNp linux-2.6.39/include/linux/gralloc.h linux-2.6.39/include/linux/gralloc.h
62571--- linux-2.6.39/include/linux/gralloc.h 1969-12-31 19:00:00.000000000 -0500
62572+++ linux-2.6.39/include/linux/gralloc.h 2011-05-22 19:41:42.000000000 -0400
62573@@ -0,0 +1,9 @@
62574+#ifndef __GRALLOC_H
62575+#define __GRALLOC_H
62576+
62577+void acl_free_all(void);
62578+int acl_alloc_stack_init(unsigned long size);
62579+void *acl_alloc(unsigned long len);
62580+void *acl_alloc_num(unsigned long num, unsigned long len);
62581+
62582+#endif
62583diff -urNp linux-2.6.39/include/linux/grdefs.h linux-2.6.39/include/linux/grdefs.h
62584--- linux-2.6.39/include/linux/grdefs.h 1969-12-31 19:00:00.000000000 -0500
62585+++ linux-2.6.39/include/linux/grdefs.h 2011-05-22 19:41:42.000000000 -0400
62586@@ -0,0 +1,139 @@
62587+#ifndef GRDEFS_H
62588+#define GRDEFS_H
62589+
62590+/* Begin grsecurity status declarations */
62591+
62592+enum {
62593+ GR_READY = 0x01,
62594+ GR_STATUS_INIT = 0x00 // disabled state
62595+};
62596+
62597+/* Begin ACL declarations */
62598+
62599+/* Role flags */
62600+
62601+enum {
62602+ GR_ROLE_USER = 0x0001,
62603+ GR_ROLE_GROUP = 0x0002,
62604+ GR_ROLE_DEFAULT = 0x0004,
62605+ GR_ROLE_SPECIAL = 0x0008,
62606+ GR_ROLE_AUTH = 0x0010,
62607+ GR_ROLE_NOPW = 0x0020,
62608+ GR_ROLE_GOD = 0x0040,
62609+ GR_ROLE_LEARN = 0x0080,
62610+ GR_ROLE_TPE = 0x0100,
62611+ GR_ROLE_DOMAIN = 0x0200,
62612+ GR_ROLE_PAM = 0x0400,
62613+ GR_ROLE_PERSIST = 0x0800
62614+};
62615+
62616+/* ACL Subject and Object mode flags */
62617+enum {
62618+ GR_DELETED = 0x80000000
62619+};
62620+
62621+/* ACL Object-only mode flags */
62622+enum {
62623+ GR_READ = 0x00000001,
62624+ GR_APPEND = 0x00000002,
62625+ GR_WRITE = 0x00000004,
62626+ GR_EXEC = 0x00000008,
62627+ GR_FIND = 0x00000010,
62628+ GR_INHERIT = 0x00000020,
62629+ GR_SETID = 0x00000040,
62630+ GR_CREATE = 0x00000080,
62631+ GR_DELETE = 0x00000100,
62632+ GR_LINK = 0x00000200,
62633+ GR_AUDIT_READ = 0x00000400,
62634+ GR_AUDIT_APPEND = 0x00000800,
62635+ GR_AUDIT_WRITE = 0x00001000,
62636+ GR_AUDIT_EXEC = 0x00002000,
62637+ GR_AUDIT_FIND = 0x00004000,
62638+ GR_AUDIT_INHERIT= 0x00008000,
62639+ GR_AUDIT_SETID = 0x00010000,
62640+ GR_AUDIT_CREATE = 0x00020000,
62641+ GR_AUDIT_DELETE = 0x00040000,
62642+ GR_AUDIT_LINK = 0x00080000,
62643+ GR_PTRACERD = 0x00100000,
62644+ GR_NOPTRACE = 0x00200000,
62645+ GR_SUPPRESS = 0x00400000,
62646+ GR_NOLEARN = 0x00800000,
62647+ GR_INIT_TRANSFER= 0x01000000
62648+};
62649+
62650+#define GR_AUDITS (GR_AUDIT_READ | GR_AUDIT_WRITE | GR_AUDIT_APPEND | GR_AUDIT_EXEC | \
62651+ GR_AUDIT_FIND | GR_AUDIT_INHERIT | GR_AUDIT_SETID | \
62652+ GR_AUDIT_CREATE | GR_AUDIT_DELETE | GR_AUDIT_LINK)
62653+
62654+/* ACL subject-only mode flags */
62655+enum {
62656+ GR_KILL = 0x00000001,
62657+ GR_VIEW = 0x00000002,
62658+ GR_PROTECTED = 0x00000004,
62659+ GR_LEARN = 0x00000008,
62660+ GR_OVERRIDE = 0x00000010,
62661+ /* just a placeholder, this mode is only used in userspace */
62662+ GR_DUMMY = 0x00000020,
62663+ GR_PROTSHM = 0x00000040,
62664+ GR_KILLPROC = 0x00000080,
62665+ GR_KILLIPPROC = 0x00000100,
62666+ /* just a placeholder, this mode is only used in userspace */
62667+ GR_NOTROJAN = 0x00000200,
62668+ GR_PROTPROCFD = 0x00000400,
62669+ GR_PROCACCT = 0x00000800,
62670+ GR_RELAXPTRACE = 0x00001000,
62671+ GR_NESTED = 0x00002000,
62672+ GR_INHERITLEARN = 0x00004000,
62673+ GR_PROCFIND = 0x00008000,
62674+ GR_POVERRIDE = 0x00010000,
62675+ GR_KERNELAUTH = 0x00020000,
62676+ GR_ATSECURE = 0x00040000
62677+};
62678+
62679+enum {
62680+ GR_PAX_ENABLE_SEGMEXEC = 0x0001,
62681+ GR_PAX_ENABLE_PAGEEXEC = 0x0002,
62682+ GR_PAX_ENABLE_MPROTECT = 0x0004,
62683+ GR_PAX_ENABLE_RANDMMAP = 0x0008,
62684+ GR_PAX_ENABLE_EMUTRAMP = 0x0010,
62685+ GR_PAX_DISABLE_SEGMEXEC = 0x0100,
62686+ GR_PAX_DISABLE_PAGEEXEC = 0x0200,
62687+ GR_PAX_DISABLE_MPROTECT = 0x0400,
62688+ GR_PAX_DISABLE_RANDMMAP = 0x0800,
62689+ GR_PAX_DISABLE_EMUTRAMP = 0x1000,
62690+};
62691+
62692+enum {
62693+ GR_ID_USER = 0x01,
62694+ GR_ID_GROUP = 0x02,
62695+};
62696+
62697+enum {
62698+ GR_ID_ALLOW = 0x01,
62699+ GR_ID_DENY = 0x02,
62700+};
62701+
62702+#define GR_CRASH_RES 31
62703+#define GR_UIDTABLE_MAX 500
62704+
62705+/* begin resource learning section */
62706+enum {
62707+ GR_RLIM_CPU_BUMP = 60,
62708+ GR_RLIM_FSIZE_BUMP = 50000,
62709+ GR_RLIM_DATA_BUMP = 10000,
62710+ GR_RLIM_STACK_BUMP = 1000,
62711+ GR_RLIM_CORE_BUMP = 10000,
62712+ GR_RLIM_RSS_BUMP = 500000,
62713+ GR_RLIM_NPROC_BUMP = 1,
62714+ GR_RLIM_NOFILE_BUMP = 5,
62715+ GR_RLIM_MEMLOCK_BUMP = 50000,
62716+ GR_RLIM_AS_BUMP = 500000,
62717+ GR_RLIM_LOCKS_BUMP = 2,
62718+ GR_RLIM_SIGPENDING_BUMP = 5,
62719+ GR_RLIM_MSGQUEUE_BUMP = 10000,
62720+ GR_RLIM_NICE_BUMP = 1,
62721+ GR_RLIM_RTPRIO_BUMP = 1,
62722+ GR_RLIM_RTTIME_BUMP = 1000000
62723+};
62724+
62725+#endif
62726diff -urNp linux-2.6.39/include/linux/grinternal.h linux-2.6.39/include/linux/grinternal.h
62727--- linux-2.6.39/include/linux/grinternal.h 1969-12-31 19:00:00.000000000 -0500
62728+++ linux-2.6.39/include/linux/grinternal.h 2011-05-22 19:41:42.000000000 -0400
62729@@ -0,0 +1,219 @@
62730+#ifndef __GRINTERNAL_H
62731+#define __GRINTERNAL_H
62732+
62733+#ifdef CONFIG_GRKERNSEC
62734+
62735+#include <linux/fs.h>
62736+#include <linux/mnt_namespace.h>
62737+#include <linux/nsproxy.h>
62738+#include <linux/gracl.h>
62739+#include <linux/grdefs.h>
62740+#include <linux/grmsg.h>
62741+
62742+void gr_add_learn_entry(const char *fmt, ...)
62743+ __attribute__ ((format (printf, 1, 2)));
62744+__u32 gr_search_file(const struct dentry *dentry, const __u32 mode,
62745+ const struct vfsmount *mnt);
62746+__u32 gr_check_create(const struct dentry *new_dentry,
62747+ const struct dentry *parent,
62748+ const struct vfsmount *mnt, const __u32 mode);
62749+int gr_check_protected_task(const struct task_struct *task);
62750+__u32 to_gr_audit(const __u32 reqmode);
62751+int gr_set_acls(const int type);
62752+int gr_apply_subject_to_task(struct task_struct *task);
62753+int gr_acl_is_enabled(void);
62754+char gr_roletype_to_char(void);
62755+
62756+void gr_handle_alertkill(struct task_struct *task);
62757+char *gr_to_filename(const struct dentry *dentry,
62758+ const struct vfsmount *mnt);
62759+char *gr_to_filename1(const struct dentry *dentry,
62760+ const struct vfsmount *mnt);
62761+char *gr_to_filename2(const struct dentry *dentry,
62762+ const struct vfsmount *mnt);
62763+char *gr_to_filename3(const struct dentry *dentry,
62764+ const struct vfsmount *mnt);
62765+
62766+extern int grsec_enable_harden_ptrace;
62767+extern int grsec_enable_link;
62768+extern int grsec_enable_fifo;
62769+extern int grsec_enable_execve;
62770+extern int grsec_enable_shm;
62771+extern int grsec_enable_execlog;
62772+extern int grsec_enable_signal;
62773+extern int grsec_enable_audit_ptrace;
62774+extern int grsec_enable_forkfail;
62775+extern int grsec_enable_time;
62776+extern int grsec_enable_rofs;
62777+extern int grsec_enable_chroot_shmat;
62778+extern int grsec_enable_chroot_findtask;
62779+extern int grsec_enable_chroot_mount;
62780+extern int grsec_enable_chroot_double;
62781+extern int grsec_enable_chroot_pivot;
62782+extern int grsec_enable_chroot_chdir;
62783+extern int grsec_enable_chroot_chmod;
62784+extern int grsec_enable_chroot_mknod;
62785+extern int grsec_enable_chroot_fchdir;
62786+extern int grsec_enable_chroot_nice;
62787+extern int grsec_enable_chroot_execlog;
62788+extern int grsec_enable_chroot_caps;
62789+extern int grsec_enable_chroot_sysctl;
62790+extern int grsec_enable_chroot_unix;
62791+extern int grsec_enable_tpe;
62792+extern int grsec_tpe_gid;
62793+extern int grsec_enable_tpe_all;
62794+extern int grsec_enable_tpe_invert;
62795+extern int grsec_enable_socket_all;
62796+extern int grsec_socket_all_gid;
62797+extern int grsec_enable_socket_client;
62798+extern int grsec_socket_client_gid;
62799+extern int grsec_enable_socket_server;
62800+extern int grsec_socket_server_gid;
62801+extern int grsec_audit_gid;
62802+extern int grsec_enable_group;
62803+extern int grsec_enable_audit_textrel;
62804+extern int grsec_enable_log_rwxmaps;
62805+extern int grsec_enable_mount;
62806+extern int grsec_enable_chdir;
62807+extern int grsec_resource_logging;
62808+extern int grsec_enable_blackhole;
62809+extern int grsec_lastack_retries;
62810+extern int grsec_lock;
62811+
62812+extern spinlock_t grsec_alert_lock;
62813+extern unsigned long grsec_alert_wtime;
62814+extern unsigned long grsec_alert_fyet;
62815+
62816+extern spinlock_t grsec_audit_lock;
62817+
62818+extern rwlock_t grsec_exec_file_lock;
62819+
62820+#define gr_task_fullpath(tsk) ((tsk)->exec_file ? \
62821+ gr_to_filename2((tsk)->exec_file->f_path.dentry, \
62822+ (tsk)->exec_file->f_vfsmnt) : "/")
62823+
62824+#define gr_parent_task_fullpath(tsk) ((tsk)->real_parent->exec_file ? \
62825+ gr_to_filename3((tsk)->real_parent->exec_file->f_path.dentry, \
62826+ (tsk)->real_parent->exec_file->f_vfsmnt) : "/")
62827+
62828+#define gr_task_fullpath0(tsk) ((tsk)->exec_file ? \
62829+ gr_to_filename((tsk)->exec_file->f_path.dentry, \
62830+ (tsk)->exec_file->f_vfsmnt) : "/")
62831+
62832+#define gr_parent_task_fullpath0(tsk) ((tsk)->real_parent->exec_file ? \
62833+ gr_to_filename1((tsk)->real_parent->exec_file->f_path.dentry, \
62834+ (tsk)->real_parent->exec_file->f_vfsmnt) : "/")
62835+
62836+#define proc_is_chrooted(tsk_a) ((tsk_a)->gr_is_chrooted)
62837+
62838+#define have_same_root(tsk_a,tsk_b) ((tsk_a)->gr_chroot_dentry == (tsk_b)->gr_chroot_dentry)
62839+
62840+#define DEFAULTSECARGS(task, cred, pcred) gr_task_fullpath(task), (task)->comm, \
62841+ (task)->pid, (cred)->uid, \
62842+ (cred)->euid, (cred)->gid, (cred)->egid, \
62843+ gr_parent_task_fullpath(task), \
62844+ (task)->real_parent->comm, (task)->real_parent->pid, \
62845+ (pcred)->uid, (pcred)->euid, \
62846+ (pcred)->gid, (pcred)->egid
62847+
62848+#define GR_CHROOT_CAPS {{ \
62849+ CAP_TO_MASK(CAP_LINUX_IMMUTABLE) | CAP_TO_MASK(CAP_NET_ADMIN) | \
62850+ CAP_TO_MASK(CAP_SYS_MODULE) | CAP_TO_MASK(CAP_SYS_RAWIO) | \
62851+ CAP_TO_MASK(CAP_SYS_PACCT) | CAP_TO_MASK(CAP_SYS_ADMIN) | \
62852+ CAP_TO_MASK(CAP_SYS_BOOT) | CAP_TO_MASK(CAP_SYS_TIME) | \
62853+ CAP_TO_MASK(CAP_NET_RAW) | CAP_TO_MASK(CAP_SYS_TTY_CONFIG) | \
62854+ CAP_TO_MASK(CAP_IPC_OWNER) , 0 }}
62855+
62856+#define security_learn(normal_msg,args...) \
62857+({ \
62858+ read_lock(&grsec_exec_file_lock); \
62859+ gr_add_learn_entry(normal_msg "\n", ## args); \
62860+ read_unlock(&grsec_exec_file_lock); \
62861+})
62862+
62863+enum {
62864+ GR_DO_AUDIT,
62865+ GR_DONT_AUDIT,
62866+ /* used for non-audit messages that we shouldn't kill the task on */
62867+ GR_DONT_AUDIT_GOOD
62868+};
62869+
62870+enum {
62871+ GR_TTYSNIFF,
62872+ GR_RBAC,
62873+ GR_RBAC_STR,
62874+ GR_STR_RBAC,
62875+ GR_RBAC_MODE2,
62876+ GR_RBAC_MODE3,
62877+ GR_FILENAME,
62878+ GR_SYSCTL_HIDDEN,
62879+ GR_NOARGS,
62880+ GR_ONE_INT,
62881+ GR_ONE_INT_TWO_STR,
62882+ GR_ONE_STR,
62883+ GR_STR_INT,
62884+ GR_TWO_STR_INT,
62885+ GR_TWO_INT,
62886+ GR_TWO_U64,
62887+ GR_THREE_INT,
62888+ GR_FIVE_INT_TWO_STR,
62889+ GR_TWO_STR,
62890+ GR_THREE_STR,
62891+ GR_FOUR_STR,
62892+ GR_STR_FILENAME,
62893+ GR_FILENAME_STR,
62894+ GR_FILENAME_TWO_INT,
62895+ GR_FILENAME_TWO_INT_STR,
62896+ GR_TEXTREL,
62897+ GR_PTRACE,
62898+ GR_RESOURCE,
62899+ GR_CAP,
62900+ GR_SIG,
62901+ GR_SIG2,
62902+ GR_CRASH1,
62903+ GR_CRASH2,
62904+ GR_PSACCT,
62905+ GR_RWXMAP
62906+};
62907+
62908+#define gr_log_hidden_sysctl(audit, msg, str) gr_log_varargs(audit, msg, GR_SYSCTL_HIDDEN, str)
62909+#define gr_log_ttysniff(audit, msg, task) gr_log_varargs(audit, msg, GR_TTYSNIFF, task)
62910+#define gr_log_fs_rbac_generic(audit, msg, dentry, mnt) gr_log_varargs(audit, msg, GR_RBAC, dentry, mnt)
62911+#define gr_log_fs_rbac_str(audit, msg, dentry, mnt, str) gr_log_varargs(audit, msg, GR_RBAC_STR, dentry, mnt, str)
62912+#define gr_log_fs_str_rbac(audit, msg, str, dentry, mnt) gr_log_varargs(audit, msg, GR_STR_RBAC, str, dentry, mnt)
62913+#define gr_log_fs_rbac_mode2(audit, msg, dentry, mnt, str1, str2) gr_log_varargs(audit, msg, GR_RBAC_MODE2, dentry, mnt, str1, str2)
62914+#define gr_log_fs_rbac_mode3(audit, msg, dentry, mnt, str1, str2, str3) gr_log_varargs(audit, msg, GR_RBAC_MODE3, dentry, mnt, str1, str2, str3)
62915+#define gr_log_fs_generic(audit, msg, dentry, mnt) gr_log_varargs(audit, msg, GR_FILENAME, dentry, mnt)
62916+#define gr_log_noargs(audit, msg) gr_log_varargs(audit, msg, GR_NOARGS)
62917+#define gr_log_int(audit, msg, num) gr_log_varargs(audit, msg, GR_ONE_INT, num)
62918+#define gr_log_int_str2(audit, msg, num, str1, str2) gr_log_varargs(audit, msg, GR_ONE_INT_TWO_STR, num, str1, str2)
62919+#define gr_log_str(audit, msg, str) gr_log_varargs(audit, msg, GR_ONE_STR, str)
62920+#define gr_log_str_int(audit, msg, str, num) gr_log_varargs(audit, msg, GR_STR_INT, str, num)
62921+#define gr_log_int_int(audit, msg, num1, num2) gr_log_varargs(audit, msg, GR_TWO_INT, num1, num2)
62922+#define gr_log_two_u64(audit, msg, num1, num2) gr_log_varargs(audit, msg, GR_TWO_U64, num1, num2)
62923+#define gr_log_int3(audit, msg, num1, num2, num3) gr_log_varargs(audit, msg, GR_THREE_INT, num1, num2, num3)
62924+#define gr_log_int5_str2(audit, msg, num1, num2, str1, str2) gr_log_varargs(audit, msg, GR_FIVE_INT_TWO_STR, num1, num2, str1, str2)
62925+#define gr_log_str_str(audit, msg, str1, str2) gr_log_varargs(audit, msg, GR_TWO_STR, str1, str2)
62926+#define gr_log_str2_int(audit, msg, str1, str2, num) gr_log_varargs(audit, msg, GR_TWO_STR_INT, str1, str2, num)
62927+#define gr_log_str3(audit, msg, str1, str2, str3) gr_log_varargs(audit, msg, GR_THREE_STR, str1, str2, str3)
62928+#define gr_log_str4(audit, msg, str1, str2, str3, str4) gr_log_varargs(audit, msg, GR_FOUR_STR, str1, str2, str3, str4)
62929+#define gr_log_str_fs(audit, msg, str, dentry, mnt) gr_log_varargs(audit, msg, GR_STR_FILENAME, str, dentry, mnt)
62930+#define gr_log_fs_str(audit, msg, dentry, mnt, str) gr_log_varargs(audit, msg, GR_FILENAME_STR, dentry, mnt, str)
62931+#define gr_log_fs_int2(audit, msg, dentry, mnt, num1, num2) gr_log_varargs(audit, msg, GR_FILENAME_TWO_INT, dentry, mnt, num1, num2)
62932+#define gr_log_fs_int2_str(audit, msg, dentry, mnt, num1, num2, str) gr_log_varargs(audit, msg, GR_FILENAME_TWO_INT_STR, dentry, mnt, num1, num2, str)
62933+#define gr_log_textrel_ulong_ulong(audit, msg, file, ulong1, ulong2) gr_log_varargs(audit, msg, GR_TEXTREL, file, ulong1, ulong2)
62934+#define gr_log_ptrace(audit, msg, task) gr_log_varargs(audit, msg, GR_PTRACE, task)
62935+#define gr_log_res_ulong2_str(audit, msg, task, ulong1, str, ulong2) gr_log_varargs(audit, msg, GR_RESOURCE, task, ulong1, str, ulong2)
62936+#define gr_log_cap(audit, msg, task, str) gr_log_varargs(audit, msg, GR_CAP, task, str)
62937+#define gr_log_sig_addr(audit, msg, str, addr) gr_log_varargs(audit, msg, GR_SIG, str, addr)
62938+#define gr_log_sig_task(audit, msg, task, num) gr_log_varargs(audit, msg, GR_SIG2, task, num)
62939+#define gr_log_crash1(audit, msg, task, ulong) gr_log_varargs(audit, msg, GR_CRASH1, task, ulong)
62940+#define gr_log_crash2(audit, msg, task, ulong1) gr_log_varargs(audit, msg, GR_CRASH2, task, ulong1)
62941+#define gr_log_procacct(audit, msg, task, num1, num2, num3, num4, num5, num6, num7, num8, num9) gr_log_varargs(audit, msg, GR_PSACCT, task, num1, num2, num3, num4, num5, num6, num7, num8, num9)
62942+#define gr_log_rwxmap(audit, msg, str) gr_log_varargs(audit, msg, GR_RWXMAP, str)
62943+
62944+void gr_log_varargs(int audit, const char *msg, int argtypes, ...);
62945+
62946+#endif
62947+
62948+#endif
62949diff -urNp linux-2.6.39/include/linux/grmsg.h linux-2.6.39/include/linux/grmsg.h
62950--- linux-2.6.39/include/linux/grmsg.h 1969-12-31 19:00:00.000000000 -0500
62951+++ linux-2.6.39/include/linux/grmsg.h 2011-05-22 19:41:42.000000000 -0400
62952@@ -0,0 +1,108 @@
62953+#define DEFAULTSECMSG "%.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u, parent %.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u"
62954+#define GR_ACL_PROCACCT_MSG "%.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u run time:[%ud %uh %um %us] cpu time:[%ud %uh %um %us] %s with exit code %ld, parent %.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u"
62955+#define GR_PTRACE_ACL_MSG "denied ptrace of %.950s(%.16s:%d) by "
62956+#define GR_STOPMOD_MSG "denied modification of module state by "
62957+#define GR_ROFS_BLOCKWRITE_MSG "denied write to block device %.950s by "
62958+#define GR_ROFS_MOUNT_MSG "denied writable mount of %.950s by "
62959+#define GR_IOPERM_MSG "denied use of ioperm() by "
62960+#define GR_IOPL_MSG "denied use of iopl() by "
62961+#define GR_SHMAT_ACL_MSG "denied attach of shared memory of UID %u, PID %d, ID %u by "
62962+#define GR_UNIX_CHROOT_MSG "denied connect() to abstract AF_UNIX socket outside of chroot by "
62963+#define GR_SHMAT_CHROOT_MSG "denied attach of shared memory outside of chroot by "
62964+#define GR_MEM_READWRITE_MSG "denied access of range %Lx -> %Lx in /dev/mem by "
62965+#define GR_SYMLINK_MSG "not following symlink %.950s owned by %d.%d by "
62966+#define GR_LEARN_AUDIT_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%lu\t%lu\t%.4095s\t%lu\t%pI4"
62967+#define GR_ID_LEARN_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%c\t%d\t%d\t%d\t%pI4"
62968+#define GR_HIDDEN_ACL_MSG "%s access to hidden file %.950s by "
62969+#define GR_OPEN_ACL_MSG "%s open of %.950s for%s%s by "
62970+#define GR_CREATE_ACL_MSG "%s create of %.950s for%s%s by "
62971+#define GR_FIFO_MSG "denied writing FIFO %.950s of %d.%d by "
62972+#define GR_MKNOD_CHROOT_MSG "denied mknod of %.950s from chroot by "
62973+#define GR_MKNOD_ACL_MSG "%s mknod of %.950s by "
62974+#define GR_UNIXCONNECT_ACL_MSG "%s connect() to the unix domain socket %.950s by "
62975+#define GR_TTYSNIFF_ACL_MSG "terminal being sniffed by IP:%pI4 %.480s[%.16s:%d], parent %.480s[%.16s:%d] against "
62976+#define GR_MKDIR_ACL_MSG "%s mkdir of %.950s by "
62977+#define GR_RMDIR_ACL_MSG "%s rmdir of %.950s by "
62978+#define GR_UNLINK_ACL_MSG "%s unlink of %.950s by "
62979+#define GR_SYMLINK_ACL_MSG "%s symlink from %.480s to %.480s by "
62980+#define GR_HARDLINK_MSG "denied hardlink of %.930s (owned by %d.%d) to %.30s for "
62981+#define GR_LINK_ACL_MSG "%s link of %.480s to %.480s by "
62982+#define GR_INHERIT_ACL_MSG "successful inherit of %.480s's ACL for %.480s by "
62983+#define GR_RENAME_ACL_MSG "%s rename of %.480s to %.480s by "
62984+#define GR_UNSAFESHARE_EXEC_ACL_MSG "denied exec with cloned fs of %.950s by "
62985+#define GR_PTRACE_EXEC_ACL_MSG "denied ptrace of %.950s by "
62986+#define GR_NPROC_MSG "denied overstep of process limit by "
62987+#define GR_EXEC_ACL_MSG "%s execution of %.950s by "
62988+#define GR_EXEC_TPE_MSG "denied untrusted exec of %.950s by "
62989+#define GR_SEGVSTART_ACL_MSG "possible exploit bruteforcing on " DEFAULTSECMSG " banning uid %u from login for %lu seconds"
62990+#define GR_SEGVNOSUID_ACL_MSG "possible exploit bruteforcing on " DEFAULTSECMSG " banning execution for %lu seconds"
62991+#define GR_MOUNT_CHROOT_MSG "denied mount of %.256s as %.930s from chroot by "
62992+#define GR_PIVOT_CHROOT_MSG "denied pivot_root from chroot by "
62993+#define GR_TRUNCATE_ACL_MSG "%s truncate of %.950s by "
62994+#define GR_ATIME_ACL_MSG "%s access time change of %.950s by "
62995+#define GR_ACCESS_ACL_MSG "%s access of %.950s for%s%s%s by "
62996+#define GR_CHROOT_CHROOT_MSG "denied double chroot to %.950s by "
62997+#define GR_FCHMOD_ACL_MSG "%s fchmod of %.950s by "
62998+#define GR_CHMOD_CHROOT_MSG "denied chmod +s of %.950s by "
62999+#define GR_CHMOD_ACL_MSG "%s chmod of %.950s by "
63000+#define GR_CHROOT_FCHDIR_MSG "denied fchdir outside of chroot to %.950s by "
63001+#define GR_CHOWN_ACL_MSG "%s chown of %.950s by "
63002+#define GR_SETXATTR_ACL_MSG "%s setting extended attributes of %.950s by "
63003+#define GR_WRITLIB_ACL_MSG "denied load of writable library %.950s by "
63004+#define GR_INITF_ACL_MSG "init_variables() failed %s by "
63005+#define GR_DISABLED_ACL_MSG "Error loading %s, trying to run kernel with acls disabled. To disable acls at startup use <kernel image name> gracl=off from your boot loader"
63006+#define GR_DEV_ACL_MSG "/dev/grsec: %d bytes sent %d required, being fed garbaged by "
63007+#define GR_SHUTS_ACL_MSG "shutdown auth success for "
63008+#define GR_SHUTF_ACL_MSG "shutdown auth failure for "
63009+#define GR_SHUTI_ACL_MSG "ignoring shutdown for disabled RBAC system for "
63010+#define GR_SEGVMODS_ACL_MSG "segvmod auth success for "
63011+#define GR_SEGVMODF_ACL_MSG "segvmod auth failure for "
63012+#define GR_SEGVMODI_ACL_MSG "ignoring segvmod for disabled RBAC system for "
63013+#define GR_ENABLE_ACL_MSG "%s RBAC system loaded by "
63014+#define GR_ENABLEF_ACL_MSG "unable to load %s for "
63015+#define GR_RELOADI_ACL_MSG "ignoring reload request for disabled RBAC system"
63016+#define GR_RELOAD_ACL_MSG "%s RBAC system reloaded by "
63017+#define GR_RELOADF_ACL_MSG "failed reload of %s for "
63018+#define GR_SPROLEI_ACL_MSG "ignoring change to special role for disabled RBAC system for "
63019+#define GR_SPROLES_ACL_MSG "successful change to special role %s (id %d) by "
63020+#define GR_SPROLEL_ACL_MSG "special role %s (id %d) exited by "
63021+#define GR_SPROLEF_ACL_MSG "special role %s failure for "
63022+#define GR_UNSPROLEI_ACL_MSG "ignoring unauth of special role for disabled RBAC system for "
63023+#define GR_UNSPROLES_ACL_MSG "successful unauth of special role %s (id %d) by "
63024+#define GR_INVMODE_ACL_MSG "invalid mode %d by "
63025+#define GR_PRIORITY_CHROOT_MSG "denied priority change of process (%.16s:%d) by "
63026+#define GR_FAILFORK_MSG "failed fork with errno %s by "
63027+#define GR_NICE_CHROOT_MSG "denied priority change by "
63028+#define GR_UNISIGLOG_MSG "%.32s occurred at %p in "
63029+#define GR_DUALSIGLOG_MSG "signal %d sent to " DEFAULTSECMSG " by "
63030+#define GR_SIG_ACL_MSG "denied send of signal %d to protected task " DEFAULTSECMSG " by "
63031+#define GR_SYSCTL_MSG "denied modification of grsecurity sysctl value : %.32s by "
63032+#define GR_SYSCTL_ACL_MSG "%s sysctl of %.950s for%s%s by "
63033+#define GR_TIME_MSG "time set by "
63034+#define GR_DEFACL_MSG "fatal: unable to find subject for (%.16s:%d), loaded by "
63035+#define GR_MMAP_ACL_MSG "%s executable mmap of %.950s by "
63036+#define GR_MPROTECT_ACL_MSG "%s executable mprotect of %.950s by "
63037+#define GR_SOCK_MSG "denied socket(%.16s,%.16s,%.16s) by "
63038+#define GR_SOCK_NOINET_MSG "denied socket(%.16s,%.16s,%d) by "
63039+#define GR_BIND_MSG "denied bind() by "
63040+#define GR_CONNECT_MSG "denied connect() by "
63041+#define GR_BIND_ACL_MSG "denied bind() to %pI4 port %u sock type %.16s protocol %.16s by "
63042+#define GR_CONNECT_ACL_MSG "denied connect() to %pI4 port %u sock type %.16s protocol %.16s by "
63043+#define GR_IP_LEARN_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%pI4\t%u\t%u\t%u\t%u\t%pI4"
63044+#define GR_EXEC_CHROOT_MSG "exec of %.980s within chroot by process "
63045+#define GR_CAP_ACL_MSG "use of %s denied for "
63046+#define GR_CAP_ACL_MSG2 "use of %s permitted for "
63047+#define GR_USRCHANGE_ACL_MSG "change to uid %u denied for "
63048+#define GR_GRPCHANGE_ACL_MSG "change to gid %u denied for "
63049+#define GR_REMOUNT_AUDIT_MSG "remount of %.256s by "
63050+#define GR_UNMOUNT_AUDIT_MSG "unmount of %.256s by "
63051+#define GR_MOUNT_AUDIT_MSG "mount of %.256s to %.256s by "
63052+#define GR_CHDIR_AUDIT_MSG "chdir to %.980s by "
63053+#define GR_EXEC_AUDIT_MSG "exec of %.930s (%.128s) by "
63054+#define GR_RESOURCE_MSG "denied resource overstep by requesting %lu for %.16s against limit %lu for "
63055+#define GR_RWXMMAP_MSG "denied RWX mmap of %.950s by "
63056+#define GR_RWXMPROTECT_MSG "denied RWX mprotect of %.950s by "
63057+#define GR_TEXTREL_AUDIT_MSG "text relocation in %s, VMA:0x%08lx 0x%08lx by "
63058+#define GR_VM86_MSG "denied use of vm86 by "
63059+#define GR_PTRACE_AUDIT_MSG "process %.950s(%.16s:%d) attached to via ptrace by "
63060+#define GR_INIT_TRANSFER_MSG "persistent special role transferred privilege to init by "
63061diff -urNp linux-2.6.39/include/linux/grsecurity.h linux-2.6.39/include/linux/grsecurity.h
63062--- linux-2.6.39/include/linux/grsecurity.h 1969-12-31 19:00:00.000000000 -0500
63063+++ linux-2.6.39/include/linux/grsecurity.h 2011-05-22 19:41:42.000000000 -0400
63064@@ -0,0 +1,212 @@
63065+#ifndef GR_SECURITY_H
63066+#define GR_SECURITY_H
63067+#include <linux/fs.h>
63068+#include <linux/fs_struct.h>
63069+#include <linux/binfmts.h>
63070+#include <linux/gracl.h>
63071+#include <linux/compat.h>
63072+
63073+/* notify of brain-dead configs */
63074+#if defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_PAGEEXEC) && !defined(CONFIG_PAX_SEGMEXEC) && !defined(CONFIG_PAX_KERNEXEC)
63075+#error "CONFIG_PAX_NOEXEC enabled, but PAGEEXEC, SEGMEXEC, and KERNEXEC are disabled."
63076+#endif
63077+#if defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_EI_PAX) && !defined(CONFIG_PAX_PT_PAX_FLAGS)
63078+#error "CONFIG_PAX_NOEXEC enabled, but neither CONFIG_PAX_EI_PAX nor CONFIG_PAX_PT_PAX_FLAGS are enabled."
63079+#endif
63080+#if defined(CONFIG_PAX_ASLR) && (defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)) && !defined(CONFIG_PAX_EI_PAX) && !defined(CONFIG_PAX_PT_PAX_FLAGS)
63081+#error "CONFIG_PAX_ASLR enabled, but neither CONFIG_PAX_EI_PAX nor CONFIG_PAX_PT_PAX_FLAGS are enabled."
63082+#endif
63083+#if defined(CONFIG_PAX_ASLR) && !defined(CONFIG_PAX_RANDKSTACK) && !defined(CONFIG_PAX_RANDUSTACK) && !defined(CONFIG_PAX_RANDMMAP)
63084+#error "CONFIG_PAX_ASLR enabled, but RANDKSTACK, RANDUSTACK, and RANDMMAP are disabled."
63085+#endif
63086+#if defined(CONFIG_PAX) && !defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_ASLR)
63087+#error "CONFIG_PAX enabled, but no PaX options are enabled."
63088+#endif
63089+
63090+void gr_handle_brute_attach(struct task_struct *p, unsigned long mm_flags);
63091+void gr_handle_brute_check(void);
63092+void gr_handle_kernel_exploit(void);
63093+int gr_process_user_ban(void);
63094+
63095+char gr_roletype_to_char(void);
63096+
63097+int gr_acl_enable_at_secure(void);
63098+
63099+int gr_check_user_change(int real, int effective, int fs);
63100+int gr_check_group_change(int real, int effective, int fs);
63101+
63102+void gr_del_task_from_ip_table(struct task_struct *p);
63103+
63104+int gr_pid_is_chrooted(struct task_struct *p);
63105+int gr_handle_chroot_fowner(struct pid *pid, enum pid_type type);
63106+int gr_handle_chroot_nice(void);
63107+int gr_handle_chroot_sysctl(const int op);
63108+int gr_handle_chroot_setpriority(struct task_struct *p,
63109+ const int niceval);
63110+int gr_chroot_fchdir(struct dentry *u_dentry, struct vfsmount *u_mnt);
63111+int gr_handle_chroot_chroot(const struct dentry *dentry,
63112+ const struct vfsmount *mnt);
63113+int gr_handle_chroot_caps(struct path *path);
63114+void gr_handle_chroot_chdir(struct path *path);
63115+int gr_handle_chroot_chmod(const struct dentry *dentry,
63116+ const struct vfsmount *mnt, const int mode);
63117+int gr_handle_chroot_mknod(const struct dentry *dentry,
63118+ const struct vfsmount *mnt, const int mode);
63119+int gr_handle_chroot_mount(const struct dentry *dentry,
63120+ const struct vfsmount *mnt,
63121+ const char *dev_name);
63122+int gr_handle_chroot_pivot(void);
63123+int gr_handle_chroot_unix(struct pid *pid);
63124+
63125+int gr_handle_rawio(const struct inode *inode);
63126+int gr_handle_nproc(void);
63127+
63128+void gr_handle_ioperm(void);
63129+void gr_handle_iopl(void);
63130+
63131+int gr_tpe_allow(const struct file *file);
63132+
63133+void gr_set_chroot_entries(struct task_struct *task, struct path *path);
63134+void gr_clear_chroot_entries(struct task_struct *task);
63135+
63136+void gr_log_forkfail(const int retval);
63137+void gr_log_timechange(void);
63138+void gr_log_signal(const int sig, const void *addr, const struct task_struct *t);
63139+void gr_log_chdir(const struct dentry *dentry,
63140+ const struct vfsmount *mnt);
63141+void gr_log_chroot_exec(const struct dentry *dentry,
63142+ const struct vfsmount *mnt);
63143+void gr_handle_exec_args(struct linux_binprm *bprm, const char __user *const __user *argv);
63144+#ifdef CONFIG_COMPAT
63145+void gr_handle_exec_args_compat(struct linux_binprm *bprm, compat_uptr_t __user *argv);
63146+#endif
63147+void gr_log_remount(const char *devname, const int retval);
63148+void gr_log_unmount(const char *devname, const int retval);
63149+void gr_log_mount(const char *from, const char *to, const int retval);
63150+void gr_log_textrel(struct vm_area_struct *vma);
63151+void gr_log_rwxmmap(struct file *file);
63152+void gr_log_rwxmprotect(struct file *file);
63153+
63154+int gr_handle_follow_link(const struct inode *parent,
63155+ const struct inode *inode,
63156+ const struct dentry *dentry,
63157+ const struct vfsmount *mnt);
63158+int gr_handle_fifo(const struct dentry *dentry,
63159+ const struct vfsmount *mnt,
63160+ const struct dentry *dir, const int flag,
63161+ const int acc_mode);
63162+int gr_handle_hardlink(const struct dentry *dentry,
63163+ const struct vfsmount *mnt,
63164+ struct inode *inode,
63165+ const int mode, const char *to);
63166+
63167+int gr_is_capable(const int cap);
63168+int gr_is_capable_nolog(const int cap);
63169+void gr_learn_resource(const struct task_struct *task, const int limit,
63170+ const unsigned long wanted, const int gt);
63171+void gr_copy_label(struct task_struct *tsk);
63172+void gr_handle_crash(struct task_struct *task, const int sig);
63173+int gr_handle_signal(const struct task_struct *p, const int sig);
63174+int gr_check_crash_uid(const uid_t uid);
63175+int gr_check_protected_task(const struct task_struct *task);
63176+int gr_check_protected_task_fowner(struct pid *pid, enum pid_type type);
63177+int gr_acl_handle_mmap(const struct file *file,
63178+ const unsigned long prot);
63179+int gr_acl_handle_mprotect(const struct file *file,
63180+ const unsigned long prot);
63181+int gr_check_hidden_task(const struct task_struct *tsk);
63182+__u32 gr_acl_handle_truncate(const struct dentry *dentry,
63183+ const struct vfsmount *mnt);
63184+__u32 gr_acl_handle_utime(const struct dentry *dentry,
63185+ const struct vfsmount *mnt);
63186+__u32 gr_acl_handle_access(const struct dentry *dentry,
63187+ const struct vfsmount *mnt, const int fmode);
63188+__u32 gr_acl_handle_fchmod(const struct dentry *dentry,
63189+ const struct vfsmount *mnt, mode_t mode);
63190+__u32 gr_acl_handle_chmod(const struct dentry *dentry,
63191+ const struct vfsmount *mnt, mode_t mode);
63192+__u32 gr_acl_handle_chown(const struct dentry *dentry,
63193+ const struct vfsmount *mnt);
63194+__u32 gr_acl_handle_setxattr(const struct dentry *dentry,
63195+ const struct vfsmount *mnt);
63196+int gr_handle_ptrace(struct task_struct *task, const long request);
63197+int gr_handle_proc_ptrace(struct task_struct *task);
63198+__u32 gr_acl_handle_execve(const struct dentry *dentry,
63199+ const struct vfsmount *mnt);
63200+int gr_check_crash_exec(const struct file *filp);
63201+int gr_acl_is_enabled(void);
63202+void gr_set_kernel_label(struct task_struct *task);
63203+void gr_set_role_label(struct task_struct *task, const uid_t uid,
63204+ const gid_t gid);
63205+int gr_set_proc_label(const struct dentry *dentry,
63206+ const struct vfsmount *mnt,
63207+ const int unsafe_share);
63208+__u32 gr_acl_handle_hidden_file(const struct dentry *dentry,
63209+ const struct vfsmount *mnt);
63210+__u32 gr_acl_handle_open(const struct dentry *dentry,
63211+ const struct vfsmount *mnt, const int fmode);
63212+__u32 gr_acl_handle_creat(const struct dentry *dentry,
63213+ const struct dentry *p_dentry,
63214+ const struct vfsmount *p_mnt, const int fmode,
63215+ const int imode);
63216+void gr_handle_create(const struct dentry *dentry,
63217+ const struct vfsmount *mnt);
63218+__u32 gr_acl_handle_mknod(const struct dentry *new_dentry,
63219+ const struct dentry *parent_dentry,
63220+ const struct vfsmount *parent_mnt,
63221+ const int mode);
63222+__u32 gr_acl_handle_mkdir(const struct dentry *new_dentry,
63223+ const struct dentry *parent_dentry,
63224+ const struct vfsmount *parent_mnt);
63225+__u32 gr_acl_handle_rmdir(const struct dentry *dentry,
63226+ const struct vfsmount *mnt);
63227+void gr_handle_delete(const ino_t ino, const dev_t dev);
63228+__u32 gr_acl_handle_unlink(const struct dentry *dentry,
63229+ const struct vfsmount *mnt);
63230+__u32 gr_acl_handle_symlink(const struct dentry *new_dentry,
63231+ const struct dentry *parent_dentry,
63232+ const struct vfsmount *parent_mnt,
63233+ const char *from);
63234+__u32 gr_acl_handle_link(const struct dentry *new_dentry,
63235+ const struct dentry *parent_dentry,
63236+ const struct vfsmount *parent_mnt,
63237+ const struct dentry *old_dentry,
63238+ const struct vfsmount *old_mnt, const char *to);
63239+int gr_acl_handle_rename(struct dentry *new_dentry,
63240+ struct dentry *parent_dentry,
63241+ const struct vfsmount *parent_mnt,
63242+ struct dentry *old_dentry,
63243+ struct inode *old_parent_inode,
63244+ struct vfsmount *old_mnt, const char *newname);
63245+void gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
63246+ struct dentry *old_dentry,
63247+ struct dentry *new_dentry,
63248+ struct vfsmount *mnt, const __u8 replace);
63249+__u32 gr_check_link(const struct dentry *new_dentry,
63250+ const struct dentry *parent_dentry,
63251+ const struct vfsmount *parent_mnt,
63252+ const struct dentry *old_dentry,
63253+ const struct vfsmount *old_mnt);
63254+int gr_acl_handle_filldir(const struct file *file, const char *name,
63255+ const unsigned int namelen, const ino_t ino);
63256+
63257+__u32 gr_acl_handle_unix(const struct dentry *dentry,
63258+ const struct vfsmount *mnt);
63259+void gr_acl_handle_exit(void);
63260+void gr_acl_handle_psacct(struct task_struct *task, const long code);
63261+int gr_acl_handle_procpidmem(const struct task_struct *task);
63262+int gr_handle_rofs_mount(struct dentry *dentry, struct vfsmount *mnt, int mnt_flags);
63263+int gr_handle_rofs_blockwrite(struct dentry *dentry, struct vfsmount *mnt, int acc_mode);
63264+void gr_audit_ptrace(struct task_struct *task);
63265+dev_t gr_get_dev_from_dentry(struct dentry *dentry);
63266+
63267+#ifdef CONFIG_GRKERNSEC
63268+void task_grsec_rbac(struct seq_file *m, struct task_struct *p);
63269+void gr_handle_vm86(void);
63270+void gr_handle_mem_readwrite(u64 from, u64 to);
63271+
63272+extern int grsec_enable_dmesg;
63273+extern int grsec_disable_privio;
63274+#endif
63275+
63276+#endif
63277diff -urNp linux-2.6.39/include/linux/grsock.h linux-2.6.39/include/linux/grsock.h
63278--- linux-2.6.39/include/linux/grsock.h 1969-12-31 19:00:00.000000000 -0500
63279+++ linux-2.6.39/include/linux/grsock.h 2011-05-22 19:41:42.000000000 -0400
63280@@ -0,0 +1,19 @@
63281+#ifndef __GRSOCK_H
63282+#define __GRSOCK_H
63283+
63284+extern void gr_attach_curr_ip(const struct sock *sk);
63285+extern int gr_handle_sock_all(const int family, const int type,
63286+ const int protocol);
63287+extern int gr_handle_sock_server(const struct sockaddr *sck);
63288+extern int gr_handle_sock_server_other(const struct sock *sck);
63289+extern int gr_handle_sock_client(const struct sockaddr *sck);
63290+extern int gr_search_connect(struct socket * sock,
63291+ struct sockaddr_in * addr);
63292+extern int gr_search_bind(struct socket * sock,
63293+ struct sockaddr_in * addr);
63294+extern int gr_search_listen(struct socket * sock);
63295+extern int gr_search_accept(struct socket * sock);
63296+extern int gr_search_socket(const int domain, const int type,
63297+ const int protocol);
63298+
63299+#endif
63300diff -urNp linux-2.6.39/include/linux/highmem.h linux-2.6.39/include/linux/highmem.h
63301--- linux-2.6.39/include/linux/highmem.h 2011-05-19 00:06:34.000000000 -0400
63302+++ linux-2.6.39/include/linux/highmem.h 2011-05-22 19:36:33.000000000 -0400
63303@@ -185,6 +185,18 @@ static inline void clear_highpage(struct
63304 kunmap_atomic(kaddr, KM_USER0);
63305 }
63306
63307+static inline void sanitize_highpage(struct page *page)
63308+{
63309+ void *kaddr;
63310+ unsigned long flags;
63311+
63312+ local_irq_save(flags);
63313+ kaddr = kmap_atomic(page, KM_CLEARPAGE);
63314+ clear_page(kaddr);
63315+ kunmap_atomic(kaddr, KM_CLEARPAGE);
63316+ local_irq_restore(flags);
63317+}
63318+
63319 static inline void zero_user_segments(struct page *page,
63320 unsigned start1, unsigned end1,
63321 unsigned start2, unsigned end2)
63322diff -urNp linux-2.6.39/include/linux/i2o.h linux-2.6.39/include/linux/i2o.h
63323--- linux-2.6.39/include/linux/i2o.h 2011-05-19 00:06:34.000000000 -0400
63324+++ linux-2.6.39/include/linux/i2o.h 2011-05-22 19:36:33.000000000 -0400
63325@@ -564,7 +564,7 @@ struct i2o_controller {
63326 struct i2o_device *exec; /* Executive */
63327 #if BITS_PER_LONG == 64
63328 spinlock_t context_list_lock; /* lock for context_list */
63329- atomic_t context_list_counter; /* needed for unique contexts */
63330+ atomic_unchecked_t context_list_counter; /* needed for unique contexts */
63331 struct list_head context_list; /* list of context id's
63332 and pointers */
63333 #endif
63334diff -urNp linux-2.6.39/include/linux/if_phonet.h linux-2.6.39/include/linux/if_phonet.h
63335--- linux-2.6.39/include/linux/if_phonet.h 2011-05-19 00:06:34.000000000 -0400
63336+++ linux-2.6.39/include/linux/if_phonet.h 2011-05-22 19:36:33.000000000 -0400
63337@@ -13,7 +13,7 @@
63338 #define PHONET_DEV_MTU PHONET_MAX_MTU
63339
63340 #ifdef __KERNEL__
63341-extern struct header_ops phonet_header_ops;
63342+extern const struct header_ops phonet_header_ops;
63343 #endif
63344
63345 #endif
63346diff -urNp linux-2.6.39/include/linux/init.h linux-2.6.39/include/linux/init.h
63347--- linux-2.6.39/include/linux/init.h 2011-05-19 00:06:34.000000000 -0400
63348+++ linux-2.6.39/include/linux/init.h 2011-05-22 19:36:33.000000000 -0400
63349@@ -293,13 +293,13 @@ void __init parse_early_options(char *cm
63350
63351 /* Each module must use one module_init(). */
63352 #define module_init(initfn) \
63353- static inline initcall_t __inittest(void) \
63354+ static inline __used initcall_t __inittest(void) \
63355 { return initfn; } \
63356 int init_module(void) __attribute__((alias(#initfn)));
63357
63358 /* This is only required if you want to be unloadable. */
63359 #define module_exit(exitfn) \
63360- static inline exitcall_t __exittest(void) \
63361+ static inline __used exitcall_t __exittest(void) \
63362 { return exitfn; } \
63363 void cleanup_module(void) __attribute__((alias(#exitfn)));
63364
63365diff -urNp linux-2.6.39/include/linux/init_task.h linux-2.6.39/include/linux/init_task.h
63366--- linux-2.6.39/include/linux/init_task.h 2011-05-19 00:06:34.000000000 -0400
63367+++ linux-2.6.39/include/linux/init_task.h 2011-05-22 19:36:33.000000000 -0400
63368@@ -83,6 +83,12 @@ extern struct group_info init_groups;
63369 #define INIT_IDS
63370 #endif
63371
63372+#ifdef CONFIG_X86
63373+#define INIT_TASK_THREAD_INFO .tinfo = INIT_THREAD_INFO,
63374+#else
63375+#define INIT_TASK_THREAD_INFO
63376+#endif
63377+
63378 /*
63379 * Because of the reduced scope of CAP_SETPCAP when filesystem
63380 * capabilities are in effect, it is safe to allow CAP_SETPCAP to
63381@@ -163,6 +169,7 @@ extern struct cred init_cred;
63382 RCU_INIT_POINTER(.cred, &init_cred), \
63383 .comm = "swapper", \
63384 .thread = INIT_THREAD, \
63385+ INIT_TASK_THREAD_INFO \
63386 .fs = &init_fs, \
63387 .files = &init_files, \
63388 .signal = &init_signals, \
63389diff -urNp linux-2.6.39/include/linux/interrupt.h linux-2.6.39/include/linux/interrupt.h
63390--- linux-2.6.39/include/linux/interrupt.h 2011-05-19 00:06:34.000000000 -0400
63391+++ linux-2.6.39/include/linux/interrupt.h 2011-05-22 19:36:33.000000000 -0400
63392@@ -422,7 +422,7 @@ enum
63393 /* map softirq index to softirq name. update 'softirq_to_name' in
63394 * kernel/softirq.c when adding a new softirq.
63395 */
63396-extern char *softirq_to_name[NR_SOFTIRQS];
63397+extern const char * const softirq_to_name[NR_SOFTIRQS];
63398
63399 /* softirq mask and active fields moved to irq_cpustat_t in
63400 * asm/hardirq.h to get better cache usage. KAO
63401@@ -430,12 +430,12 @@ extern char *softirq_to_name[NR_SOFTIRQS
63402
63403 struct softirq_action
63404 {
63405- void (*action)(struct softirq_action *);
63406+ void (*action)(void);
63407 };
63408
63409 asmlinkage void do_softirq(void);
63410 asmlinkage void __do_softirq(void);
63411-extern void open_softirq(int nr, void (*action)(struct softirq_action *));
63412+extern void open_softirq(int nr, void (*action)(void));
63413 extern void softirq_init(void);
63414 static inline void __raise_softirq_irqoff(unsigned int nr)
63415 {
63416diff -urNp linux-2.6.39/include/linux/iommu.h linux-2.6.39/include/linux/iommu.h
63417--- linux-2.6.39/include/linux/iommu.h 2011-05-19 00:06:34.000000000 -0400
63418+++ linux-2.6.39/include/linux/iommu.h 2011-05-22 19:36:33.000000000 -0400
63419@@ -49,7 +49,7 @@ struct iommu_ops {
63420
63421 #ifdef CONFIG_IOMMU_API
63422
63423-extern void register_iommu(struct iommu_ops *ops);
63424+extern void register_iommu(const struct iommu_ops *ops);
63425 extern bool iommu_found(void);
63426 extern struct iommu_domain *iommu_domain_alloc(void);
63427 extern void iommu_domain_free(struct iommu_domain *domain);
63428diff -urNp linux-2.6.39/include/linux/ipmi.h linux-2.6.39/include/linux/ipmi.h
63429--- linux-2.6.39/include/linux/ipmi.h 2011-05-19 00:06:34.000000000 -0400
63430+++ linux-2.6.39/include/linux/ipmi.h 2011-05-22 19:36:33.000000000 -0400
63431@@ -282,7 +282,7 @@ struct ipmi_user_hndl {
63432
63433 /* Create a new user of the IPMI layer on the given interface number. */
63434 int ipmi_create_user(unsigned int if_num,
63435- struct ipmi_user_hndl *handler,
63436+ const struct ipmi_user_hndl *handler,
63437 void *handler_data,
63438 ipmi_user_t *user);
63439
63440diff -urNp linux-2.6.39/include/linux/kallsyms.h linux-2.6.39/include/linux/kallsyms.h
63441--- linux-2.6.39/include/linux/kallsyms.h 2011-05-19 00:06:34.000000000 -0400
63442+++ linux-2.6.39/include/linux/kallsyms.h 2011-05-22 22:52:54.000000000 -0400
63443@@ -15,7 +15,8 @@
63444
63445 struct module;
63446
63447-#ifdef CONFIG_KALLSYMS
63448+#if !defined(__INCLUDED_BY_HIDESYM) || !defined(CONFIG_KALLSYMS)
63449+#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
63450 /* Lookup the address for a symbol. Returns 0 if not found. */
63451 unsigned long kallsyms_lookup_name(const char *name);
63452
63453@@ -99,6 +100,16 @@ static inline int lookup_symbol_attrs(un
63454 /* Stupid that this does nothing, but I didn't create this mess. */
63455 #define __print_symbol(fmt, addr)
63456 #endif /*CONFIG_KALLSYMS*/
63457+#else /* when included by kallsyms.c, vsnprintf.c, or
63458+ arch/x86/kernel/dumpstack.c, with HIDESYM enabled */
63459+extern void __print_symbol(const char *fmt, unsigned long address);
63460+extern int sprint_backtrace(char *buffer, unsigned long address);
63461+extern int sprint_symbol(char *buffer, unsigned long address);
63462+const char *kallsyms_lookup(unsigned long addr,
63463+ unsigned long *symbolsize,
63464+ unsigned long *offset,
63465+ char **modname, char *namebuf);
63466+#endif
63467
63468 /* This macro allows us to keep printk typechecking */
63469 static void __check_printsym_format(const char *fmt, ...)
63470diff -urNp linux-2.6.39/include/linux/kgdb.h linux-2.6.39/include/linux/kgdb.h
63471--- linux-2.6.39/include/linux/kgdb.h 2011-05-19 00:06:34.000000000 -0400
63472+++ linux-2.6.39/include/linux/kgdb.h 2011-05-22 19:36:33.000000000 -0400
63473@@ -53,7 +53,7 @@ extern int kgdb_connected;
63474 extern int kgdb_io_module_registered;
63475
63476 extern atomic_t kgdb_setting_breakpoint;
63477-extern atomic_t kgdb_cpu_doing_single_step;
63478+extern atomic_unchecked_t kgdb_cpu_doing_single_step;
63479
63480 extern struct task_struct *kgdb_usethread;
63481 extern struct task_struct *kgdb_contthread;
63482@@ -269,22 +269,22 @@ struct kgdb_arch {
63483 */
63484 struct kgdb_io {
63485 const char *name;
63486- int (*read_char) (void);
63487- void (*write_char) (u8);
63488- void (*flush) (void);
63489- int (*init) (void);
63490- void (*pre_exception) (void);
63491- void (*post_exception) (void);
63492+ int (* const read_char) (void);
63493+ void (* const write_char) (u8);
63494+ void (* const flush) (void);
63495+ int (* const init) (void);
63496+ void (* const pre_exception) (void);
63497+ void (* const post_exception) (void);
63498 int is_console;
63499 };
63500
63501-extern struct kgdb_arch arch_kgdb_ops;
63502+extern const struct kgdb_arch arch_kgdb_ops;
63503
63504 extern unsigned long __weak kgdb_arch_pc(int exception, struct pt_regs *regs);
63505
63506-extern int kgdb_register_io_module(struct kgdb_io *local_kgdb_io_ops);
63507-extern void kgdb_unregister_io_module(struct kgdb_io *local_kgdb_io_ops);
63508-extern struct kgdb_io *dbg_io_ops;
63509+extern int kgdb_register_io_module(const struct kgdb_io *local_kgdb_io_ops);
63510+extern void kgdb_unregister_io_module(const struct kgdb_io *local_kgdb_io_ops);
63511+extern const struct kgdb_io *dbg_io_ops;
63512
63513 extern int kgdb_hex2long(char **ptr, unsigned long *long_val);
63514 extern char *kgdb_mem2hex(char *mem, char *buf, int count);
63515diff -urNp linux-2.6.39/include/linux/kmod.h linux-2.6.39/include/linux/kmod.h
63516--- linux-2.6.39/include/linux/kmod.h 2011-05-19 00:06:34.000000000 -0400
63517+++ linux-2.6.39/include/linux/kmod.h 2011-05-22 19:41:42.000000000 -0400
63518@@ -33,6 +33,8 @@ extern char modprobe_path[]; /* for sysc
63519 * usually useless though. */
63520 extern int __request_module(bool wait, const char *name, ...) \
63521 __attribute__((format(printf, 2, 3)));
63522+extern int ___request_module(bool wait, char *param_name, const char *name, ...) \
63523+ __attribute__((format(printf, 3, 4)));
63524 #define request_module(mod...) __request_module(true, mod)
63525 #define request_module_nowait(mod...) __request_module(false, mod)
63526 #define try_then_request_module(x, mod...) \
63527diff -urNp linux-2.6.39/include/linux/kvm_host.h linux-2.6.39/include/linux/kvm_host.h
63528--- linux-2.6.39/include/linux/kvm_host.h 2011-05-19 00:06:34.000000000 -0400
63529+++ linux-2.6.39/include/linux/kvm_host.h 2011-05-22 19:36:33.000000000 -0400
63530@@ -302,7 +302,7 @@ void kvm_vcpu_uninit(struct kvm_vcpu *vc
63531 void vcpu_load(struct kvm_vcpu *vcpu);
63532 void vcpu_put(struct kvm_vcpu *vcpu);
63533
63534-int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
63535+int kvm_init(const void *opaque, unsigned vcpu_size, unsigned vcpu_align,
63536 struct module *module);
63537 void kvm_exit(void);
63538
63539@@ -442,7 +442,7 @@ int kvm_arch_vcpu_ioctl_set_guest_debug(
63540 struct kvm_guest_debug *dbg);
63541 int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run);
63542
63543-int kvm_arch_init(void *opaque);
63544+int kvm_arch_init(const void *opaque);
63545 void kvm_arch_exit(void);
63546
63547 int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu);
63548diff -urNp linux-2.6.39/include/linux/lapb.h linux-2.6.39/include/linux/lapb.h
63549--- linux-2.6.39/include/linux/lapb.h 2011-05-19 00:06:34.000000000 -0400
63550+++ linux-2.6.39/include/linux/lapb.h 2011-05-22 19:36:33.000000000 -0400
63551@@ -44,7 +44,7 @@ struct lapb_parms_struct {
63552 unsigned int mode;
63553 };
63554
63555-extern int lapb_register(struct net_device *dev, struct lapb_register_struct *callbacks);
63556+extern int lapb_register(struct net_device *dev, const struct lapb_register_struct *callbacks);
63557 extern int lapb_unregister(struct net_device *dev);
63558 extern int lapb_getparms(struct net_device *dev, struct lapb_parms_struct *parms);
63559 extern int lapb_setparms(struct net_device *dev, struct lapb_parms_struct *parms);
63560diff -urNp linux-2.6.39/include/linux/lcd.h linux-2.6.39/include/linux/lcd.h
63561--- linux-2.6.39/include/linux/lcd.h 2011-05-19 00:06:34.000000000 -0400
63562+++ linux-2.6.39/include/linux/lcd.h 2011-05-22 19:36:33.000000000 -0400
63563@@ -60,7 +60,7 @@ struct lcd_device {
63564 points to something in the body of that driver, it is also invalid. */
63565 struct mutex ops_lock;
63566 /* If this is NULL, the backing module is unloaded */
63567- struct lcd_ops *ops;
63568+ const struct lcd_ops *ops;
63569 /* Serialise access to set_power method */
63570 struct mutex update_lock;
63571 /* The framebuffer notifier block */
63572@@ -101,7 +101,7 @@ static inline void lcd_set_power(struct
63573 }
63574
63575 extern struct lcd_device *lcd_device_register(const char *name,
63576- struct device *parent, void *devdata, struct lcd_ops *ops);
63577+ struct device *parent, void *devdata, const struct lcd_ops *ops);
63578 extern void lcd_device_unregister(struct lcd_device *ld);
63579
63580 #define to_lcd_device(obj) container_of(obj, struct lcd_device, dev)
63581diff -urNp linux-2.6.39/include/linux/libata.h linux-2.6.39/include/linux/libata.h
63582--- linux-2.6.39/include/linux/libata.h 2011-05-19 00:06:34.000000000 -0400
63583+++ linux-2.6.39/include/linux/libata.h 2011-05-22 19:36:33.000000000 -0400
63584@@ -524,11 +524,11 @@ struct ata_ioports {
63585
63586 struct ata_host {
63587 spinlock_t lock;
63588- struct device *dev;
63589+ struct device *dev;
63590 void __iomem * const *iomap;
63591 unsigned int n_ports;
63592 void *private_data;
63593- struct ata_port_operations *ops;
63594+ const struct ata_port_operations *ops;
63595 unsigned long flags;
63596
63597 struct mutex eh_mutex;
63598@@ -719,7 +719,7 @@ struct ata_link {
63599
63600 struct ata_port {
63601 struct Scsi_Host *scsi_host; /* our co-allocated scsi host */
63602- struct ata_port_operations *ops;
63603+ const struct ata_port_operations *ops;
63604 spinlock_t *lock;
63605 /* Flags owned by the EH context. Only EH should touch these once the
63606 port is active */
63607@@ -907,7 +907,7 @@ struct ata_port_info {
63608 unsigned long pio_mask;
63609 unsigned long mwdma_mask;
63610 unsigned long udma_mask;
63611- struct ata_port_operations *port_ops;
63612+ const struct ata_port_operations *port_ops;
63613 void *private_data;
63614 };
63615
63616@@ -931,7 +931,7 @@ extern const unsigned long sata_deb_timi
63617 extern const unsigned long sata_deb_timing_hotplug[];
63618 extern const unsigned long sata_deb_timing_long[];
63619
63620-extern struct ata_port_operations ata_dummy_port_ops;
63621+extern const struct ata_port_operations ata_dummy_port_ops;
63622 extern const struct ata_port_info ata_dummy_port_info;
63623
63624 static inline const unsigned long *
63625@@ -977,7 +977,7 @@ extern int ata_host_activate(struct ata_
63626 struct scsi_host_template *sht);
63627 extern void ata_host_detach(struct ata_host *host);
63628 extern void ata_host_init(struct ata_host *, struct device *,
63629- unsigned long, struct ata_port_operations *);
63630+ unsigned long, const struct ata_port_operations *);
63631 extern int ata_scsi_detect(struct scsi_host_template *sht);
63632 extern int ata_scsi_ioctl(struct scsi_device *dev, int cmd, void __user *arg);
63633 extern int ata_scsi_queuecmd(struct Scsi_Host *h, struct scsi_cmnd *cmd);
63634diff -urNp linux-2.6.39/include/linux/lockd/bind.h linux-2.6.39/include/linux/lockd/bind.h
63635--- linux-2.6.39/include/linux/lockd/bind.h 2011-05-19 00:06:34.000000000 -0400
63636+++ linux-2.6.39/include/linux/lockd/bind.h 2011-05-22 19:36:33.000000000 -0400
63637@@ -23,13 +23,13 @@ struct svc_rqst;
63638 * This is the set of functions for lockd->nfsd communication
63639 */
63640 struct nlmsvc_binding {
63641- __be32 (*fopen)(struct svc_rqst *,
63642+ __be32 (* const fopen)(struct svc_rqst *,
63643 struct nfs_fh *,
63644 struct file **);
63645- void (*fclose)(struct file *);
63646+ void (* const fclose)(struct file *);
63647 };
63648
63649-extern struct nlmsvc_binding * nlmsvc_ops;
63650+extern const struct nlmsvc_binding * nlmsvc_ops;
63651
63652 /*
63653 * Similar to nfs_client_initdata, but without the NFS-specific
63654diff -urNp linux-2.6.39/include/linux/mfd/abx500.h linux-2.6.39/include/linux/mfd/abx500.h
63655--- linux-2.6.39/include/linux/mfd/abx500.h 2011-05-19 00:06:34.000000000 -0400
63656+++ linux-2.6.39/include/linux/mfd/abx500.h 2011-05-22 19:36:33.000000000 -0400
63657@@ -227,6 +227,6 @@ struct abx500_ops {
63658 int (*startup_irq_enabled) (struct device *, unsigned int);
63659 };
63660
63661-int abx500_register_ops(struct device *core_dev, struct abx500_ops *ops);
63662+int abx500_register_ops(struct device *core_dev, const struct abx500_ops *ops);
63663 void abx500_remove_ops(struct device *dev);
63664 #endif
63665diff -urNp linux-2.6.39/include/linux/mm.h linux-2.6.39/include/linux/mm.h
63666--- linux-2.6.39/include/linux/mm.h 2011-05-19 00:06:34.000000000 -0400
63667+++ linux-2.6.39/include/linux/mm.h 2011-05-22 19:36:33.000000000 -0400
63668@@ -113,7 +113,14 @@ extern unsigned int kobjsize(const void
63669
63670 #define VM_CAN_NONLINEAR 0x08000000 /* Has ->fault & does nonlinear pages */
63671 #define VM_MIXEDMAP 0x10000000 /* Can contain "struct page" and pure PFN pages */
63672+
63673+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
63674+#define VM_SAO 0x00000000 /* Strong Access Ordering (powerpc) */
63675+#define VM_PAGEEXEC 0x20000000 /* vma->vm_page_prot needs special handling */
63676+#else
63677 #define VM_SAO 0x20000000 /* Strong Access Ordering (powerpc) */
63678+#endif
63679+
63680 #define VM_PFN_AT_MMAP 0x40000000 /* PFNMAP vma that is fully mapped at mmap time */
63681 #define VM_MERGEABLE 0x80000000 /* KSM may merge identical pages */
63682
63683@@ -1010,34 +1017,6 @@ int set_page_dirty(struct page *page);
63684 int set_page_dirty_lock(struct page *page);
63685 int clear_page_dirty_for_io(struct page *page);
63686
63687-/* Is the vma a continuation of the stack vma above it? */
63688-static inline int vma_growsdown(struct vm_area_struct *vma, unsigned long addr)
63689-{
63690- return vma && (vma->vm_end == addr) && (vma->vm_flags & VM_GROWSDOWN);
63691-}
63692-
63693-static inline int stack_guard_page_start(struct vm_area_struct *vma,
63694- unsigned long addr)
63695-{
63696- return (vma->vm_flags & VM_GROWSDOWN) &&
63697- (vma->vm_start == addr) &&
63698- !vma_growsdown(vma->vm_prev, addr);
63699-}
63700-
63701-/* Is the vma a continuation of the stack vma below it? */
63702-static inline int vma_growsup(struct vm_area_struct *vma, unsigned long addr)
63703-{
63704- return vma && (vma->vm_start == addr) && (vma->vm_flags & VM_GROWSUP);
63705-}
63706-
63707-static inline int stack_guard_page_end(struct vm_area_struct *vma,
63708- unsigned long addr)
63709-{
63710- return (vma->vm_flags & VM_GROWSUP) &&
63711- (vma->vm_end == addr) &&
63712- !vma_growsup(vma->vm_next, addr);
63713-}
63714-
63715 extern unsigned long move_page_tables(struct vm_area_struct *vma,
63716 unsigned long old_addr, struct vm_area_struct *new_vma,
63717 unsigned long new_addr, unsigned long len);
63718@@ -1189,6 +1168,15 @@ struct shrinker {
63719 extern void register_shrinker(struct shrinker *);
63720 extern void unregister_shrinker(struct shrinker *);
63721
63722+#ifdef CONFIG_MMU
63723+pgprot_t vm_get_page_prot(unsigned long vm_flags);
63724+#else
63725+static inline pgprot_t vm_get_page_prot(unsigned long vm_flags)
63726+{
63727+ return __pgprot(0);
63728+}
63729+#endif
63730+
63731 int vma_wants_writenotify(struct vm_area_struct *vma);
63732
63733 extern pte_t *__get_locked_pte(struct mm_struct *mm, unsigned long addr,
63734@@ -1476,6 +1464,7 @@ out:
63735 }
63736
63737 extern int do_munmap(struct mm_struct *, unsigned long, size_t);
63738+extern int __do_munmap(struct mm_struct *, unsigned long, size_t);
63739
63740 extern unsigned long do_brk(unsigned long, unsigned long);
63741
63742@@ -1532,6 +1521,10 @@ extern struct vm_area_struct * find_vma(
63743 extern struct vm_area_struct * find_vma_prev(struct mm_struct * mm, unsigned long addr,
63744 struct vm_area_struct **pprev);
63745
63746+extern struct vm_area_struct *pax_find_mirror_vma(struct vm_area_struct *vma);
63747+extern __must_check long pax_mirror_vma(struct vm_area_struct *vma_m, struct vm_area_struct *vma);
63748+extern void pax_mirror_file_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl);
63749+
63750 /* Look up the first VMA which intersects the interval start_addr..end_addr-1,
63751 NULL if none. Assume start_addr < end_addr. */
63752 static inline struct vm_area_struct * find_vma_intersection(struct mm_struct * mm, unsigned long start_addr, unsigned long end_addr)
63753@@ -1548,15 +1541,6 @@ static inline unsigned long vma_pages(st
63754 return (vma->vm_end - vma->vm_start) >> PAGE_SHIFT;
63755 }
63756
63757-#ifdef CONFIG_MMU
63758-pgprot_t vm_get_page_prot(unsigned long vm_flags);
63759-#else
63760-static inline pgprot_t vm_get_page_prot(unsigned long vm_flags)
63761-{
63762- return __pgprot(0);
63763-}
63764-#endif
63765-
63766 struct vm_area_struct *find_extend_vma(struct mm_struct *, unsigned long addr);
63767 int remap_pfn_range(struct vm_area_struct *, unsigned long addr,
63768 unsigned long pfn, unsigned long size, pgprot_t);
63769@@ -1668,7 +1652,7 @@ extern int unpoison_memory(unsigned long
63770 extern int sysctl_memory_failure_early_kill;
63771 extern int sysctl_memory_failure_recovery;
63772 extern void shake_page(struct page *p, int access);
63773-extern atomic_long_t mce_bad_pages;
63774+extern atomic_long_unchecked_t mce_bad_pages;
63775 extern int soft_offline_page(struct page *page, int flags);
63776
63777 extern void dump_page(struct page *page);
63778@@ -1682,5 +1666,11 @@ extern void copy_user_huge_page(struct p
63779 unsigned int pages_per_huge_page);
63780 #endif /* CONFIG_TRANSPARENT_HUGEPAGE || CONFIG_HUGETLBFS */
63781
63782+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
63783+extern void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot);
63784+#else
63785+static inline void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot) {}
63786+#endif
63787+
63788 #endif /* __KERNEL__ */
63789 #endif /* _LINUX_MM_H */
63790diff -urNp linux-2.6.39/include/linux/mm_types.h linux-2.6.39/include/linux/mm_types.h
63791--- linux-2.6.39/include/linux/mm_types.h 2011-05-19 00:06:34.000000000 -0400
63792+++ linux-2.6.39/include/linux/mm_types.h 2011-05-22 19:36:33.000000000 -0400
63793@@ -183,6 +183,8 @@ struct vm_area_struct {
63794 #ifdef CONFIG_NUMA
63795 struct mempolicy *vm_policy; /* NUMA policy for the VMA */
63796 #endif
63797+
63798+ struct vm_area_struct *vm_mirror;/* PaX: mirror vma or NULL */
63799 };
63800
63801 struct core_thread {
63802@@ -317,6 +319,24 @@ struct mm_struct {
63803 #ifdef CONFIG_TRANSPARENT_HUGEPAGE
63804 pgtable_t pmd_huge_pte; /* protected by page_table_lock */
63805 #endif
63806+
63807+#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS) || defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
63808+ unsigned long pax_flags;
63809+#endif
63810+
63811+#ifdef CONFIG_PAX_DLRESOLVE
63812+ unsigned long call_dl_resolve;
63813+#endif
63814+
63815+#if defined(CONFIG_PPC32) && defined(CONFIG_PAX_EMUSIGRT)
63816+ unsigned long call_syscall;
63817+#endif
63818+
63819+#ifdef CONFIG_PAX_ASLR
63820+ unsigned long delta_mmap; /* randomized offset */
63821+ unsigned long delta_stack; /* randomized offset */
63822+#endif
63823+
63824 };
63825
63826 /* Future-safe accessor for struct mm_struct's cpu_vm_mask. */
63827diff -urNp linux-2.6.39/include/linux/mmu_notifier.h linux-2.6.39/include/linux/mmu_notifier.h
63828--- linux-2.6.39/include/linux/mmu_notifier.h 2011-05-19 00:06:34.000000000 -0400
63829+++ linux-2.6.39/include/linux/mmu_notifier.h 2011-05-22 19:36:33.000000000 -0400
63830@@ -255,12 +255,12 @@ static inline void mmu_notifier_mm_destr
63831 */
63832 #define ptep_clear_flush_notify(__vma, __address, __ptep) \
63833 ({ \
63834- pte_t __pte; \
63835+ pte_t ___pte; \
63836 struct vm_area_struct *___vma = __vma; \
63837 unsigned long ___address = __address; \
63838- __pte = ptep_clear_flush(___vma, ___address, __ptep); \
63839+ ___pte = ptep_clear_flush(___vma, ___address, __ptep); \
63840 mmu_notifier_invalidate_page(___vma->vm_mm, ___address); \
63841- __pte; \
63842+ ___pte; \
63843 })
63844
63845 #define pmdp_clear_flush_notify(__vma, __address, __pmdp) \
63846diff -urNp linux-2.6.39/include/linux/mmzone.h linux-2.6.39/include/linux/mmzone.h
63847--- linux-2.6.39/include/linux/mmzone.h 2011-05-19 00:06:34.000000000 -0400
63848+++ linux-2.6.39/include/linux/mmzone.h 2011-05-22 19:36:33.000000000 -0400
63849@@ -355,7 +355,7 @@ struct zone {
63850 unsigned long flags; /* zone flags, see below */
63851
63852 /* Zone statistics */
63853- atomic_long_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
63854+ atomic_long_unchecked_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
63855
63856 /*
63857 * The target ratio of ACTIVE_ANON to INACTIVE_ANON pages on
63858diff -urNp linux-2.6.39/include/linux/mod_devicetable.h linux-2.6.39/include/linux/mod_devicetable.h
63859--- linux-2.6.39/include/linux/mod_devicetable.h 2011-05-19 00:06:34.000000000 -0400
63860+++ linux-2.6.39/include/linux/mod_devicetable.h 2011-05-22 19:36:33.000000000 -0400
63861@@ -12,7 +12,7 @@
63862 typedef unsigned long kernel_ulong_t;
63863 #endif
63864
63865-#define PCI_ANY_ID (~0)
63866+#define PCI_ANY_ID ((__u16)~0)
63867
63868 struct pci_device_id {
63869 __u32 vendor, device; /* Vendor and device ID or PCI_ANY_ID*/
63870@@ -131,7 +131,7 @@ struct usb_device_id {
63871 #define USB_DEVICE_ID_MATCH_INT_SUBCLASS 0x0100
63872 #define USB_DEVICE_ID_MATCH_INT_PROTOCOL 0x0200
63873
63874-#define HID_ANY_ID (~0)
63875+#define HID_ANY_ID (~0U)
63876
63877 struct hid_device_id {
63878 __u16 bus;
63879diff -urNp linux-2.6.39/include/linux/module.h linux-2.6.39/include/linux/module.h
63880--- linux-2.6.39/include/linux/module.h 2011-05-19 00:06:34.000000000 -0400
63881+++ linux-2.6.39/include/linux/module.h 2011-05-22 19:36:33.000000000 -0400
63882@@ -324,19 +324,16 @@ struct module
63883 int (*init)(void);
63884
63885 /* If this is non-NULL, vfree after init() returns */
63886- void *module_init;
63887+ void *module_init_rx, *module_init_rw;
63888
63889 /* Here is the actual code + data, vfree'd on unload. */
63890- void *module_core;
63891+ void *module_core_rx, *module_core_rw;
63892
63893 /* Here are the sizes of the init and core sections */
63894- unsigned int init_size, core_size;
63895+ unsigned int init_size_rw, core_size_rw;
63896
63897 /* The size of the executable code in each section. */
63898- unsigned int init_text_size, core_text_size;
63899-
63900- /* Size of RO sections of the module (text+rodata) */
63901- unsigned int init_ro_size, core_ro_size;
63902+ unsigned int init_size_rx, core_size_rx;
63903
63904 /* Arch-specific module values */
63905 struct mod_arch_specific arch;
63906@@ -441,16 +438,46 @@ bool is_module_address(unsigned long add
63907 bool is_module_percpu_address(unsigned long addr);
63908 bool is_module_text_address(unsigned long addr);
63909
63910+static inline int within_module_range(unsigned long addr, void *start, unsigned long size)
63911+{
63912+
63913+#ifdef CONFIG_PAX_KERNEXEC
63914+ if (ktla_ktva(addr) >= (unsigned long)start &&
63915+ ktla_ktva(addr) < (unsigned long)start + size)
63916+ return 1;
63917+#endif
63918+
63919+ return ((void *)addr >= start && (void *)addr < start + size);
63920+}
63921+
63922+static inline int within_module_core_rx(unsigned long addr, struct module *mod)
63923+{
63924+ return within_module_range(addr, mod->module_core_rx, mod->core_size_rx);
63925+}
63926+
63927+static inline int within_module_core_rw(unsigned long addr, struct module *mod)
63928+{
63929+ return within_module_range(addr, mod->module_core_rw, mod->core_size_rw);
63930+}
63931+
63932+static inline int within_module_init_rx(unsigned long addr, struct module *mod)
63933+{
63934+ return within_module_range(addr, mod->module_init_rx, mod->init_size_rx);
63935+}
63936+
63937+static inline int within_module_init_rw(unsigned long addr, struct module *mod)
63938+{
63939+ return within_module_range(addr, mod->module_init_rw, mod->init_size_rw);
63940+}
63941+
63942 static inline int within_module_core(unsigned long addr, struct module *mod)
63943 {
63944- return (unsigned long)mod->module_core <= addr &&
63945- addr < (unsigned long)mod->module_core + mod->core_size;
63946+ return within_module_core_rx(addr, mod) || within_module_core_rw(addr, mod);
63947 }
63948
63949 static inline int within_module_init(unsigned long addr, struct module *mod)
63950 {
63951- return (unsigned long)mod->module_init <= addr &&
63952- addr < (unsigned long)mod->module_init + mod->init_size;
63953+ return within_module_init_rx(addr, mod) || within_module_init_rw(addr, mod);
63954 }
63955
63956 /* Search for module by name: must hold module_mutex. */
63957diff -urNp linux-2.6.39/include/linux/moduleloader.h linux-2.6.39/include/linux/moduleloader.h
63958--- linux-2.6.39/include/linux/moduleloader.h 2011-05-19 00:06:34.000000000 -0400
63959+++ linux-2.6.39/include/linux/moduleloader.h 2011-05-22 19:36:33.000000000 -0400
63960@@ -20,9 +20,21 @@ unsigned int arch_mod_section_prepend(st
63961 sections. Returns NULL on failure. */
63962 void *module_alloc(unsigned long size);
63963
63964+#ifdef CONFIG_PAX_KERNEXEC
63965+void *module_alloc_exec(unsigned long size);
63966+#else
63967+#define module_alloc_exec(x) module_alloc(x)
63968+#endif
63969+
63970 /* Free memory returned from module_alloc. */
63971 void module_free(struct module *mod, void *module_region);
63972
63973+#ifdef CONFIG_PAX_KERNEXEC
63974+void module_free_exec(struct module *mod, void *module_region);
63975+#else
63976+#define module_free_exec(x, y) module_free((x), (y))
63977+#endif
63978+
63979 /* Apply the given relocation to the (simplified) ELF. Return -error
63980 or 0. */
63981 int apply_relocate(Elf_Shdr *sechdrs,
63982diff -urNp linux-2.6.39/include/linux/moduleparam.h linux-2.6.39/include/linux/moduleparam.h
63983--- linux-2.6.39/include/linux/moduleparam.h 2011-05-19 00:06:34.000000000 -0400
63984+++ linux-2.6.39/include/linux/moduleparam.h 2011-05-22 19:36:33.000000000 -0400
63985@@ -255,7 +255,7 @@ static inline void __kernel_param_unlock
63986 * @len is usually just sizeof(string).
63987 */
63988 #define module_param_string(name, string, len, perm) \
63989- static const struct kparam_string __param_string_##name \
63990+ static const struct kparam_string __param_string_##name __used \
63991 = { len, string }; \
63992 __module_param_call(MODULE_PARAM_PREFIX, name, \
63993 &param_ops_string, \
63994@@ -285,48 +285,48 @@ static inline void destroy_params(const
63995 #define __param_check(name, p, type) \
63996 static inline type *__check_##name(void) { return(p); }
63997
63998-extern struct kernel_param_ops param_ops_byte;
63999+extern const struct kernel_param_ops param_ops_byte;
64000 extern int param_set_byte(const char *val, const struct kernel_param *kp);
64001 extern int param_get_byte(char *buffer, const struct kernel_param *kp);
64002 #define param_check_byte(name, p) __param_check(name, p, unsigned char)
64003
64004-extern struct kernel_param_ops param_ops_short;
64005+extern const struct kernel_param_ops param_ops_short;
64006 extern int param_set_short(const char *val, const struct kernel_param *kp);
64007 extern int param_get_short(char *buffer, const struct kernel_param *kp);
64008 #define param_check_short(name, p) __param_check(name, p, short)
64009
64010-extern struct kernel_param_ops param_ops_ushort;
64011+extern const struct kernel_param_ops param_ops_ushort;
64012 extern int param_set_ushort(const char *val, const struct kernel_param *kp);
64013 extern int param_get_ushort(char *buffer, const struct kernel_param *kp);
64014 #define param_check_ushort(name, p) __param_check(name, p, unsigned short)
64015
64016-extern struct kernel_param_ops param_ops_int;
64017+extern const struct kernel_param_ops param_ops_int;
64018 extern int param_set_int(const char *val, const struct kernel_param *kp);
64019 extern int param_get_int(char *buffer, const struct kernel_param *kp);
64020 #define param_check_int(name, p) __param_check(name, p, int)
64021
64022-extern struct kernel_param_ops param_ops_uint;
64023+extern const struct kernel_param_ops param_ops_uint;
64024 extern int param_set_uint(const char *val, const struct kernel_param *kp);
64025 extern int param_get_uint(char *buffer, const struct kernel_param *kp);
64026 #define param_check_uint(name, p) __param_check(name, p, unsigned int)
64027
64028-extern struct kernel_param_ops param_ops_long;
64029+extern const struct kernel_param_ops param_ops_long;
64030 extern int param_set_long(const char *val, const struct kernel_param *kp);
64031 extern int param_get_long(char *buffer, const struct kernel_param *kp);
64032 #define param_check_long(name, p) __param_check(name, p, long)
64033
64034-extern struct kernel_param_ops param_ops_ulong;
64035+extern const struct kernel_param_ops param_ops_ulong;
64036 extern int param_set_ulong(const char *val, const struct kernel_param *kp);
64037 extern int param_get_ulong(char *buffer, const struct kernel_param *kp);
64038 #define param_check_ulong(name, p) __param_check(name, p, unsigned long)
64039
64040-extern struct kernel_param_ops param_ops_charp;
64041+extern const struct kernel_param_ops param_ops_charp;
64042 extern int param_set_charp(const char *val, const struct kernel_param *kp);
64043 extern int param_get_charp(char *buffer, const struct kernel_param *kp);
64044 #define param_check_charp(name, p) __param_check(name, p, char *)
64045
64046 /* For historical reasons "bool" parameters can be (unsigned) "int". */
64047-extern struct kernel_param_ops param_ops_bool;
64048+extern const struct kernel_param_ops param_ops_bool;
64049 extern int param_set_bool(const char *val, const struct kernel_param *kp);
64050 extern int param_get_bool(char *buffer, const struct kernel_param *kp);
64051 #define param_check_bool(name, p) \
64052@@ -337,7 +337,7 @@ extern int param_get_bool(char *buffer,
64053 !__same_type((p), int *)); \
64054 }
64055
64056-extern struct kernel_param_ops param_ops_invbool;
64057+extern const struct kernel_param_ops param_ops_invbool;
64058 extern int param_set_invbool(const char *val, const struct kernel_param *kp);
64059 extern int param_get_invbool(char *buffer, const struct kernel_param *kp);
64060 #define param_check_invbool(name, p) __param_check(name, p, bool)
64061@@ -370,7 +370,7 @@ extern int param_get_invbool(char *buffe
64062 * module_param_named() for why this might be necessary.
64063 */
64064 #define module_param_array_named(name, array, type, nump, perm) \
64065- static const struct kparam_array __param_arr_##name \
64066+ static const struct kparam_array __param_arr_##name __used \
64067 = { ARRAY_SIZE(array), nump, &param_ops_##type, \
64068 sizeof(array[0]), array }; \
64069 __module_param_call(MODULE_PARAM_PREFIX, name, \
64070@@ -379,9 +379,9 @@ extern int param_get_invbool(char *buffe
64071 __same_type(array[0], bool), perm); \
64072 __MODULE_PARM_TYPE(name, "array of " #type)
64073
64074-extern struct kernel_param_ops param_array_ops;
64075+extern const struct kernel_param_ops param_array_ops;
64076
64077-extern struct kernel_param_ops param_ops_string;
64078+extern const struct kernel_param_ops param_ops_string;
64079 extern int param_set_copystring(const char *val, const struct kernel_param *);
64080 extern int param_get_string(char *buffer, const struct kernel_param *kp);
64081
64082diff -urNp linux-2.6.39/include/linux/mutex.h linux-2.6.39/include/linux/mutex.h
64083--- linux-2.6.39/include/linux/mutex.h 2011-05-19 00:06:34.000000000 -0400
64084+++ linux-2.6.39/include/linux/mutex.h 2011-05-22 19:36:33.000000000 -0400
64085@@ -51,7 +51,7 @@ struct mutex {
64086 spinlock_t wait_lock;
64087 struct list_head wait_list;
64088 #if defined(CONFIG_DEBUG_MUTEXES) || defined(CONFIG_SMP)
64089- struct thread_info *owner;
64090+ struct task_struct *owner;
64091 #endif
64092 #ifdef CONFIG_DEBUG_MUTEXES
64093 const char *name;
64094diff -urNp linux-2.6.39/include/linux/namei.h linux-2.6.39/include/linux/namei.h
64095--- linux-2.6.39/include/linux/namei.h 2011-05-19 00:06:34.000000000 -0400
64096+++ linux-2.6.39/include/linux/namei.h 2011-05-22 19:36:33.000000000 -0400
64097@@ -24,7 +24,7 @@ struct nameidata {
64098 unsigned seq;
64099 int last_type;
64100 unsigned depth;
64101- char *saved_names[MAX_NESTED_LINKS + 1];
64102+ const char *saved_names[MAX_NESTED_LINKS + 1];
64103
64104 /* Intent data */
64105 union {
64106@@ -91,12 +91,12 @@ extern int follow_up(struct path *);
64107 extern struct dentry *lock_rename(struct dentry *, struct dentry *);
64108 extern void unlock_rename(struct dentry *, struct dentry *);
64109
64110-static inline void nd_set_link(struct nameidata *nd, char *path)
64111+static inline void nd_set_link(struct nameidata *nd, const char *path)
64112 {
64113 nd->saved_names[nd->depth] = path;
64114 }
64115
64116-static inline char *nd_get_link(struct nameidata *nd)
64117+static inline const char *nd_get_link(const struct nameidata *nd)
64118 {
64119 return nd->saved_names[nd->depth];
64120 }
64121diff -urNp linux-2.6.39/include/linux/netfilter/xt_gradm.h linux-2.6.39/include/linux/netfilter/xt_gradm.h
64122--- linux-2.6.39/include/linux/netfilter/xt_gradm.h 1969-12-31 19:00:00.000000000 -0500
64123+++ linux-2.6.39/include/linux/netfilter/xt_gradm.h 2011-05-22 19:41:42.000000000 -0400
64124@@ -0,0 +1,9 @@
64125+#ifndef _LINUX_NETFILTER_XT_GRADM_H
64126+#define _LINUX_NETFILTER_XT_GRADM_H 1
64127+
64128+struct xt_gradm_mtinfo {
64129+ __u16 flags;
64130+ __u16 invflags;
64131+};
64132+
64133+#endif
64134diff -urNp linux-2.6.39/include/linux/oprofile.h linux-2.6.39/include/linux/oprofile.h
64135--- linux-2.6.39/include/linux/oprofile.h 2011-05-19 00:06:34.000000000 -0400
64136+++ linux-2.6.39/include/linux/oprofile.h 2011-05-22 19:36:33.000000000 -0400
64137@@ -139,9 +139,9 @@ int oprofilefs_create_ulong(struct super
64138 int oprofilefs_create_ro_ulong(struct super_block * sb, struct dentry * root,
64139 char const * name, ulong * val);
64140
64141-/** Create a file for read-only access to an atomic_t. */
64142+/** Create a file for read-only access to an atomic_unchecked_t. */
64143 int oprofilefs_create_ro_atomic(struct super_block * sb, struct dentry * root,
64144- char const * name, atomic_t * val);
64145+ char const * name, atomic_unchecked_t * val);
64146
64147 /** create a directory */
64148 struct dentry * oprofilefs_mkdir(struct super_block * sb, struct dentry * root,
64149diff -urNp linux-2.6.39/include/linux/padata.h linux-2.6.39/include/linux/padata.h
64150--- linux-2.6.39/include/linux/padata.h 2011-05-19 00:06:34.000000000 -0400
64151+++ linux-2.6.39/include/linux/padata.h 2011-05-22 19:36:33.000000000 -0400
64152@@ -129,7 +129,7 @@ struct parallel_data {
64153 struct padata_instance *pinst;
64154 struct padata_parallel_queue __percpu *pqueue;
64155 struct padata_serial_queue __percpu *squeue;
64156- atomic_t seq_nr;
64157+ atomic_unchecked_t seq_nr;
64158 atomic_t reorder_objects;
64159 atomic_t refcnt;
64160 unsigned int max_seq_nr;
64161diff -urNp linux-2.6.39/include/linux/pci.h linux-2.6.39/include/linux/pci.h
64162--- linux-2.6.39/include/linux/pci.h 2011-05-19 00:06:34.000000000 -0400
64163+++ linux-2.6.39/include/linux/pci.h 2011-05-22 19:36:33.000000000 -0400
64164@@ -411,7 +411,7 @@ struct pci_bus {
64165 struct resource *resource[PCI_BRIDGE_RESOURCE_NUM];
64166 struct list_head resources; /* address space routed to this bus */
64167
64168- struct pci_ops *ops; /* configuration access functions */
64169+ const struct pci_ops *ops; /* configuration access functions */
64170 void *sysdata; /* hook for sys-specific extension */
64171 struct proc_dir_entry *procdir; /* directory entry in /proc/bus/pci */
64172
64173@@ -550,7 +550,7 @@ struct pci_driver {
64174 int (*resume_early) (struct pci_dev *dev);
64175 int (*resume) (struct pci_dev *dev); /* Device woken up */
64176 void (*shutdown) (struct pci_dev *dev);
64177- struct pci_error_handlers *err_handler;
64178+ const struct pci_error_handlers *err_handler;
64179 struct device_driver driver;
64180 struct pci_dynids dynids;
64181 };
64182@@ -639,7 +639,7 @@ void pcibios_scan_specific_bus(int busn)
64183 extern struct pci_bus *pci_find_bus(int domain, int busnr);
64184 void pci_bus_add_devices(const struct pci_bus *bus);
64185 struct pci_bus *pci_scan_bus_parented(struct device *parent, int bus,
64186- struct pci_ops *ops, void *sysdata);
64187+ const struct pci_ops *ops, void *sysdata);
64188 static inline struct pci_bus * __devinit pci_scan_bus(int bus, struct pci_ops *ops,
64189 void *sysdata)
64190 {
64191@@ -650,7 +650,7 @@ static inline struct pci_bus * __devinit
64192 return root_bus;
64193 }
64194 struct pci_bus *pci_create_bus(struct device *parent, int bus,
64195- struct pci_ops *ops, void *sysdata);
64196+ const struct pci_ops *ops, void *sysdata);
64197 struct pci_bus *pci_add_new_bus(struct pci_bus *parent, struct pci_dev *dev,
64198 int busnr);
64199 void pcie_update_link_speed(struct pci_bus *bus, u16 link_status);
64200@@ -727,7 +727,7 @@ int pci_bus_write_config_word(struct pci
64201 int where, u16 val);
64202 int pci_bus_write_config_dword(struct pci_bus *bus, unsigned int devfn,
64203 int where, u32 val);
64204-struct pci_ops *pci_bus_set_ops(struct pci_bus *bus, struct pci_ops *ops);
64205+const struct pci_ops *pci_bus_set_ops(struct pci_bus *bus, const struct pci_ops *ops);
64206
64207 static inline int pci_read_config_byte(struct pci_dev *dev, int where, u8 *val)
64208 {
64209diff -urNp linux-2.6.39/include/linux/perf_event.h linux-2.6.39/include/linux/perf_event.h
64210--- linux-2.6.39/include/linux/perf_event.h 2011-05-19 00:06:34.000000000 -0400
64211+++ linux-2.6.39/include/linux/perf_event.h 2011-05-22 19:36:33.000000000 -0400
64212@@ -759,8 +759,8 @@ struct perf_event {
64213
64214 enum perf_event_active_state state;
64215 unsigned int attach_state;
64216- local64_t count;
64217- atomic64_t child_count;
64218+ local64_t count; /* PaX: fix it one day */
64219+ atomic64_unchecked_t child_count;
64220
64221 /*
64222 * These are the total time in nanoseconds that the event
64223@@ -811,8 +811,8 @@ struct perf_event {
64224 * These accumulate total time (in nanoseconds) that children
64225 * events have been enabled and running, respectively.
64226 */
64227- atomic64_t child_total_time_enabled;
64228- atomic64_t child_total_time_running;
64229+ atomic64_unchecked_t child_total_time_enabled;
64230+ atomic64_unchecked_t child_total_time_running;
64231
64232 /*
64233 * Protect attach/detach and child_list:
64234@@ -1090,9 +1090,9 @@ void perf_event_task_sched_out(struct ta
64235 }
64236
64237 extern void perf_event_mmap(struct vm_area_struct *vma);
64238-extern struct perf_guest_info_callbacks *perf_guest_cbs;
64239-extern int perf_register_guest_info_callbacks(struct perf_guest_info_callbacks *callbacks);
64240-extern int perf_unregister_guest_info_callbacks(struct perf_guest_info_callbacks *callbacks);
64241+extern const struct perf_guest_info_callbacks *perf_guest_cbs;
64242+extern int perf_register_guest_info_callbacks(const struct perf_guest_info_callbacks *callbacks);
64243+extern int perf_unregister_guest_info_callbacks(const struct perf_guest_info_callbacks *callbacks);
64244
64245 extern void perf_event_comm(struct task_struct *tsk);
64246 extern void perf_event_fork(struct task_struct *tsk);
64247diff -urNp linux-2.6.39/include/linux/pipe_fs_i.h linux-2.6.39/include/linux/pipe_fs_i.h
64248--- linux-2.6.39/include/linux/pipe_fs_i.h 2011-05-19 00:06:34.000000000 -0400
64249+++ linux-2.6.39/include/linux/pipe_fs_i.h 2011-05-22 19:36:33.000000000 -0400
64250@@ -46,9 +46,9 @@ struct pipe_buffer {
64251 struct pipe_inode_info {
64252 wait_queue_head_t wait;
64253 unsigned int nrbufs, curbuf, buffers;
64254- unsigned int readers;
64255- unsigned int writers;
64256- unsigned int waiting_writers;
64257+ atomic_t readers;
64258+ atomic_t writers;
64259+ atomic_t waiting_writers;
64260 unsigned int r_counter;
64261 unsigned int w_counter;
64262 struct page *tmp_page;
64263diff -urNp linux-2.6.39/include/linux/pm.h linux-2.6.39/include/linux/pm.h
64264--- linux-2.6.39/include/linux/pm.h 2011-05-19 00:06:34.000000000 -0400
64265+++ linux-2.6.39/include/linux/pm.h 2011-05-22 19:36:33.000000000 -0400
64266@@ -268,7 +268,7 @@ const struct dev_pm_ops name = { \
64267 * runtime PM, make the pm member point to generic_subsys_pm_ops.
64268 */
64269 #ifdef CONFIG_PM
64270-extern struct dev_pm_ops generic_subsys_pm_ops;
64271+extern const struct dev_pm_ops generic_subsys_pm_ops;
64272 #define GENERIC_SUBSYS_PM_OPS (&generic_subsys_pm_ops)
64273 #else
64274 #define GENERIC_SUBSYS_PM_OPS NULL
64275@@ -471,7 +471,7 @@ extern void update_pm_runtime_accounting
64276 * subsystem-level and driver-level callbacks.
64277 */
64278 struct dev_power_domain {
64279- struct dev_pm_ops ops;
64280+ const struct dev_pm_ops ops;
64281 };
64282
64283 /*
64284diff -urNp linux-2.6.39/include/linux/pm_runtime.h linux-2.6.39/include/linux/pm_runtime.h
64285--- linux-2.6.39/include/linux/pm_runtime.h 2011-05-19 00:06:34.000000000 -0400
64286+++ linux-2.6.39/include/linux/pm_runtime.h 2011-05-22 19:36:33.000000000 -0400
64287@@ -94,7 +94,7 @@ static inline bool pm_runtime_callbacks_
64288
64289 static inline void pm_runtime_mark_last_busy(struct device *dev)
64290 {
64291- ACCESS_ONCE(dev->power.last_busy) = jiffies;
64292+ ACCESS_ONCE_RW(dev->power.last_busy) = jiffies;
64293 }
64294
64295 #else /* !CONFIG_PM_RUNTIME */
64296diff -urNp linux-2.6.39/include/linux/poison.h linux-2.6.39/include/linux/poison.h
64297--- linux-2.6.39/include/linux/poison.h 2011-05-19 00:06:34.000000000 -0400
64298+++ linux-2.6.39/include/linux/poison.h 2011-05-22 19:36:33.000000000 -0400
64299@@ -19,8 +19,8 @@
64300 * under normal circumstances, used to verify that nobody uses
64301 * non-initialized list entries.
64302 */
64303-#define LIST_POISON1 ((void *) 0x00100100 + POISON_POINTER_DELTA)
64304-#define LIST_POISON2 ((void *) 0x00200200 + POISON_POINTER_DELTA)
64305+#define LIST_POISON1 ((void *) (long)0xFFFFFF01)
64306+#define LIST_POISON2 ((void *) (long)0xFFFFFF02)
64307
64308 /********** include/linux/timer.h **********/
64309 /*
64310diff -urNp linux-2.6.39/include/linux/posix-timers.h linux-2.6.39/include/linux/posix-timers.h
64311--- linux-2.6.39/include/linux/posix-timers.h 2011-05-19 00:06:34.000000000 -0400
64312+++ linux-2.6.39/include/linux/posix-timers.h 2011-05-22 19:36:33.000000000 -0400
64313@@ -102,10 +102,10 @@ struct k_clock {
64314 struct itimerspec * cur_setting);
64315 };
64316
64317-extern struct k_clock clock_posix_cpu;
64318-extern struct k_clock clock_posix_dynamic;
64319+extern const struct k_clock clock_posix_cpu;
64320+extern const struct k_clock clock_posix_dynamic;
64321
64322-void posix_timers_register_clock(const clockid_t clock_id, struct k_clock *new_clock);
64323+void posix_timers_register_clock(const clockid_t clock_id, const struct k_clock *new_clock);
64324
64325 /* function to call to trigger timer event */
64326 int posix_timer_event(struct k_itimer *timr, int si_private);
64327diff -urNp linux-2.6.39/include/linux/proc_fs.h linux-2.6.39/include/linux/proc_fs.h
64328--- linux-2.6.39/include/linux/proc_fs.h 2011-05-19 00:06:34.000000000 -0400
64329+++ linux-2.6.39/include/linux/proc_fs.h 2011-05-22 19:41:42.000000000 -0400
64330@@ -155,6 +155,19 @@ static inline struct proc_dir_entry *pro
64331 return proc_create_data(name, mode, parent, proc_fops, NULL);
64332 }
64333
64334+static inline struct proc_dir_entry *proc_create_grsec(const char *name, mode_t mode,
64335+ struct proc_dir_entry *parent, const struct file_operations *proc_fops)
64336+{
64337+#ifdef CONFIG_GRKERNSEC_PROC_USER
64338+ return proc_create_data(name, S_IRUSR, parent, proc_fops, NULL);
64339+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
64340+ return proc_create_data(name, S_IRUSR | S_IRGRP, parent, proc_fops, NULL);
64341+#else
64342+ return proc_create_data(name, mode, parent, proc_fops, NULL);
64343+#endif
64344+}
64345+
64346+
64347 static inline struct proc_dir_entry *create_proc_read_entry(const char *name,
64348 mode_t mode, struct proc_dir_entry *base,
64349 read_proc_t *read_proc, void * data)
64350diff -urNp linux-2.6.39/include/linux/ptrace.h linux-2.6.39/include/linux/ptrace.h
64351--- linux-2.6.39/include/linux/ptrace.h 2011-05-19 00:06:34.000000000 -0400
64352+++ linux-2.6.39/include/linux/ptrace.h 2011-05-22 19:41:42.000000000 -0400
64353@@ -115,10 +115,10 @@ extern void __ptrace_unlink(struct task_
64354 extern void exit_ptrace(struct task_struct *tracer);
64355 #define PTRACE_MODE_READ 1
64356 #define PTRACE_MODE_ATTACH 2
64357-/* Returns 0 on success, -errno on denial. */
64358-extern int __ptrace_may_access(struct task_struct *task, unsigned int mode);
64359 /* Returns true on success, false on denial. */
64360 extern bool ptrace_may_access(struct task_struct *task, unsigned int mode);
64361+/* Returns true on success, false on denial. */
64362+extern bool ptrace_may_access_log(struct task_struct *task, unsigned int mode);
64363
64364 static inline int ptrace_reparented(struct task_struct *child)
64365 {
64366diff -urNp linux-2.6.39/include/linux/random.h linux-2.6.39/include/linux/random.h
64367--- linux-2.6.39/include/linux/random.h 2011-05-19 00:06:34.000000000 -0400
64368+++ linux-2.6.39/include/linux/random.h 2011-05-22 19:36:33.000000000 -0400
64369@@ -80,12 +80,17 @@ void srandom32(u32 seed);
64370
64371 u32 prandom32(struct rnd_state *);
64372
64373+static inline unsigned long pax_get_random_long(void)
64374+{
64375+ return random32() + (sizeof(long) > 4 ? (unsigned long)random32() << 32 : 0);
64376+}
64377+
64378 /*
64379 * Handle minimum values for seeds
64380 */
64381 static inline u32 __seed(u32 x, u32 m)
64382 {
64383- return (x < m) ? x + m : x;
64384+ return (x <= m) ? x + m + 1 : x;
64385 }
64386
64387 /**
64388diff -urNp linux-2.6.39/include/linux/reboot.h linux-2.6.39/include/linux/reboot.h
64389--- linux-2.6.39/include/linux/reboot.h 2011-05-19 00:06:34.000000000 -0400
64390+++ linux-2.6.39/include/linux/reboot.h 2011-05-22 19:36:33.000000000 -0400
64391@@ -47,9 +47,9 @@ extern int unregister_reboot_notifier(st
64392 * Architecture-specific implementations of sys_reboot commands.
64393 */
64394
64395-extern void machine_restart(char *cmd);
64396-extern void machine_halt(void);
64397-extern void machine_power_off(void);
64398+extern void machine_restart(char *cmd) __noreturn;
64399+extern void machine_halt(void) __noreturn;
64400+extern void machine_power_off(void) __noreturn;
64401
64402 extern void machine_shutdown(void);
64403 struct pt_regs;
64404@@ -60,9 +60,9 @@ extern void machine_crash_shutdown(struc
64405 */
64406
64407 extern void kernel_restart_prepare(char *cmd);
64408-extern void kernel_restart(char *cmd);
64409-extern void kernel_halt(void);
64410-extern void kernel_power_off(void);
64411+extern void kernel_restart(char *cmd) __noreturn;
64412+extern void kernel_halt(void) __noreturn;
64413+extern void kernel_power_off(void) __noreturn;
64414
64415 extern int C_A_D; /* for sysctl */
64416 void ctrl_alt_del(void);
64417@@ -76,7 +76,7 @@ extern int orderly_poweroff(bool force);
64418 * Emergency restart, callable from an interrupt handler.
64419 */
64420
64421-extern void emergency_restart(void);
64422+extern void emergency_restart(void) __noreturn;
64423 #include <asm/emergency-restart.h>
64424
64425 #endif
64426diff -urNp linux-2.6.39/include/linux/reiserfs_fs.h linux-2.6.39/include/linux/reiserfs_fs.h
64427--- linux-2.6.39/include/linux/reiserfs_fs.h 2011-05-19 00:06:34.000000000 -0400
64428+++ linux-2.6.39/include/linux/reiserfs_fs.h 2011-05-22 19:36:33.000000000 -0400
64429@@ -1406,7 +1406,7 @@ static inline loff_t max_reiserfs_offset
64430 #define REISERFS_USER_MEM 1 /* reiserfs user memory mode */
64431
64432 #define fs_generation(s) (REISERFS_SB(s)->s_generation_counter)
64433-#define get_generation(s) atomic_read (&fs_generation(s))
64434+#define get_generation(s) atomic_read_unchecked (&fs_generation(s))
64435 #define FILESYSTEM_CHANGED_TB(tb) (get_generation((tb)->tb_sb) != (tb)->fs_gen)
64436 #define __fs_changed(gen,s) (gen != get_generation (s))
64437 #define fs_changed(gen,s) \
64438@@ -1618,24 +1618,24 @@ static inline struct super_block *sb_fro
64439 */
64440
64441 struct item_operations {
64442- int (*bytes_number) (struct item_head * ih, int block_size);
64443- void (*decrement_key) (struct cpu_key *);
64444- int (*is_left_mergeable) (struct reiserfs_key * ih,
64445+ int (* const bytes_number) (struct item_head * ih, int block_size);
64446+ void (* const decrement_key) (struct cpu_key *);
64447+ int (* const is_left_mergeable) (struct reiserfs_key * ih,
64448 unsigned long bsize);
64449- void (*print_item) (struct item_head *, char *item);
64450- void (*check_item) (struct item_head *, char *item);
64451+ void (* const print_item) (struct item_head *, char *item);
64452+ void (* const check_item) (struct item_head *, char *item);
64453
64454- int (*create_vi) (struct virtual_node * vn, struct virtual_item * vi,
64455+ int (* const create_vi) (struct virtual_node * vn, struct virtual_item * vi,
64456 int is_affected, int insert_size);
64457- int (*check_left) (struct virtual_item * vi, int free,
64458+ int (* const check_left) (struct virtual_item * vi, int free,
64459 int start_skip, int end_skip);
64460- int (*check_right) (struct virtual_item * vi, int free);
64461- int (*part_size) (struct virtual_item * vi, int from, int to);
64462- int (*unit_num) (struct virtual_item * vi);
64463- void (*print_vi) (struct virtual_item * vi);
64464+ int (* const check_right) (struct virtual_item * vi, int free);
64465+ int (* const part_size) (struct virtual_item * vi, int from, int to);
64466+ int (* const unit_num) (struct virtual_item * vi);
64467+ void (* const print_vi) (struct virtual_item * vi);
64468 };
64469
64470-extern struct item_operations *item_ops[TYPE_ANY + 1];
64471+extern const struct item_operations * const item_ops[TYPE_ANY + 1];
64472
64473 #define op_bytes_number(ih,bsize) item_ops[le_ih_k_type (ih)]->bytes_number (ih, bsize)
64474 #define op_is_left_mergeable(key,bsize) item_ops[le_key_k_type (le_key_version (key), key)]->is_left_mergeable (key, bsize)
64475diff -urNp linux-2.6.39/include/linux/reiserfs_fs_sb.h linux-2.6.39/include/linux/reiserfs_fs_sb.h
64476--- linux-2.6.39/include/linux/reiserfs_fs_sb.h 2011-05-19 00:06:34.000000000 -0400
64477+++ linux-2.6.39/include/linux/reiserfs_fs_sb.h 2011-05-22 19:36:33.000000000 -0400
64478@@ -386,7 +386,7 @@ struct reiserfs_sb_info {
64479 /* Comment? -Hans */
64480 wait_queue_head_t s_wait;
64481 /* To be obsoleted soon by per buffer seals.. -Hans */
64482- atomic_t s_generation_counter; // increased by one every time the
64483+ atomic_unchecked_t s_generation_counter; // increased by one every time the
64484 // tree gets re-balanced
64485 unsigned long s_properties; /* File system properties. Currently holds
64486 on-disk FS format */
64487diff -urNp linux-2.6.39/include/linux/rmap.h linux-2.6.39/include/linux/rmap.h
64488--- linux-2.6.39/include/linux/rmap.h 2011-05-19 00:06:34.000000000 -0400
64489+++ linux-2.6.39/include/linux/rmap.h 2011-05-22 19:36:33.000000000 -0400
64490@@ -119,8 +119,8 @@ static inline void anon_vma_unlock(struc
64491 void anon_vma_init(void); /* create anon_vma_cachep */
64492 int anon_vma_prepare(struct vm_area_struct *);
64493 void unlink_anon_vmas(struct vm_area_struct *);
64494-int anon_vma_clone(struct vm_area_struct *, struct vm_area_struct *);
64495-int anon_vma_fork(struct vm_area_struct *, struct vm_area_struct *);
64496+int anon_vma_clone(struct vm_area_struct *, const struct vm_area_struct *);
64497+int anon_vma_fork(struct vm_area_struct *, const struct vm_area_struct *);
64498 void __anon_vma_link(struct vm_area_struct *);
64499
64500 static inline void anon_vma_merge(struct vm_area_struct *vma,
64501diff -urNp linux-2.6.39/include/linux/sched.h linux-2.6.39/include/linux/sched.h
64502--- linux-2.6.39/include/linux/sched.h 2011-05-19 00:06:34.000000000 -0400
64503+++ linux-2.6.39/include/linux/sched.h 2011-05-22 19:41:42.000000000 -0400
64504@@ -100,6 +100,7 @@ struct bio_list;
64505 struct fs_struct;
64506 struct perf_event_context;
64507 struct blk_plug;
64508+struct linux_binprm;
64509
64510 /*
64511 * List of flags we want to share for kernel threads,
64512@@ -360,7 +361,7 @@ extern signed long schedule_timeout_inte
64513 extern signed long schedule_timeout_killable(signed long timeout);
64514 extern signed long schedule_timeout_uninterruptible(signed long timeout);
64515 asmlinkage void schedule(void);
64516-extern int mutex_spin_on_owner(struct mutex *lock, struct thread_info *owner);
64517+extern int mutex_spin_on_owner(struct mutex *lock, struct task_struct *owner);
64518
64519 struct nsproxy;
64520 struct user_namespace;
64521@@ -381,10 +382,13 @@ struct user_namespace;
64522 #define DEFAULT_MAX_MAP_COUNT (USHRT_MAX - MAPCOUNT_ELF_CORE_MARGIN)
64523
64524 extern int sysctl_max_map_count;
64525+extern unsigned long sysctl_heap_stack_gap;
64526
64527 #include <linux/aio.h>
64528
64529 #ifdef CONFIG_MMU
64530+extern bool check_heap_stack_gap(const struct vm_area_struct *vma, unsigned long addr, unsigned long len);
64531+extern unsigned long skip_heap_stack_gap(const struct vm_area_struct *vma, unsigned long len);
64532 extern void arch_pick_mmap_layout(struct mm_struct *mm);
64533 extern unsigned long
64534 arch_get_unmapped_area(struct file *, unsigned long, unsigned long,
64535@@ -629,6 +633,17 @@ struct signal_struct {
64536 #ifdef CONFIG_TASKSTATS
64537 struct taskstats *stats;
64538 #endif
64539+
64540+#ifdef CONFIG_GRKERNSEC
64541+ u32 curr_ip;
64542+ u32 saved_ip;
64543+ u32 gr_saddr;
64544+ u32 gr_daddr;
64545+ u16 gr_sport;
64546+ u16 gr_dport;
64547+ u8 used_accept:1;
64548+#endif
64549+
64550 #ifdef CONFIG_AUDIT
64551 unsigned audit_tty;
64552 struct tty_audit_buf *tty_audit_buf;
64553@@ -701,6 +716,11 @@ struct user_struct {
64554 struct key *session_keyring; /* UID's default session keyring */
64555 #endif
64556
64557+#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
64558+ unsigned int banned;
64559+ unsigned long ban_expires;
64560+#endif
64561+
64562 /* Hash table maintenance information */
64563 struct hlist_node uidhash_node;
64564 uid_t uid;
64565@@ -1310,8 +1330,8 @@ struct task_struct {
64566 struct list_head thread_group;
64567
64568 struct completion *vfork_done; /* for vfork() */
64569- int __user *set_child_tid; /* CLONE_CHILD_SETTID */
64570- int __user *clear_child_tid; /* CLONE_CHILD_CLEARTID */
64571+ pid_t __user *set_child_tid; /* CLONE_CHILD_SETTID */
64572+ pid_t __user *clear_child_tid; /* CLONE_CHILD_CLEARTID */
64573
64574 cputime_t utime, stime, utimescaled, stimescaled;
64575 cputime_t gtime;
64576@@ -1327,13 +1347,6 @@ struct task_struct {
64577 struct task_cputime cputime_expires;
64578 struct list_head cpu_timers[3];
64579
64580-/* process credentials */
64581- const struct cred __rcu *real_cred; /* objective and real subjective task
64582- * credentials (COW) */
64583- const struct cred __rcu *cred; /* effective (overridable) subjective task
64584- * credentials (COW) */
64585- struct cred *replacement_session_keyring; /* for KEYCTL_SESSION_TO_PARENT */
64586-
64587 char comm[TASK_COMM_LEN]; /* executable name excluding path
64588 - access with [gs]et_task_comm (which lock
64589 it with task_lock())
64590@@ -1350,8 +1363,16 @@ struct task_struct {
64591 #endif
64592 /* CPU-specific state of this task */
64593 struct thread_struct thread;
64594+/* thread_info moved to task_struct */
64595+#ifdef CONFIG_X86
64596+ struct thread_info tinfo;
64597+#endif
64598 /* filesystem information */
64599 struct fs_struct *fs;
64600+
64601+ const struct cred __rcu *cred; /* effective (overridable) subjective task
64602+ * credentials (COW) */
64603+
64604 /* open file information */
64605 struct files_struct *files;
64606 /* namespaces */
64607@@ -1398,6 +1419,11 @@ struct task_struct {
64608 struct rt_mutex_waiter *pi_blocked_on;
64609 #endif
64610
64611+/* process credentials */
64612+ const struct cred __rcu *real_cred; /* objective and real subjective task
64613+ * credentials (COW) */
64614+ struct cred *replacement_session_keyring; /* for KEYCTL_SESSION_TO_PARENT */
64615+
64616 #ifdef CONFIG_DEBUG_MUTEXES
64617 /* mutex deadlock detection */
64618 struct mutex_waiter *blocked_on;
64619@@ -1508,6 +1534,21 @@ struct task_struct {
64620 unsigned long default_timer_slack_ns;
64621
64622 struct list_head *scm_work_list;
64623+
64624+#ifdef CONFIG_GRKERNSEC
64625+ /* grsecurity */
64626+ struct dentry *gr_chroot_dentry;
64627+ struct acl_subject_label *acl;
64628+ struct acl_role_label *role;
64629+ struct file *exec_file;
64630+ u16 acl_role_id;
64631+ /* is this the task that authenticated to the special role */
64632+ u8 acl_sp_role;
64633+ u8 is_writable;
64634+ u8 brute;
64635+ u8 gr_is_chrooted;
64636+#endif
64637+
64638 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
64639 /* Index of current stored address in ret_stack */
64640 int curr_ret_stack;
64641@@ -1542,6 +1583,63 @@ struct task_struct {
64642 #endif
64643 };
64644
64645+#define MF_PAX_PAGEEXEC 0x01000000 /* Paging based non-executable pages */
64646+#define MF_PAX_EMUTRAMP 0x02000000 /* Emulate trampolines */
64647+#define MF_PAX_MPROTECT 0x04000000 /* Restrict mprotect() */
64648+#define MF_PAX_RANDMMAP 0x08000000 /* Randomize mmap() base */
64649+/*#define MF_PAX_RANDEXEC 0x10000000*/ /* Randomize ET_EXEC base */
64650+#define MF_PAX_SEGMEXEC 0x20000000 /* Segmentation based non-executable pages */
64651+
64652+#ifdef CONFIG_PAX_SOFTMODE
64653+extern unsigned int pax_softmode;
64654+#endif
64655+
64656+extern int pax_check_flags(unsigned long *);
64657+
64658+/* if tsk != current then task_lock must be held on it */
64659+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
64660+static inline unsigned long pax_get_flags(struct task_struct *tsk)
64661+{
64662+ if (likely(tsk->mm))
64663+ return tsk->mm->pax_flags;
64664+ else
64665+ return 0UL;
64666+}
64667+
64668+/* if tsk != current then task_lock must be held on it */
64669+static inline long pax_set_flags(struct task_struct *tsk, unsigned long flags)
64670+{
64671+ if (likely(tsk->mm)) {
64672+ tsk->mm->pax_flags = flags;
64673+ return 0;
64674+ }
64675+ return -EINVAL;
64676+}
64677+#endif
64678+
64679+#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
64680+extern void pax_set_initial_flags(struct linux_binprm *bprm);
64681+#elif defined(CONFIG_PAX_HOOK_ACL_FLAGS)
64682+extern void (*pax_set_initial_flags_func)(struct linux_binprm *bprm);
64683+#endif
64684+
64685+void pax_report_fault(struct pt_regs *regs, void *pc, void *sp);
64686+void pax_report_insns(void *pc, void *sp);
64687+void pax_report_refcount_overflow(struct pt_regs *regs);
64688+void pax_report_usercopy(const void *ptr, unsigned long len, bool to, const char *type);
64689+
64690+static inline void pax_track_stack(void)
64691+{
64692+
64693+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
64694+ unsigned long sp = current_stack_pointer;
64695+ if (current_thread_info()->lowest_stack > sp &&
64696+ (unsigned long)task_stack_page(current) < sp)
64697+ current_thread_info()->lowest_stack = sp;
64698+#endif
64699+
64700+}
64701+
64702 /* Future-safe accessor for struct task_struct's cpus_allowed. */
64703 #define tsk_cpus_allowed(tsk) (&(tsk)->cpus_allowed)
64704
64705@@ -2009,7 +2107,9 @@ void yield(void);
64706 extern struct exec_domain default_exec_domain;
64707
64708 union thread_union {
64709+#ifndef CONFIG_X86
64710 struct thread_info thread_info;
64711+#endif
64712 unsigned long stack[THREAD_SIZE/sizeof(long)];
64713 };
64714
64715@@ -2179,7 +2279,7 @@ extern void __cleanup_sighand(struct sig
64716 extern void exit_itimers(struct signal_struct *);
64717 extern void flush_itimer_signals(void);
64718
64719-extern NORET_TYPE void do_group_exit(int);
64720+extern NORET_TYPE void do_group_exit(int) ATTRIB_NORET;
64721
64722 extern void daemonize(const char *, ...);
64723 extern int allow_signal(int);
64724@@ -2320,13 +2420,17 @@ static inline unsigned long *end_of_stac
64725
64726 #endif
64727
64728-static inline int object_is_on_stack(void *obj)
64729+static inline int object_starts_on_stack(void *obj)
64730 {
64731- void *stack = task_stack_page(current);
64732+ const void *stack = task_stack_page(current);
64733
64734 return (obj >= stack) && (obj < (stack + THREAD_SIZE));
64735 }
64736
64737+#ifdef CONFIG_PAX_USERCOPY
64738+extern int object_is_on_stack(const void *obj, unsigned long len);
64739+#endif
64740+
64741 extern void thread_info_cache_init(void);
64742
64743 #ifdef CONFIG_DEBUG_STACK_USAGE
64744diff -urNp linux-2.6.39/include/linux/screen_info.h linux-2.6.39/include/linux/screen_info.h
64745--- linux-2.6.39/include/linux/screen_info.h 2011-05-19 00:06:34.000000000 -0400
64746+++ linux-2.6.39/include/linux/screen_info.h 2011-05-22 19:36:33.000000000 -0400
64747@@ -43,7 +43,8 @@ struct screen_info {
64748 __u16 pages; /* 0x32 */
64749 __u16 vesa_attributes; /* 0x34 */
64750 __u32 capabilities; /* 0x36 */
64751- __u8 _reserved[6]; /* 0x3a */
64752+ __u16 vesapm_size; /* 0x3a */
64753+ __u8 _reserved[4]; /* 0x3c */
64754 } __attribute__((packed));
64755
64756 #define VIDEO_TYPE_MDA 0x10 /* Monochrome Text Display */
64757diff -urNp linux-2.6.39/include/linux/security.h linux-2.6.39/include/linux/security.h
64758--- linux-2.6.39/include/linux/security.h 2011-05-19 00:06:34.000000000 -0400
64759+++ linux-2.6.39/include/linux/security.h 2011-05-22 19:41:42.000000000 -0400
64760@@ -36,6 +36,7 @@
64761 #include <linux/key.h>
64762 #include <linux/xfrm.h>
64763 #include <linux/slab.h>
64764+#include <linux/grsecurity.h>
64765 #include <net/flow.h>
64766
64767 /* Maximum number of letters for an LSM name string */
64768diff -urNp linux-2.6.39/include/linux/shm.h linux-2.6.39/include/linux/shm.h
64769--- linux-2.6.39/include/linux/shm.h 2011-05-19 00:06:34.000000000 -0400
64770+++ linux-2.6.39/include/linux/shm.h 2011-05-22 19:41:42.000000000 -0400
64771@@ -95,6 +95,10 @@ struct shmid_kernel /* private to the ke
64772 pid_t shm_cprid;
64773 pid_t shm_lprid;
64774 struct user_struct *mlock_user;
64775+#ifdef CONFIG_GRKERNSEC
64776+ time_t shm_createtime;
64777+ pid_t shm_lapid;
64778+#endif
64779 };
64780
64781 /* shm_mode upper byte flags */
64782diff -urNp linux-2.6.39/include/linux/skbuff.h linux-2.6.39/include/linux/skbuff.h
64783--- linux-2.6.39/include/linux/skbuff.h 2011-05-19 00:06:34.000000000 -0400
64784+++ linux-2.6.39/include/linux/skbuff.h 2011-05-22 19:36:33.000000000 -0400
64785@@ -592,7 +592,7 @@ static inline struct skb_shared_hwtstamp
64786 */
64787 static inline int skb_queue_empty(const struct sk_buff_head *list)
64788 {
64789- return list->next == (struct sk_buff *)list;
64790+ return list->next == (const struct sk_buff *)list;
64791 }
64792
64793 /**
64794@@ -605,7 +605,7 @@ static inline int skb_queue_empty(const
64795 static inline bool skb_queue_is_last(const struct sk_buff_head *list,
64796 const struct sk_buff *skb)
64797 {
64798- return skb->next == (struct sk_buff *)list;
64799+ return skb->next == (const struct sk_buff *)list;
64800 }
64801
64802 /**
64803@@ -618,7 +618,7 @@ static inline bool skb_queue_is_last(con
64804 static inline bool skb_queue_is_first(const struct sk_buff_head *list,
64805 const struct sk_buff *skb)
64806 {
64807- return skb->prev == (struct sk_buff *)list;
64808+ return skb->prev == (const struct sk_buff *)list;
64809 }
64810
64811 /**
64812@@ -1435,7 +1435,7 @@ static inline int pskb_network_may_pull(
64813 * NET_IP_ALIGN(2) + ethernet_header(14) + IP_header(20/40) + ports(8)
64814 */
64815 #ifndef NET_SKB_PAD
64816-#define NET_SKB_PAD max(32, L1_CACHE_BYTES)
64817+#define NET_SKB_PAD max(_AC(32,U), L1_CACHE_BYTES)
64818 #endif
64819
64820 extern int ___pskb_trim(struct sk_buff *skb, unsigned int len);
64821diff -urNp linux-2.6.39/include/linux/slab_def.h linux-2.6.39/include/linux/slab_def.h
64822--- linux-2.6.39/include/linux/slab_def.h 2011-05-19 00:06:34.000000000 -0400
64823+++ linux-2.6.39/include/linux/slab_def.h 2011-05-22 19:36:33.000000000 -0400
64824@@ -96,10 +96,10 @@ struct kmem_cache {
64825 unsigned long node_allocs;
64826 unsigned long node_frees;
64827 unsigned long node_overflow;
64828- atomic_t allochit;
64829- atomic_t allocmiss;
64830- atomic_t freehit;
64831- atomic_t freemiss;
64832+ atomic_unchecked_t allochit;
64833+ atomic_unchecked_t allocmiss;
64834+ atomic_unchecked_t freehit;
64835+ atomic_unchecked_t freemiss;
64836
64837 /*
64838 * If debugging is enabled, then the allocator can add additional
64839diff -urNp linux-2.6.39/include/linux/slab.h linux-2.6.39/include/linux/slab.h
64840--- linux-2.6.39/include/linux/slab.h 2011-05-19 00:06:34.000000000 -0400
64841+++ linux-2.6.39/include/linux/slab.h 2011-05-23 17:07:00.000000000 -0400
64842@@ -11,12 +11,20 @@
64843
64844 #include <linux/gfp.h>
64845 #include <linux/types.h>
64846+#include <linux/err.h>
64847
64848 /*
64849 * Flags to pass to kmem_cache_create().
64850 * The ones marked DEBUG are only valid if CONFIG_SLAB_DEBUG is set.
64851 */
64852 #define SLAB_DEBUG_FREE 0x00000100UL /* DEBUG: Perform (expensive) checks on free */
64853+
64854+#ifdef CONFIG_PAX_USERCOPY
64855+#define SLAB_USERCOPY 0x00000200UL /* PaX: Allow copying objs to/from userland */
64856+#else
64857+#define SLAB_USERCOPY 0x00000000UL
64858+#endif
64859+
64860 #define SLAB_RED_ZONE 0x00000400UL /* DEBUG: Red zone objs in a cache */
64861 #define SLAB_POISON 0x00000800UL /* DEBUG: Poison objects */
64862 #define SLAB_HWCACHE_ALIGN 0x00002000UL /* Align objs on cache lines */
64863@@ -87,10 +95,13 @@
64864 * ZERO_SIZE_PTR can be passed to kfree though in the same way that NULL can.
64865 * Both make kfree a no-op.
64866 */
64867-#define ZERO_SIZE_PTR ((void *)16)
64868+#define ZERO_SIZE_PTR \
64869+({ \
64870+ BUILD_BUG_ON(!(MAX_ERRNO & ~PAGE_MASK));\
64871+ (void *)(-MAX_ERRNO-1L); \
64872+})
64873
64874-#define ZERO_OR_NULL_PTR(x) ((unsigned long)(x) <= \
64875- (unsigned long)ZERO_SIZE_PTR)
64876+#define ZERO_OR_NULL_PTR(x) ((unsigned long)(x) - 1 >= (unsigned long)ZERO_SIZE_PTR - 1)
64877
64878 /*
64879 * struct kmem_cache related prototypes
64880@@ -141,6 +152,7 @@ void * __must_check krealloc(const void
64881 void kfree(const void *);
64882 void kzfree(const void *);
64883 size_t ksize(const void *);
64884+void check_object_size(const void *ptr, unsigned long n, bool to);
64885
64886 /*
64887 * Allocator specific definitions. These are mainly used to establish optimized
64888@@ -333,4 +345,59 @@ static inline void *kzalloc_node(size_t
64889
64890 void __init kmem_cache_init_late(void);
64891
64892+#define kmalloc(x, y) \
64893+({ \
64894+ void *___retval; \
64895+ intoverflow_t ___x = (intoverflow_t)x; \
64896+ if (WARN(___x > ULONG_MAX, "kmalloc size overflow\n")) \
64897+ ___retval = NULL; \
64898+ else \
64899+ ___retval = kmalloc((size_t)___x, (y)); \
64900+ ___retval; \
64901+})
64902+
64903+#define kmalloc_node(x, y, z) \
64904+({ \
64905+ void *___retval; \
64906+ intoverflow_t ___x = (intoverflow_t)x; \
64907+ if (WARN(___x > ULONG_MAX, "kmalloc_node size overflow\n"))\
64908+ ___retval = NULL; \
64909+ else \
64910+ ___retval = kmalloc_node((size_t)___x, (y), (z));\
64911+ ___retval; \
64912+})
64913+
64914+#define kzalloc(x, y) \
64915+({ \
64916+ void *___retval; \
64917+ intoverflow_t ___x = (intoverflow_t)x; \
64918+ if (WARN(___x > ULONG_MAX, "kzalloc size overflow\n")) \
64919+ ___retval = NULL; \
64920+ else \
64921+ ___retval = kzalloc((size_t)___x, (y)); \
64922+ ___retval; \
64923+})
64924+
64925+#define __krealloc(x, y, z) \
64926+({ \
64927+ void *___retval; \
64928+ intoverflow_t ___y = (intoverflow_t)y; \
64929+ if (WARN(___y > ULONG_MAX, "__krealloc size overflow\n"))\
64930+ ___retval = NULL; \
64931+ else \
64932+ ___retval = __krealloc((x), (size_t)___y, (z)); \
64933+ ___retval; \
64934+})
64935+
64936+#define krealloc(x, y, z) \
64937+({ \
64938+ void *___retval; \
64939+ intoverflow_t ___y = (intoverflow_t)y; \
64940+ if (WARN(___y > ULONG_MAX, "krealloc size overflow\n")) \
64941+ ___retval = NULL; \
64942+ else \
64943+ ___retval = krealloc((x), (size_t)___y, (z)); \
64944+ ___retval; \
64945+})
64946+
64947 #endif /* _LINUX_SLAB_H */
64948diff -urNp linux-2.6.39/include/linux/slub_def.h linux-2.6.39/include/linux/slub_def.h
64949--- linux-2.6.39/include/linux/slub_def.h 2011-05-19 00:06:34.000000000 -0400
64950+++ linux-2.6.39/include/linux/slub_def.h 2011-05-22 19:36:33.000000000 -0400
64951@@ -84,7 +84,7 @@ struct kmem_cache {
64952 struct kmem_cache_order_objects max;
64953 struct kmem_cache_order_objects min;
64954 gfp_t allocflags; /* gfp flags to use on each alloc */
64955- int refcount; /* Refcount for slab cache destroy */
64956+ atomic_t refcount; /* Refcount for slab cache destroy */
64957 void (*ctor)(void *);
64958 int inuse; /* Offset to metadata */
64959 int align; /* Alignment */
64960diff -urNp linux-2.6.39/include/linux/sonet.h linux-2.6.39/include/linux/sonet.h
64961--- linux-2.6.39/include/linux/sonet.h 2011-05-19 00:06:34.000000000 -0400
64962+++ linux-2.6.39/include/linux/sonet.h 2011-05-22 19:36:33.000000000 -0400
64963@@ -61,7 +61,7 @@ struct sonet_stats {
64964 #include <asm/atomic.h>
64965
64966 struct k_sonet_stats {
64967-#define __HANDLE_ITEM(i) atomic_t i
64968+#define __HANDLE_ITEM(i) atomic_unchecked_t i
64969 __SONET_ITEMS
64970 #undef __HANDLE_ITEM
64971 };
64972diff -urNp linux-2.6.39/include/linux/ssb/ssb_driver_gige.h linux-2.6.39/include/linux/ssb/ssb_driver_gige.h
64973--- linux-2.6.39/include/linux/ssb/ssb_driver_gige.h 2011-05-19 00:06:34.000000000 -0400
64974+++ linux-2.6.39/include/linux/ssb/ssb_driver_gige.h 2011-05-22 19:36:33.000000000 -0400
64975@@ -44,7 +44,7 @@ struct ssb_gige {
64976
64977 /* The PCI controller device. */
64978 struct pci_controller pci_controller;
64979- struct pci_ops pci_ops;
64980+ const struct pci_ops pci_ops;
64981 struct resource mem_resource;
64982 struct resource io_resource;
64983 };
64984diff -urNp linux-2.6.39/include/linux/sunrpc/clnt.h linux-2.6.39/include/linux/sunrpc/clnt.h
64985--- linux-2.6.39/include/linux/sunrpc/clnt.h 2011-05-19 00:06:34.000000000 -0400
64986+++ linux-2.6.39/include/linux/sunrpc/clnt.h 2011-05-22 19:36:33.000000000 -0400
64987@@ -169,9 +169,9 @@ static inline unsigned short rpc_get_por
64988 {
64989 switch (sap->sa_family) {
64990 case AF_INET:
64991- return ntohs(((struct sockaddr_in *)sap)->sin_port);
64992+ return ntohs(((const struct sockaddr_in *)sap)->sin_port);
64993 case AF_INET6:
64994- return ntohs(((struct sockaddr_in6 *)sap)->sin6_port);
64995+ return ntohs(((const struct sockaddr_in6 *)sap)->sin6_port);
64996 }
64997 return 0;
64998 }
64999@@ -204,7 +204,7 @@ static inline bool __rpc_cmp_addr4(const
65000 static inline bool __rpc_copy_addr4(struct sockaddr *dst,
65001 const struct sockaddr *src)
65002 {
65003- const struct sockaddr_in *ssin = (struct sockaddr_in *) src;
65004+ const struct sockaddr_in *ssin = (const struct sockaddr_in *) src;
65005 struct sockaddr_in *dsin = (struct sockaddr_in *) dst;
65006
65007 dsin->sin_family = ssin->sin_family;
65008@@ -301,7 +301,7 @@ static inline u32 rpc_get_scope_id(const
65009 if (sa->sa_family != AF_INET6)
65010 return 0;
65011
65012- return ((struct sockaddr_in6 *) sa)->sin6_scope_id;
65013+ return ((const struct sockaddr_in6 *) sa)->sin6_scope_id;
65014 }
65015
65016 #endif /* __KERNEL__ */
65017diff -urNp linux-2.6.39/include/linux/sunrpc/svc_rdma.h linux-2.6.39/include/linux/sunrpc/svc_rdma.h
65018--- linux-2.6.39/include/linux/sunrpc/svc_rdma.h 2011-05-19 00:06:34.000000000 -0400
65019+++ linux-2.6.39/include/linux/sunrpc/svc_rdma.h 2011-05-22 19:36:33.000000000 -0400
65020@@ -53,15 +53,15 @@ extern unsigned int svcrdma_ord;
65021 extern unsigned int svcrdma_max_requests;
65022 extern unsigned int svcrdma_max_req_size;
65023
65024-extern atomic_t rdma_stat_recv;
65025-extern atomic_t rdma_stat_read;
65026-extern atomic_t rdma_stat_write;
65027-extern atomic_t rdma_stat_sq_starve;
65028-extern atomic_t rdma_stat_rq_starve;
65029-extern atomic_t rdma_stat_rq_poll;
65030-extern atomic_t rdma_stat_rq_prod;
65031-extern atomic_t rdma_stat_sq_poll;
65032-extern atomic_t rdma_stat_sq_prod;
65033+extern atomic_unchecked_t rdma_stat_recv;
65034+extern atomic_unchecked_t rdma_stat_read;
65035+extern atomic_unchecked_t rdma_stat_write;
65036+extern atomic_unchecked_t rdma_stat_sq_starve;
65037+extern atomic_unchecked_t rdma_stat_rq_starve;
65038+extern atomic_unchecked_t rdma_stat_rq_poll;
65039+extern atomic_unchecked_t rdma_stat_rq_prod;
65040+extern atomic_unchecked_t rdma_stat_sq_poll;
65041+extern atomic_unchecked_t rdma_stat_sq_prod;
65042
65043 #define RPCRDMA_VERSION 1
65044
65045diff -urNp linux-2.6.39/include/linux/suspend.h linux-2.6.39/include/linux/suspend.h
65046--- linux-2.6.39/include/linux/suspend.h 2011-05-19 00:06:34.000000000 -0400
65047+++ linux-2.6.39/include/linux/suspend.h 2011-05-22 19:36:33.000000000 -0400
65048@@ -106,15 +106,15 @@ typedef int __bitwise suspend_state_t;
65049 * which require special recovery actions in that situation.
65050 */
65051 struct platform_suspend_ops {
65052- int (*valid)(suspend_state_t state);
65053- int (*begin)(suspend_state_t state);
65054- int (*prepare)(void);
65055- int (*prepare_late)(void);
65056- int (*enter)(suspend_state_t state);
65057- void (*wake)(void);
65058- void (*finish)(void);
65059- void (*end)(void);
65060- void (*recover)(void);
65061+ int (* const valid)(suspend_state_t state);
65062+ int (* const begin)(suspend_state_t state);
65063+ int (* const prepare)(void);
65064+ int (* const prepare_late)(void);
65065+ int (* const enter)(suspend_state_t state);
65066+ void (* const wake)(void);
65067+ void (* const finish)(void);
65068+ void (* const end)(void);
65069+ void (* const recover)(void);
65070 };
65071
65072 #ifdef CONFIG_SUSPEND
65073@@ -217,16 +217,16 @@ extern void mark_free_pages(struct zone
65074 * platforms which require special recovery actions in that situation.
65075 */
65076 struct platform_hibernation_ops {
65077- int (*begin)(void);
65078- void (*end)(void);
65079- int (*pre_snapshot)(void);
65080- void (*finish)(void);
65081- int (*prepare)(void);
65082- int (*enter)(void);
65083- void (*leave)(void);
65084- int (*pre_restore)(void);
65085- void (*restore_cleanup)(void);
65086- void (*recover)(void);
65087+ int (* const begin)(void);
65088+ void (* const end)(void);
65089+ int (* const pre_snapshot)(void);
65090+ void (* const finish)(void);
65091+ int (* const prepare)(void);
65092+ int (* const enter)(void);
65093+ void (* const leave)(void);
65094+ int (* const pre_restore)(void);
65095+ void (* const restore_cleanup)(void);
65096+ void (* const recover)(void);
65097 };
65098
65099 #ifdef CONFIG_HIBERNATION
65100diff -urNp linux-2.6.39/include/linux/sysctl.h linux-2.6.39/include/linux/sysctl.h
65101--- linux-2.6.39/include/linux/sysctl.h 2011-05-19 00:06:34.000000000 -0400
65102+++ linux-2.6.39/include/linux/sysctl.h 2011-05-22 19:41:42.000000000 -0400
65103@@ -155,7 +155,11 @@ enum
65104 KERN_PANIC_ON_NMI=76, /* int: whether we will panic on an unrecovered */
65105 };
65106
65107-
65108+#ifdef CONFIG_PAX_SOFTMODE
65109+enum {
65110+ PAX_SOFTMODE=1 /* PaX: disable/enable soft mode */
65111+};
65112+#endif
65113
65114 /* CTL_VM names: */
65115 enum
65116@@ -967,6 +971,8 @@ typedef int proc_handler (struct ctl_tab
65117
65118 extern int proc_dostring(struct ctl_table *, int,
65119 void __user *, size_t *, loff_t *);
65120+extern int proc_dostring_modpriv(struct ctl_table *, int,
65121+ void __user *, size_t *, loff_t *);
65122 extern int proc_dointvec(struct ctl_table *, int,
65123 void __user *, size_t *, loff_t *);
65124 extern int proc_dointvec_minmax(struct ctl_table *, int,
65125diff -urNp linux-2.6.39/include/linux/sysfs.h linux-2.6.39/include/linux/sysfs.h
65126--- linux-2.6.39/include/linux/sysfs.h 2011-05-19 00:06:34.000000000 -0400
65127+++ linux-2.6.39/include/linux/sysfs.h 2011-05-22 19:36:33.000000000 -0400
65128@@ -110,8 +110,8 @@ struct bin_attribute {
65129 #define sysfs_bin_attr_init(bin_attr) sysfs_attr_init(&(bin_attr)->attr)
65130
65131 struct sysfs_ops {
65132- ssize_t (*show)(struct kobject *, struct attribute *,char *);
65133- ssize_t (*store)(struct kobject *,struct attribute *,const char *, size_t);
65134+ ssize_t (* const show)(struct kobject *, struct attribute *,char *);
65135+ ssize_t (* const store)(struct kobject *,struct attribute *,const char *, size_t);
65136 };
65137
65138 struct sysfs_dirent;
65139diff -urNp linux-2.6.39/include/linux/tty.h linux-2.6.39/include/linux/tty.h
65140--- linux-2.6.39/include/linux/tty.h 2011-05-19 00:06:34.000000000 -0400
65141+++ linux-2.6.39/include/linux/tty.h 2011-05-22 19:36:33.000000000 -0400
65142@@ -13,6 +13,7 @@
65143 #include <linux/tty_driver.h>
65144 #include <linux/tty_ldisc.h>
65145 #include <linux/mutex.h>
65146+#include <linux/poll.h>
65147
65148 #include <asm/system.h>
65149
65150@@ -466,7 +467,6 @@ extern int tty_perform_flush(struct tty_
65151 extern dev_t tty_devnum(struct tty_struct *tty);
65152 extern void proc_clear_tty(struct task_struct *p);
65153 extern struct tty_struct *get_current_tty(void);
65154-extern void tty_default_fops(struct file_operations *fops);
65155 extern struct tty_struct *alloc_tty_struct(void);
65156 extern int tty_add_file(struct tty_struct *tty, struct file *file);
65157 extern void free_tty_struct(struct tty_struct *tty);
65158@@ -529,6 +529,18 @@ extern void tty_ldisc_begin(void);
65159 /* This last one is just for the tty layer internals and shouldn't be used elsewhere */
65160 extern void tty_ldisc_enable(struct tty_struct *tty);
65161
65162+/* tty_io.c */
65163+extern ssize_t tty_read(struct file *, char __user *, size_t, loff_t *);
65164+extern ssize_t tty_write(struct file *, const char __user *, size_t, loff_t *);
65165+extern unsigned int tty_poll(struct file *, poll_table *);
65166+#ifdef CONFIG_COMPAT
65167+extern long tty_compat_ioctl(struct file *file, unsigned int cmd,
65168+ unsigned long arg);
65169+#else
65170+#define tty_compat_ioctl NULL
65171+#endif
65172+extern int tty_release(struct inode *, struct file *);
65173+extern int tty_fasync(int fd, struct file *filp, int on);
65174
65175 /* n_tty.c */
65176 extern struct tty_ldisc_ops tty_ldisc_N_TTY;
65177diff -urNp linux-2.6.39/include/linux/tty_ldisc.h linux-2.6.39/include/linux/tty_ldisc.h
65178--- linux-2.6.39/include/linux/tty_ldisc.h 2011-05-19 00:06:34.000000000 -0400
65179+++ linux-2.6.39/include/linux/tty_ldisc.h 2011-05-22 19:36:33.000000000 -0400
65180@@ -148,7 +148,7 @@ struct tty_ldisc_ops {
65181
65182 struct module *owner;
65183
65184- int refcount;
65185+ atomic_t refcount;
65186 };
65187
65188 struct tty_ldisc {
65189diff -urNp linux-2.6.39/include/linux/types.h linux-2.6.39/include/linux/types.h
65190--- linux-2.6.39/include/linux/types.h 2011-05-19 00:06:34.000000000 -0400
65191+++ linux-2.6.39/include/linux/types.h 2011-05-22 19:36:33.000000000 -0400
65192@@ -213,10 +213,26 @@ typedef struct {
65193 int counter;
65194 } atomic_t;
65195
65196+#ifdef CONFIG_PAX_REFCOUNT
65197+typedef struct {
65198+ int counter;
65199+} atomic_unchecked_t;
65200+#else
65201+typedef atomic_t atomic_unchecked_t;
65202+#endif
65203+
65204 #ifdef CONFIG_64BIT
65205 typedef struct {
65206 long counter;
65207 } atomic64_t;
65208+
65209+#ifdef CONFIG_PAX_REFCOUNT
65210+typedef struct {
65211+ long counter;
65212+} atomic64_unchecked_t;
65213+#else
65214+typedef atomic64_t atomic64_unchecked_t;
65215+#endif
65216 #endif
65217
65218 struct list_head {
65219diff -urNp linux-2.6.39/include/linux/uaccess.h linux-2.6.39/include/linux/uaccess.h
65220--- linux-2.6.39/include/linux/uaccess.h 2011-05-19 00:06:34.000000000 -0400
65221+++ linux-2.6.39/include/linux/uaccess.h 2011-05-22 19:36:33.000000000 -0400
65222@@ -76,11 +76,11 @@ static inline unsigned long __copy_from_
65223 long ret; \
65224 mm_segment_t old_fs = get_fs(); \
65225 \
65226- set_fs(KERNEL_DS); \
65227 pagefault_disable(); \
65228+ set_fs(KERNEL_DS); \
65229 ret = __copy_from_user_inatomic(&(retval), (__force typeof(retval) __user *)(addr), sizeof(retval)); \
65230- pagefault_enable(); \
65231 set_fs(old_fs); \
65232+ pagefault_enable(); \
65233 ret; \
65234 })
65235
65236@@ -93,8 +93,8 @@ static inline unsigned long __copy_from_
65237 * Safely read from address @src to the buffer at @dst. If a kernel fault
65238 * happens, handle that and return -EFAULT.
65239 */
65240-extern long probe_kernel_read(void *dst, void *src, size_t size);
65241-extern long __probe_kernel_read(void *dst, void *src, size_t size);
65242+extern long probe_kernel_read(void *dst, const void *src, size_t size);
65243+extern long __probe_kernel_read(void *dst, const void *src, size_t size);
65244
65245 /*
65246 * probe_kernel_write(): safely attempt to write to a location
65247@@ -105,7 +105,7 @@ extern long __probe_kernel_read(void *ds
65248 * Safely write to address @dst from the buffer at @src. If a kernel fault
65249 * happens, handle that and return -EFAULT.
65250 */
65251-extern long notrace probe_kernel_write(void *dst, void *src, size_t size);
65252-extern long notrace __probe_kernel_write(void *dst, void *src, size_t size);
65253+extern long notrace probe_kernel_write(void *dst, const void *src, size_t size);
65254+extern long notrace __probe_kernel_write(void *dst, const void *src, size_t size);
65255
65256 #endif /* __LINUX_UACCESS_H__ */
65257diff -urNp linux-2.6.39/include/linux/unaligned/access_ok.h linux-2.6.39/include/linux/unaligned/access_ok.h
65258--- linux-2.6.39/include/linux/unaligned/access_ok.h 2011-05-19 00:06:34.000000000 -0400
65259+++ linux-2.6.39/include/linux/unaligned/access_ok.h 2011-05-22 19:36:33.000000000 -0400
65260@@ -6,32 +6,32 @@
65261
65262 static inline u16 get_unaligned_le16(const void *p)
65263 {
65264- return le16_to_cpup((__le16 *)p);
65265+ return le16_to_cpup((const __le16 *)p);
65266 }
65267
65268 static inline u32 get_unaligned_le32(const void *p)
65269 {
65270- return le32_to_cpup((__le32 *)p);
65271+ return le32_to_cpup((const __le32 *)p);
65272 }
65273
65274 static inline u64 get_unaligned_le64(const void *p)
65275 {
65276- return le64_to_cpup((__le64 *)p);
65277+ return le64_to_cpup((const __le64 *)p);
65278 }
65279
65280 static inline u16 get_unaligned_be16(const void *p)
65281 {
65282- return be16_to_cpup((__be16 *)p);
65283+ return be16_to_cpup((const __be16 *)p);
65284 }
65285
65286 static inline u32 get_unaligned_be32(const void *p)
65287 {
65288- return be32_to_cpup((__be32 *)p);
65289+ return be32_to_cpup((const __be32 *)p);
65290 }
65291
65292 static inline u64 get_unaligned_be64(const void *p)
65293 {
65294- return be64_to_cpup((__be64 *)p);
65295+ return be64_to_cpup((const __be64 *)p);
65296 }
65297
65298 static inline void put_unaligned_le16(u16 val, void *p)
65299diff -urNp linux-2.6.39/include/linux/usb/hcd.h linux-2.6.39/include/linux/usb/hcd.h
65300--- linux-2.6.39/include/linux/usb/hcd.h 2011-05-19 00:06:34.000000000 -0400
65301+++ linux-2.6.39/include/linux/usb/hcd.h 2011-05-22 19:36:33.000000000 -0400
65302@@ -615,7 +615,7 @@ struct usb_mon_operations {
65303 /* void (*urb_unlink)(struct usb_bus *bus, struct urb *urb); */
65304 };
65305
65306-extern struct usb_mon_operations *mon_ops;
65307+extern const struct usb_mon_operations *mon_ops;
65308
65309 static inline void usbmon_urb_submit(struct usb_bus *bus, struct urb *urb)
65310 {
65311@@ -637,7 +637,7 @@ static inline void usbmon_urb_complete(s
65312 (*mon_ops->urb_complete)(bus, urb, status);
65313 }
65314
65315-int usb_mon_register(struct usb_mon_operations *ops);
65316+int usb_mon_register(const struct usb_mon_operations *ops);
65317 void usb_mon_deregister(void);
65318
65319 #else
65320diff -urNp linux-2.6.39/include/linux/usb/intel_mid_otg.h linux-2.6.39/include/linux/usb/intel_mid_otg.h
65321--- linux-2.6.39/include/linux/usb/intel_mid_otg.h 2011-05-19 00:06:34.000000000 -0400
65322+++ linux-2.6.39/include/linux/usb/intel_mid_otg.h 2011-05-22 19:36:33.000000000 -0400
65323@@ -115,7 +115,7 @@ struct intel_mid_otg_xceiv {
65324 void __iomem *base;
65325
65326 /* ops to access ulpi */
65327- struct iotg_ulpi_access_ops ulpi_ops;
65328+ const struct iotg_ulpi_access_ops ulpi_ops;
65329
65330 /* atomic notifier for interrupt context */
65331 struct atomic_notifier_head iotg_notifier;
65332diff -urNp linux-2.6.39/include/linux/usb/ulpi.h linux-2.6.39/include/linux/usb/ulpi.h
65333--- linux-2.6.39/include/linux/usb/ulpi.h 2011-05-19 00:06:34.000000000 -0400
65334+++ linux-2.6.39/include/linux/usb/ulpi.h 2011-05-22 19:36:33.000000000 -0400
65335@@ -186,7 +186,7 @@ struct otg_transceiver *otg_ulpi_create(
65336
65337 #ifdef CONFIG_USB_ULPI_VIEWPORT
65338 /* access ops for controllers with a viewport register */
65339-extern struct otg_io_access_ops ulpi_viewport_access_ops;
65340+extern const struct otg_io_access_ops ulpi_viewport_access_ops;
65341 #endif
65342
65343 #endif /* __LINUX_USB_ULPI_H */
65344diff -urNp linux-2.6.39/include/linux/vga_switcheroo.h linux-2.6.39/include/linux/vga_switcheroo.h
65345--- linux-2.6.39/include/linux/vga_switcheroo.h 2011-05-19 00:06:34.000000000 -0400
65346+++ linux-2.6.39/include/linux/vga_switcheroo.h 2011-05-22 19:36:33.000000000 -0400
65347@@ -39,7 +39,7 @@ int vga_switcheroo_register_client(struc
65348 void vga_switcheroo_client_fb_set(struct pci_dev *dev,
65349 struct fb_info *info);
65350
65351-int vga_switcheroo_register_handler(struct vga_switcheroo_handler *handler);
65352+int vga_switcheroo_register_handler(const struct vga_switcheroo_handler *handler);
65353 void vga_switcheroo_unregister_handler(void);
65354
65355 int vga_switcheroo_process_delayed_switch(void);
65356@@ -52,7 +52,7 @@ static inline int vga_switcheroo_registe
65357 void (*reprobe)(struct pci_dev *dev),
65358 bool (*can_switch)(struct pci_dev *dev)) { return 0; }
65359 static inline void vga_switcheroo_client_fb_set(struct pci_dev *dev, struct fb_info *info) {}
65360-static inline int vga_switcheroo_register_handler(struct vga_switcheroo_handler *handler) { return 0; }
65361+static inline int vga_switcheroo_register_handler(const struct vga_switcheroo_handler *handler) { return 0; }
65362 static inline void vga_switcheroo_unregister_handler(void) {}
65363 static inline int vga_switcheroo_process_delayed_switch(void) { return 0; }
65364
65365diff -urNp linux-2.6.39/include/linux/virtio.h linux-2.6.39/include/linux/virtio.h
65366--- linux-2.6.39/include/linux/virtio.h 2011-05-19 00:06:34.000000000 -0400
65367+++ linux-2.6.39/include/linux/virtio.h 2011-05-22 19:36:33.000000000 -0400
65368@@ -102,7 +102,7 @@ struct virtio_device {
65369 int index;
65370 struct device dev;
65371 struct virtio_device_id id;
65372- struct virtio_config_ops *config;
65373+ const struct virtio_config_ops *config;
65374 struct list_head vqs;
65375 /* Note that this is a Linux set_bit-style bitmap. */
65376 unsigned long features[1];
65377diff -urNp linux-2.6.39/include/linux/vmalloc.h linux-2.6.39/include/linux/vmalloc.h
65378--- linux-2.6.39/include/linux/vmalloc.h 2011-05-19 00:06:34.000000000 -0400
65379+++ linux-2.6.39/include/linux/vmalloc.h 2011-05-22 19:36:33.000000000 -0400
65380@@ -13,6 +13,11 @@ struct vm_area_struct; /* vma defining
65381 #define VM_MAP 0x00000004 /* vmap()ed pages */
65382 #define VM_USERMAP 0x00000008 /* suitable for remap_vmalloc_range */
65383 #define VM_VPAGES 0x00000010 /* buffer for pages was vmalloc'ed */
65384+
65385+#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
65386+#define VM_KERNEXEC 0x00000020 /* allocate from executable kernel memory range */
65387+#endif
65388+
65389 /* bits [20..32] reserved for arch specific ioremap internals */
65390
65391 /*
65392@@ -155,4 +160,103 @@ pcpu_free_vm_areas(struct vm_struct **vm
65393 # endif
65394 #endif
65395
65396+#define vmalloc(x) \
65397+({ \
65398+ void *___retval; \
65399+ intoverflow_t ___x = (intoverflow_t)x; \
65400+ if (WARN(___x > ULONG_MAX, "vmalloc size overflow\n")) \
65401+ ___retval = NULL; \
65402+ else \
65403+ ___retval = vmalloc((unsigned long)___x); \
65404+ ___retval; \
65405+})
65406+
65407+#define vzalloc(x) \
65408+({ \
65409+ void *___retval; \
65410+ intoverflow_t ___x = (intoverflow_t)x; \
65411+ if (WARN(___x > ULONG_MAX, "vzalloc size overflow\n")) \
65412+ ___retval = NULL; \
65413+ else \
65414+ ___retval = vzalloc((unsigned long)___x); \
65415+ ___retval; \
65416+})
65417+
65418+#define __vmalloc(x, y, z) \
65419+({ \
65420+ void *___retval; \
65421+ intoverflow_t ___x = (intoverflow_t)x; \
65422+ if (WARN(___x > ULONG_MAX, "__vmalloc size overflow\n"))\
65423+ ___retval = NULL; \
65424+ else \
65425+ ___retval = __vmalloc((unsigned long)___x, (y), (z));\
65426+ ___retval; \
65427+})
65428+
65429+#define vmalloc_user(x) \
65430+({ \
65431+ void *___retval; \
65432+ intoverflow_t ___x = (intoverflow_t)x; \
65433+ if (WARN(___x > ULONG_MAX, "vmalloc_user size overflow\n"))\
65434+ ___retval = NULL; \
65435+ else \
65436+ ___retval = vmalloc_user((unsigned long)___x); \
65437+ ___retval; \
65438+})
65439+
65440+#define vmalloc_exec(x) \
65441+({ \
65442+ void *___retval; \
65443+ intoverflow_t ___x = (intoverflow_t)x; \
65444+ if (WARN(___x > ULONG_MAX, "vmalloc_exec size overflow\n"))\
65445+ ___retval = NULL; \
65446+ else \
65447+ ___retval = vmalloc_exec((unsigned long)___x); \
65448+ ___retval; \
65449+})
65450+
65451+#define vmalloc_node(x, y) \
65452+({ \
65453+ void *___retval; \
65454+ intoverflow_t ___x = (intoverflow_t)x; \
65455+ if (WARN(___x > ULONG_MAX, "vmalloc_node size overflow\n"))\
65456+ ___retval = NULL; \
65457+ else \
65458+ ___retval = vmalloc_node((unsigned long)___x, (y));\
65459+ ___retval; \
65460+})
65461+
65462+#define vzalloc_node(x, y) \
65463+({ \
65464+ void *___retval; \
65465+ intoverflow_t ___x = (intoverflow_t)x; \
65466+ if (WARN(___x > ULONG_MAX, "vzalloc_node size overflow\n"))\
65467+ ___retval = NULL; \
65468+ else \
65469+ ___retval = vzalloc_node((unsigned long)___x, (y));\
65470+ ___retval; \
65471+})
65472+
65473+#define vmalloc_32(x) \
65474+({ \
65475+ void *___retval; \
65476+ intoverflow_t ___x = (intoverflow_t)x; \
65477+ if (WARN(___x > ULONG_MAX, "vmalloc_32 size overflow\n"))\
65478+ ___retval = NULL; \
65479+ else \
65480+ ___retval = vmalloc_32((unsigned long)___x); \
65481+ ___retval; \
65482+})
65483+
65484+#define vmalloc_32_user(x) \
65485+({ \
65486+void *___retval; \
65487+ intoverflow_t ___x = (intoverflow_t)x; \
65488+ if (WARN(___x > ULONG_MAX, "vmalloc_32_user size overflow\n"))\
65489+ ___retval = NULL; \
65490+ else \
65491+ ___retval = vmalloc_32_user((unsigned long)___x);\
65492+ ___retval; \
65493+})
65494+
65495 #endif /* _LINUX_VMALLOC_H */
65496diff -urNp linux-2.6.39/include/linux/vmstat.h linux-2.6.39/include/linux/vmstat.h
65497--- linux-2.6.39/include/linux/vmstat.h 2011-05-19 00:06:34.000000000 -0400
65498+++ linux-2.6.39/include/linux/vmstat.h 2011-05-22 19:36:33.000000000 -0400
65499@@ -147,18 +147,18 @@ static inline void vm_events_fold_cpu(in
65500 /*
65501 * Zone based page accounting with per cpu differentials.
65502 */
65503-extern atomic_long_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
65504+extern atomic_long_unchecked_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
65505
65506 static inline void zone_page_state_add(long x, struct zone *zone,
65507 enum zone_stat_item item)
65508 {
65509- atomic_long_add(x, &zone->vm_stat[item]);
65510- atomic_long_add(x, &vm_stat[item]);
65511+ atomic_long_add_unchecked(x, &zone->vm_stat[item]);
65512+ atomic_long_add_unchecked(x, &vm_stat[item]);
65513 }
65514
65515 static inline unsigned long global_page_state(enum zone_stat_item item)
65516 {
65517- long x = atomic_long_read(&vm_stat[item]);
65518+ long x = atomic_long_read_unchecked(&vm_stat[item]);
65519 #ifdef CONFIG_SMP
65520 if (x < 0)
65521 x = 0;
65522@@ -169,7 +169,7 @@ static inline unsigned long global_page_
65523 static inline unsigned long zone_page_state(struct zone *zone,
65524 enum zone_stat_item item)
65525 {
65526- long x = atomic_long_read(&zone->vm_stat[item]);
65527+ long x = atomic_long_read_unchecked(&zone->vm_stat[item]);
65528 #ifdef CONFIG_SMP
65529 if (x < 0)
65530 x = 0;
65531@@ -186,7 +186,7 @@ static inline unsigned long zone_page_st
65532 static inline unsigned long zone_page_state_snapshot(struct zone *zone,
65533 enum zone_stat_item item)
65534 {
65535- long x = atomic_long_read(&zone->vm_stat[item]);
65536+ long x = atomic_long_read_unchecked(&zone->vm_stat[item]);
65537
65538 #ifdef CONFIG_SMP
65539 int cpu;
65540@@ -280,8 +280,8 @@ static inline void __mod_zone_page_state
65541
65542 static inline void __inc_zone_state(struct zone *zone, enum zone_stat_item item)
65543 {
65544- atomic_long_inc(&zone->vm_stat[item]);
65545- atomic_long_inc(&vm_stat[item]);
65546+ atomic_long_inc_unchecked(&zone->vm_stat[item]);
65547+ atomic_long_inc_unchecked(&vm_stat[item]);
65548 }
65549
65550 static inline void __inc_zone_page_state(struct page *page,
65551@@ -292,8 +292,8 @@ static inline void __inc_zone_page_state
65552
65553 static inline void __dec_zone_state(struct zone *zone, enum zone_stat_item item)
65554 {
65555- atomic_long_dec(&zone->vm_stat[item]);
65556- atomic_long_dec(&vm_stat[item]);
65557+ atomic_long_dec_unchecked(&zone->vm_stat[item]);
65558+ atomic_long_dec_unchecked(&vm_stat[item]);
65559 }
65560
65561 static inline void __dec_zone_page_state(struct page *page,
65562diff -urNp linux-2.6.39/include/media/saa7146_vv.h linux-2.6.39/include/media/saa7146_vv.h
65563--- linux-2.6.39/include/media/saa7146_vv.h 2011-05-19 00:06:34.000000000 -0400
65564+++ linux-2.6.39/include/media/saa7146_vv.h 2011-05-22 19:36:33.000000000 -0400
65565@@ -202,13 +202,13 @@ void saa7146_set_gpio(struct saa7146_dev
65566
65567 /* from saa7146_video.c */
65568 extern const struct v4l2_ioctl_ops saa7146_video_ioctl_ops;
65569-extern struct saa7146_use_ops saa7146_video_uops;
65570+extern const struct saa7146_use_ops saa7146_video_uops;
65571 int saa7146_start_preview(struct saa7146_fh *fh);
65572 int saa7146_stop_preview(struct saa7146_fh *fh);
65573 long saa7146_video_do_ioctl(struct file *file, unsigned int cmd, void *arg);
65574
65575 /* from saa7146_vbi.c */
65576-extern struct saa7146_use_ops saa7146_vbi_uops;
65577+extern const struct saa7146_use_ops saa7146_vbi_uops;
65578
65579 /* resource management functions */
65580 int saa7146_res_get(struct saa7146_fh *fh, unsigned int bit);
65581diff -urNp linux-2.6.39/include/media/v4l2-device.h linux-2.6.39/include/media/v4l2-device.h
65582--- linux-2.6.39/include/media/v4l2-device.h 2011-05-19 00:06:34.000000000 -0400
65583+++ linux-2.6.39/include/media/v4l2-device.h 2011-05-22 19:36:33.000000000 -0400
65584@@ -95,7 +95,7 @@ int __must_check v4l2_device_register(st
65585 this function returns 0. If the name ends with a digit (e.g. cx18),
65586 then the name will be set to cx18-0 since cx180 looks really odd. */
65587 int v4l2_device_set_name(struct v4l2_device *v4l2_dev, const char *basename,
65588- atomic_t *instance);
65589+ atomic_unchecked_t *instance);
65590
65591 /* Set v4l2_dev->dev to NULL. Call when the USB parent disconnects.
65592 Since the parent disappears this ensures that v4l2_dev doesn't have an
65593diff -urNp linux-2.6.39/include/net/caif/cfctrl.h linux-2.6.39/include/net/caif/cfctrl.h
65594--- linux-2.6.39/include/net/caif/cfctrl.h 2011-05-19 00:06:34.000000000 -0400
65595+++ linux-2.6.39/include/net/caif/cfctrl.h 2011-05-22 19:36:33.000000000 -0400
65596@@ -101,8 +101,8 @@ struct cfctrl_request_info {
65597 struct cfctrl {
65598 struct cfsrvl serv;
65599 struct cfctrl_rsp res;
65600- atomic_t req_seq_no;
65601- atomic_t rsp_seq_no;
65602+ atomic_unchecked_t req_seq_no;
65603+ atomic_unchecked_t rsp_seq_no;
65604 struct list_head list;
65605 /* Protects from simultaneous access to first_req list */
65606 spinlock_t info_list_lock;
65607diff -urNp linux-2.6.39/include/net/flow.h linux-2.6.39/include/net/flow.h
65608--- linux-2.6.39/include/net/flow.h 2011-05-19 00:06:34.000000000 -0400
65609+++ linux-2.6.39/include/net/flow.h 2011-05-22 19:36:33.000000000 -0400
65610@@ -167,6 +167,6 @@ extern struct flow_cache_object *flow_ca
65611 u8 dir, flow_resolve_t resolver, void *ctx);
65612
65613 extern void flow_cache_flush(void);
65614-extern atomic_t flow_cache_genid;
65615+extern atomic_unchecked_t flow_cache_genid;
65616
65617 #endif
65618diff -urNp linux-2.6.39/include/net/inetpeer.h linux-2.6.39/include/net/inetpeer.h
65619--- linux-2.6.39/include/net/inetpeer.h 2011-05-19 00:06:34.000000000 -0400
65620+++ linux-2.6.39/include/net/inetpeer.h 2011-05-22 19:36:33.000000000 -0400
65621@@ -43,8 +43,8 @@ struct inet_peer {
65622 */
65623 union {
65624 struct {
65625- atomic_t rid; /* Frag reception counter */
65626- atomic_t ip_id_count; /* IP ID for the next packet */
65627+ atomic_unchecked_t rid; /* Frag reception counter */
65628+ atomic_unchecked_t ip_id_count; /* IP ID for the next packet */
65629 __u32 tcp_ts;
65630 __u32 tcp_ts_stamp;
65631 u32 metrics[RTAX_MAX];
65632@@ -108,7 +108,7 @@ static inline __u16 inet_getid(struct in
65633 {
65634 more++;
65635 inet_peer_refcheck(p);
65636- return atomic_add_return(more, &p->ip_id_count) - more;
65637+ return atomic_add_return_unchecked(more, &p->ip_id_count) - more;
65638 }
65639
65640 #endif /* _NET_INETPEER_H */
65641diff -urNp linux-2.6.39/include/net/ip_fib.h linux-2.6.39/include/net/ip_fib.h
65642--- linux-2.6.39/include/net/ip_fib.h 2011-05-19 00:06:34.000000000 -0400
65643+++ linux-2.6.39/include/net/ip_fib.h 2011-05-22 19:36:33.000000000 -0400
65644@@ -146,7 +146,7 @@ extern __be32 fib_info_update_nh_saddr(s
65645
65646 #define FIB_RES_SADDR(net, res) \
65647 ((FIB_RES_NH(res).nh_saddr_genid == \
65648- atomic_read(&(net)->ipv4.dev_addr_genid)) ? \
65649+ atomic_read_unchecked(&(net)->ipv4.dev_addr_genid)) ? \
65650 FIB_RES_NH(res).nh_saddr : \
65651 fib_info_update_nh_saddr((net), &FIB_RES_NH(res)))
65652 #define FIB_RES_GW(res) (FIB_RES_NH(res).nh_gw)
65653diff -urNp linux-2.6.39/include/net/ip_vs.h linux-2.6.39/include/net/ip_vs.h
65654--- linux-2.6.39/include/net/ip_vs.h 2011-05-19 00:06:34.000000000 -0400
65655+++ linux-2.6.39/include/net/ip_vs.h 2011-05-22 19:36:33.000000000 -0400
65656@@ -512,7 +512,7 @@ struct ip_vs_conn {
65657 struct ip_vs_conn *control; /* Master control connection */
65658 atomic_t n_control; /* Number of controlled ones */
65659 struct ip_vs_dest *dest; /* real server */
65660- atomic_t in_pkts; /* incoming packet counter */
65661+ atomic_unchecked_t in_pkts; /* incoming packet counter */
65662
65663 /* packet transmitter for different forwarding methods. If it
65664 mangles the packet, it must return NF_DROP or better NF_STOLEN,
65665@@ -650,7 +650,7 @@ struct ip_vs_dest {
65666 __be16 port; /* port number of the server */
65667 union nf_inet_addr addr; /* IP address of the server */
65668 volatile unsigned flags; /* dest status flags */
65669- atomic_t conn_flags; /* flags to copy to conn */
65670+ atomic_unchecked_t conn_flags; /* flags to copy to conn */
65671 atomic_t weight; /* server weight */
65672
65673 atomic_t refcnt; /* reference counter */
65674diff -urNp linux-2.6.39/include/net/irda/ircomm_tty.h linux-2.6.39/include/net/irda/ircomm_tty.h
65675--- linux-2.6.39/include/net/irda/ircomm_tty.h 2011-05-19 00:06:34.000000000 -0400
65676+++ linux-2.6.39/include/net/irda/ircomm_tty.h 2011-05-22 19:36:33.000000000 -0400
65677@@ -35,6 +35,7 @@
65678 #include <linux/termios.h>
65679 #include <linux/timer.h>
65680 #include <linux/tty.h> /* struct tty_struct */
65681+#include <asm/local.h>
65682
65683 #include <net/irda/irias_object.h>
65684 #include <net/irda/ircomm_core.h>
65685@@ -105,8 +106,8 @@ struct ircomm_tty_cb {
65686 unsigned short close_delay;
65687 unsigned short closing_wait; /* time to wait before closing */
65688
65689- int open_count;
65690- int blocked_open; /* # of blocked opens */
65691+ local_t open_count;
65692+ local_t blocked_open; /* # of blocked opens */
65693
65694 /* Protect concurent access to :
65695 * o self->open_count
65696diff -urNp linux-2.6.39/include/net/iucv/af_iucv.h linux-2.6.39/include/net/iucv/af_iucv.h
65697--- linux-2.6.39/include/net/iucv/af_iucv.h 2011-05-19 00:06:34.000000000 -0400
65698+++ linux-2.6.39/include/net/iucv/af_iucv.h 2011-05-22 19:36:33.000000000 -0400
65699@@ -87,7 +87,7 @@ struct iucv_sock {
65700 struct iucv_sock_list {
65701 struct hlist_head head;
65702 rwlock_t lock;
65703- atomic_t autobind_name;
65704+ atomic_unchecked_t autobind_name;
65705 };
65706
65707 unsigned int iucv_sock_poll(struct file *file, struct socket *sock,
65708diff -urNp linux-2.6.39/include/net/neighbour.h linux-2.6.39/include/net/neighbour.h
65709--- linux-2.6.39/include/net/neighbour.h 2011-05-19 00:06:34.000000000 -0400
65710+++ linux-2.6.39/include/net/neighbour.h 2011-05-22 19:36:33.000000000 -0400
65711@@ -118,12 +118,12 @@ struct neighbour {
65712
65713 struct neigh_ops {
65714 int family;
65715- void (*solicit)(struct neighbour *, struct sk_buff*);
65716- void (*error_report)(struct neighbour *, struct sk_buff*);
65717- int (*output)(struct sk_buff*);
65718- int (*connected_output)(struct sk_buff*);
65719- int (*hh_output)(struct sk_buff*);
65720- int (*queue_xmit)(struct sk_buff*);
65721+ void (* const solicit)(struct neighbour *, struct sk_buff*);
65722+ void (* const error_report)(struct neighbour *, struct sk_buff*);
65723+ int (* const output)(struct sk_buff*);
65724+ int (* const connected_output)(struct sk_buff*);
65725+ int (* const hh_output)(struct sk_buff*);
65726+ int (* const queue_xmit)(struct sk_buff*);
65727 };
65728
65729 struct pneigh_entry {
65730diff -urNp linux-2.6.39/include/net/netfilter/nf_conntrack_ecache.h linux-2.6.39/include/net/netfilter/nf_conntrack_ecache.h
65731--- linux-2.6.39/include/net/netfilter/nf_conntrack_ecache.h 2011-05-19 00:06:34.000000000 -0400
65732+++ linux-2.6.39/include/net/netfilter/nf_conntrack_ecache.h 2011-05-22 19:36:33.000000000 -0400
65733@@ -95,7 +95,7 @@ nf_conntrack_eventmask_report(unsigned i
65734 int report)
65735 {
65736 int ret = 0;
65737- struct nf_ct_event_notifier *notify;
65738+ const struct nf_ct_event_notifier *notify;
65739 struct nf_conntrack_ecache *e;
65740
65741 rcu_read_lock();
65742@@ -174,7 +174,7 @@ nf_ct_expect_event_report(enum ip_conntr
65743 u32 pid,
65744 int report)
65745 {
65746- struct nf_exp_event_notifier *notify;
65747+ const struct nf_exp_event_notifier *notify;
65748 struct nf_conntrack_ecache *e;
65749
65750 rcu_read_lock();
65751diff -urNp linux-2.6.39/include/net/netlink.h linux-2.6.39/include/net/netlink.h
65752--- linux-2.6.39/include/net/netlink.h 2011-05-19 00:06:34.000000000 -0400
65753+++ linux-2.6.39/include/net/netlink.h 2011-05-22 19:36:33.000000000 -0400
65754@@ -562,7 +562,7 @@ static inline void *nlmsg_get_pos(struct
65755 static inline void nlmsg_trim(struct sk_buff *skb, const void *mark)
65756 {
65757 if (mark)
65758- skb_trim(skb, (unsigned char *) mark - skb->data);
65759+ skb_trim(skb, (const unsigned char *) mark - skb->data);
65760 }
65761
65762 /**
65763diff -urNp linux-2.6.39/include/net/netns/ipv4.h linux-2.6.39/include/net/netns/ipv4.h
65764--- linux-2.6.39/include/net/netns/ipv4.h 2011-05-19 00:06:34.000000000 -0400
65765+++ linux-2.6.39/include/net/netns/ipv4.h 2011-05-22 19:36:33.000000000 -0400
65766@@ -54,8 +54,8 @@ struct netns_ipv4 {
65767 int sysctl_rt_cache_rebuild_count;
65768 int current_rt_cache_rebuild_count;
65769
65770- atomic_t rt_genid;
65771- atomic_t dev_addr_genid;
65772+ atomic_unchecked_t rt_genid;
65773+ atomic_unchecked_t dev_addr_genid;
65774
65775 #ifdef CONFIG_IP_MROUTE
65776 #ifndef CONFIG_IP_MROUTE_MULTIPLE_TABLES
65777diff -urNp linux-2.6.39/include/net/sctp/sctp.h linux-2.6.39/include/net/sctp/sctp.h
65778--- linux-2.6.39/include/net/sctp/sctp.h 2011-05-19 00:06:34.000000000 -0400
65779+++ linux-2.6.39/include/net/sctp/sctp.h 2011-05-22 19:36:33.000000000 -0400
65780@@ -316,9 +316,9 @@ do { \
65781
65782 #else /* SCTP_DEBUG */
65783
65784-#define SCTP_DEBUG_PRINTK(whatever...)
65785-#define SCTP_DEBUG_PRINTK_CONT(fmt, args...)
65786-#define SCTP_DEBUG_PRINTK_IPADDR(whatever...)
65787+#define SCTP_DEBUG_PRINTK(whatever...) do {} while (0)
65788+#define SCTP_DEBUG_PRINTK_CONT(fmt, args...) do {} while (0)
65789+#define SCTP_DEBUG_PRINTK_IPADDR(whatever...) do {} while (0)
65790 #define SCTP_ENABLE_DEBUG
65791 #define SCTP_DISABLE_DEBUG
65792 #define SCTP_ASSERT(expr, str, func)
65793diff -urNp linux-2.6.39/include/net/sock.h linux-2.6.39/include/net/sock.h
65794--- linux-2.6.39/include/net/sock.h 2011-05-19 00:06:34.000000000 -0400
65795+++ linux-2.6.39/include/net/sock.h 2011-05-22 19:36:33.000000000 -0400
65796@@ -277,7 +277,7 @@ struct sock {
65797 #ifdef CONFIG_RPS
65798 __u32 sk_rxhash;
65799 #endif
65800- atomic_t sk_drops;
65801+ atomic_unchecked_t sk_drops;
65802 int sk_rcvbuf;
65803
65804 struct sk_filter __rcu *sk_filter;
65805diff -urNp linux-2.6.39/include/net/tcp.h linux-2.6.39/include/net/tcp.h
65806--- linux-2.6.39/include/net/tcp.h 2011-05-19 00:06:34.000000000 -0400
65807+++ linux-2.6.39/include/net/tcp.h 2011-05-22 19:36:33.000000000 -0400
65808@@ -1374,7 +1374,7 @@ enum tcp_seq_states {
65809 struct tcp_seq_afinfo {
65810 char *name;
65811 sa_family_t family;
65812- struct file_operations seq_fops;
65813+ struct file_operations seq_fops; /* cannot be const */
65814 struct seq_operations seq_ops;
65815 };
65816
65817diff -urNp linux-2.6.39/include/net/udp.h linux-2.6.39/include/net/udp.h
65818--- linux-2.6.39/include/net/udp.h 2011-05-19 00:06:34.000000000 -0400
65819+++ linux-2.6.39/include/net/udp.h 2011-05-22 19:36:33.000000000 -0400
65820@@ -234,7 +234,7 @@ struct udp_seq_afinfo {
65821 char *name;
65822 sa_family_t family;
65823 struct udp_table *udp_table;
65824- struct file_operations seq_fops;
65825+ struct file_operations seq_fops; /* cannot be const */
65826 struct seq_operations seq_ops;
65827 };
65828
65829diff -urNp linux-2.6.39/include/net/xfrm.h linux-2.6.39/include/net/xfrm.h
65830--- linux-2.6.39/include/net/xfrm.h 2011-05-19 00:06:34.000000000 -0400
65831+++ linux-2.6.39/include/net/xfrm.h 2011-05-22 19:36:33.000000000 -0400
65832@@ -505,7 +505,7 @@ struct xfrm_policy {
65833 struct timer_list timer;
65834
65835 struct flow_cache_object flo;
65836- atomic_t genid;
65837+ atomic_unchecked_t genid;
65838 u32 priority;
65839 u32 index;
65840 struct xfrm_mark mark;
65841diff -urNp linux-2.6.39/include/pcmcia/ss.h linux-2.6.39/include/pcmcia/ss.h
65842--- linux-2.6.39/include/pcmcia/ss.h 2011-05-19 00:06:34.000000000 -0400
65843+++ linux-2.6.39/include/pcmcia/ss.h 2011-05-22 19:36:33.000000000 -0400
65844@@ -241,9 +241,9 @@ struct pcmcia_socket {
65845 * "select PCCARD_NONSTATIC" in Kconfig.
65846 *
65847 */
65848-extern struct pccard_resource_ops pccard_static_ops;
65849+extern const struct pccard_resource_ops pccard_static_ops;
65850 #if defined(CONFIG_PCMCIA) || defined(CONFIG_PCMCIA_MODULE)
65851-extern struct pccard_resource_ops pccard_iodyn_ops;
65852+extern const struct pccard_resource_ops pccard_iodyn_ops;
65853 extern struct pccard_resource_ops pccard_nonstatic_ops;
65854 #else
65855 /* If PCMCIA is not used, but only CARDBUS, these functions are not used
65856diff -urNp linux-2.6.39/include/rdma/ib_verbs.h linux-2.6.39/include/rdma/ib_verbs.h
65857--- linux-2.6.39/include/rdma/ib_verbs.h 2011-05-19 00:06:34.000000000 -0400
65858+++ linux-2.6.39/include/rdma/ib_verbs.h 2011-05-22 19:36:33.000000000 -0400
65859@@ -1149,7 +1149,7 @@ struct ib_device {
65860 struct ib_mad *in_mad,
65861 struct ib_mad *out_mad);
65862
65863- struct ib_dma_mapping_ops *dma_ops;
65864+ const struct ib_dma_mapping_ops *dma_ops;
65865
65866 struct module *owner;
65867 struct device dev;
65868diff -urNp linux-2.6.39/include/scsi/libfc.h linux-2.6.39/include/scsi/libfc.h
65869--- linux-2.6.39/include/scsi/libfc.h 2011-05-19 00:06:34.000000000 -0400
65870+++ linux-2.6.39/include/scsi/libfc.h 2011-05-22 19:36:33.000000000 -0400
65871@@ -202,7 +202,7 @@ struct fc_rport_priv {
65872 struct mutex rp_mutex;
65873 struct delayed_work retry_work;
65874 enum fc_rport_event event;
65875- struct fc_rport_operations *ops;
65876+ const struct fc_rport_operations *ops;
65877 struct list_head peers;
65878 struct work_struct event_work;
65879 u32 supported_classes;
65880diff -urNp linux-2.6.39/include/scsi/scsi_device.h linux-2.6.39/include/scsi/scsi_device.h
65881--- linux-2.6.39/include/scsi/scsi_device.h 2011-05-19 00:06:34.000000000 -0400
65882+++ linux-2.6.39/include/scsi/scsi_device.h 2011-05-22 19:36:33.000000000 -0400
65883@@ -161,9 +161,9 @@ struct scsi_device {
65884 unsigned int max_device_blocked; /* what device_blocked counts down from */
65885 #define SCSI_DEFAULT_DEVICE_BLOCKED 3
65886
65887- atomic_t iorequest_cnt;
65888- atomic_t iodone_cnt;
65889- atomic_t ioerr_cnt;
65890+ atomic_unchecked_t iorequest_cnt;
65891+ atomic_unchecked_t iodone_cnt;
65892+ atomic_unchecked_t ioerr_cnt;
65893
65894 struct device sdev_gendev,
65895 sdev_dev;
65896diff -urNp linux-2.6.39/include/sound/ac97_codec.h linux-2.6.39/include/sound/ac97_codec.h
65897--- linux-2.6.39/include/sound/ac97_codec.h 2011-05-19 00:06:34.000000000 -0400
65898+++ linux-2.6.39/include/sound/ac97_codec.h 2011-05-22 19:36:33.000000000 -0400
65899@@ -424,15 +424,15 @@
65900 struct snd_ac97;
65901
65902 struct snd_ac97_build_ops {
65903- int (*build_3d) (struct snd_ac97 *ac97);
65904- int (*build_specific) (struct snd_ac97 *ac97);
65905- int (*build_spdif) (struct snd_ac97 *ac97);
65906- int (*build_post_spdif) (struct snd_ac97 *ac97);
65907+ int (* const build_3d) (struct snd_ac97 *ac97);
65908+ int (* const build_specific) (struct snd_ac97 *ac97);
65909+ int (* const build_spdif) (struct snd_ac97 *ac97);
65910+ int (* const build_post_spdif) (struct snd_ac97 *ac97);
65911 #ifdef CONFIG_PM
65912- void (*suspend) (struct snd_ac97 *ac97);
65913- void (*resume) (struct snd_ac97 *ac97);
65914+ void (* const suspend) (struct snd_ac97 *ac97);
65915+ void (* const resume) (struct snd_ac97 *ac97);
65916 #endif
65917- void (*update_jacks) (struct snd_ac97 *ac97); /* for jack-sharing */
65918+ void (* const update_jacks) (struct snd_ac97 *ac97); /* for jack-sharing */
65919 };
65920
65921 struct snd_ac97_bus_ops {
65922@@ -446,7 +446,7 @@ struct snd_ac97_bus_ops {
65923
65924 struct snd_ac97_bus {
65925 /* -- lowlevel (hardware) driver specific -- */
65926- struct snd_ac97_bus_ops *ops;
65927+ const struct snd_ac97_bus_ops *ops;
65928 void *private_data;
65929 void (*private_free) (struct snd_ac97_bus *bus);
65930 /* --- */
65931@@ -556,7 +556,7 @@ static inline int ac97_can_spdif(struct
65932
65933 /* functions */
65934 /* create new AC97 bus */
65935-int snd_ac97_bus(struct snd_card *card, int num, struct snd_ac97_bus_ops *ops,
65936+int snd_ac97_bus(struct snd_card *card, int num, const struct snd_ac97_bus_ops *ops,
65937 void *private_data, struct snd_ac97_bus **rbus);
65938 /* create mixer controls */
65939 int snd_ac97_mixer(struct snd_ac97_bus *bus, struct snd_ac97_template *template,
65940diff -urNp linux-2.6.39/include/sound/core.h linux-2.6.39/include/sound/core.h
65941--- linux-2.6.39/include/sound/core.h 2011-05-19 00:06:34.000000000 -0400
65942+++ linux-2.6.39/include/sound/core.h 2011-05-22 19:36:33.000000000 -0400
65943@@ -88,7 +88,7 @@ struct snd_device {
65944 snd_device_state_t state; /* state of the device */
65945 snd_device_type_t type; /* device type */
65946 void *device_data; /* device structure */
65947- struct snd_device_ops *ops; /* operations */
65948+ const struct snd_device_ops *ops; /* operations */
65949 };
65950
65951 #define snd_device(n) list_entry(n, struct snd_device, list)
65952@@ -301,7 +301,7 @@ int snd_card_file_remove(struct snd_card
65953 /* device.c */
65954
65955 int snd_device_new(struct snd_card *card, snd_device_type_t type,
65956- void *device_data, struct snd_device_ops *ops);
65957+ void *device_data, const struct snd_device_ops *ops);
65958 int snd_device_register(struct snd_card *card, void *device_data);
65959 int snd_device_register_all(struct snd_card *card);
65960 int snd_device_disconnect(struct snd_card *card, void *device_data);
65961diff -urNp linux-2.6.39/include/sound/pcm.h linux-2.6.39/include/sound/pcm.h
65962--- linux-2.6.39/include/sound/pcm.h 2011-05-19 00:06:34.000000000 -0400
65963+++ linux-2.6.39/include/sound/pcm.h 2011-05-22 19:36:33.000000000 -0400
65964@@ -379,7 +379,7 @@ struct snd_pcm_substream {
65965 unsigned int dma_buf_id;
65966 size_t dma_max;
65967 /* -- hardware operations -- */
65968- struct snd_pcm_ops *ops;
65969+ const struct snd_pcm_ops *ops;
65970 /* -- runtime information -- */
65971 struct snd_pcm_runtime *runtime;
65972 /* -- timer section -- */
65973@@ -845,7 +845,7 @@ const unsigned char *snd_pcm_format_sile
65974 int snd_pcm_format_set_silence(snd_pcm_format_t format, void *buf, unsigned int frames);
65975 snd_pcm_format_t snd_pcm_build_linear_format(int width, int unsignd, int big_endian);
65976
65977-void snd_pcm_set_ops(struct snd_pcm * pcm, int direction, struct snd_pcm_ops *ops);
65978+void snd_pcm_set_ops(struct snd_pcm * pcm, int direction, const struct snd_pcm_ops *ops);
65979 void snd_pcm_set_sync(struct snd_pcm_substream *substream);
65980 int snd_pcm_lib_interleave_len(struct snd_pcm_substream *substream);
65981 int snd_pcm_lib_ioctl(struct snd_pcm_substream *substream,
65982diff -urNp linux-2.6.39/include/sound/rawmidi.h linux-2.6.39/include/sound/rawmidi.h
65983--- linux-2.6.39/include/sound/rawmidi.h 2011-05-19 00:06:34.000000000 -0400
65984+++ linux-2.6.39/include/sound/rawmidi.h 2011-05-22 19:36:33.000000000 -0400
65985@@ -100,7 +100,7 @@ struct snd_rawmidi_substream {
65986 struct snd_rawmidi_runtime *runtime;
65987 struct pid *pid;
65988 /* hardware layer */
65989- struct snd_rawmidi_ops *ops;
65990+ const struct snd_rawmidi_ops *ops;
65991 };
65992
65993 struct snd_rawmidi_file {
65994@@ -127,7 +127,7 @@ struct snd_rawmidi {
65995 int ossreg;
65996 #endif
65997
65998- struct snd_rawmidi_global_ops *ops;
65999+ const struct snd_rawmidi_global_ops *ops;
66000
66001 struct snd_rawmidi_str streams[2];
66002
66003@@ -151,7 +151,7 @@ int snd_rawmidi_new(struct snd_card *car
66004 int output_count, int input_count,
66005 struct snd_rawmidi **rmidi);
66006 void snd_rawmidi_set_ops(struct snd_rawmidi *rmidi, int stream,
66007- struct snd_rawmidi_ops *ops);
66008+ const struct snd_rawmidi_ops *ops);
66009
66010 /* callbacks */
66011
66012diff -urNp linux-2.6.39/include/sound/seq_device.h linux-2.6.39/include/sound/seq_device.h
66013--- linux-2.6.39/include/sound/seq_device.h 2011-05-19 00:06:34.000000000 -0400
66014+++ linux-2.6.39/include/sound/seq_device.h 2011-05-22 19:36:33.000000000 -0400
66015@@ -69,7 +69,7 @@ struct snd_seq_dev_ops {
66016 */
66017 void snd_seq_device_load_drivers(void);
66018 int snd_seq_device_new(struct snd_card *card, int device, char *id, int argsize, struct snd_seq_device **result);
66019-int snd_seq_device_register_driver(char *id, struct snd_seq_dev_ops *entry, int argsize);
66020+int snd_seq_device_register_driver(char *id, const struct snd_seq_dev_ops *entry, int argsize);
66021 int snd_seq_device_unregister_driver(char *id);
66022
66023 #define SNDRV_SEQ_DEVICE_ARGPTR(dev) (void *)((char *)(dev) + sizeof(struct snd_seq_device))
66024diff -urNp linux-2.6.39/include/sound/snd_wavefront.h linux-2.6.39/include/sound/snd_wavefront.h
66025--- linux-2.6.39/include/sound/snd_wavefront.h 2011-05-19 00:06:34.000000000 -0400
66026+++ linux-2.6.39/include/sound/snd_wavefront.h 2011-05-22 19:36:33.000000000 -0400
66027@@ -37,8 +37,8 @@ struct _snd_wavefront_midi {
66028 #define MPU_ACK 0xFE
66029 #define UART_MODE_ON 0x3F
66030
66031-extern struct snd_rawmidi_ops snd_wavefront_midi_output;
66032-extern struct snd_rawmidi_ops snd_wavefront_midi_input;
66033+extern const struct snd_rawmidi_ops snd_wavefront_midi_output;
66034+extern const struct snd_rawmidi_ops snd_wavefront_midi_input;
66035
66036 extern void snd_wavefront_midi_enable_virtual (snd_wavefront_card_t *);
66037 extern void snd_wavefront_midi_disable_virtual (snd_wavefront_card_t *);
66038diff -urNp linux-2.6.39/include/sound/soc.h linux-2.6.39/include/sound/soc.h
66039--- linux-2.6.39/include/sound/soc.h 2011-05-19 00:06:34.000000000 -0400
66040+++ linux-2.6.39/include/sound/soc.h 2011-05-22 19:36:33.000000000 -0400
66041@@ -245,7 +245,7 @@ struct snd_soc_jack_gpio;
66042
66043 typedef int (*hw_write_t)(void *,const char* ,int);
66044
66045-extern struct snd_ac97_bus_ops soc_ac97_ops;
66046+extern const struct snd_ac97_bus_ops soc_ac97_ops;
66047
66048 enum snd_soc_control_type {
66049 SND_SOC_CUSTOM,
66050diff -urNp linux-2.6.39/include/sound/ymfpci.h linux-2.6.39/include/sound/ymfpci.h
66051--- linux-2.6.39/include/sound/ymfpci.h 2011-05-19 00:06:34.000000000 -0400
66052+++ linux-2.6.39/include/sound/ymfpci.h 2011-05-22 19:36:33.000000000 -0400
66053@@ -358,7 +358,7 @@ struct snd_ymfpci {
66054 spinlock_t reg_lock;
66055 spinlock_t voice_lock;
66056 wait_queue_head_t interrupt_sleep;
66057- atomic_t interrupt_sleep_count;
66058+ atomic_unchecked_t interrupt_sleep_count;
66059 struct snd_info_entry *proc_entry;
66060 const struct firmware *dsp_microcode;
66061 const struct firmware *controller_microcode;
66062diff -urNp linux-2.6.39/include/target/target_core_base.h linux-2.6.39/include/target/target_core_base.h
66063--- linux-2.6.39/include/target/target_core_base.h 2011-05-19 00:06:34.000000000 -0400
66064+++ linux-2.6.39/include/target/target_core_base.h 2011-05-22 19:36:33.000000000 -0400
66065@@ -431,8 +431,8 @@ struct se_transport_task {
66066 atomic_t t_task_cdbs_left;
66067 atomic_t t_task_cdbs_ex_left;
66068 atomic_t t_task_cdbs_timeout_left;
66069- atomic_t t_task_cdbs_sent;
66070- atomic_t t_transport_aborted;
66071+ atomic_unchecked_t t_task_cdbs_sent;
66072+ atomic_unchecked_t t_transport_aborted;
66073 atomic_t t_transport_active;
66074 atomic_t t_transport_complete;
66075 atomic_t t_transport_queue_active;
66076@@ -773,7 +773,7 @@ struct se_device {
66077 atomic_t active_cmds;
66078 atomic_t simple_cmds;
66079 atomic_t depth_left;
66080- atomic_t dev_ordered_id;
66081+ atomic_unchecked_t dev_ordered_id;
66082 atomic_t dev_tur_active;
66083 atomic_t execute_tasks;
66084 atomic_t dev_status_thr_count;
66085diff -urNp linux-2.6.39/include/trace/events/irq.h linux-2.6.39/include/trace/events/irq.h
66086--- linux-2.6.39/include/trace/events/irq.h 2011-05-19 00:06:34.000000000 -0400
66087+++ linux-2.6.39/include/trace/events/irq.h 2011-05-22 19:36:33.000000000 -0400
66088@@ -36,7 +36,7 @@ struct softirq_action;
66089 */
66090 TRACE_EVENT(irq_handler_entry,
66091
66092- TP_PROTO(int irq, struct irqaction *action),
66093+ TP_PROTO(int irq, const struct irqaction *action),
66094
66095 TP_ARGS(irq, action),
66096
66097@@ -66,7 +66,7 @@ TRACE_EVENT(irq_handler_entry,
66098 */
66099 TRACE_EVENT(irq_handler_exit,
66100
66101- TP_PROTO(int irq, struct irqaction *action, int ret),
66102+ TP_PROTO(int irq, const struct irqaction *action, int ret),
66103
66104 TP_ARGS(irq, action, ret),
66105
66106diff -urNp linux-2.6.39/include/video/udlfb.h linux-2.6.39/include/video/udlfb.h
66107--- linux-2.6.39/include/video/udlfb.h 2011-05-19 00:06:34.000000000 -0400
66108+++ linux-2.6.39/include/video/udlfb.h 2011-05-22 19:36:33.000000000 -0400
66109@@ -51,10 +51,10 @@ struct dlfb_data {
66110 int base8;
66111 u32 pseudo_palette[256];
66112 /* blit-only rendering path metrics, exposed through sysfs */
66113- atomic_t bytes_rendered; /* raw pixel-bytes driver asked to render */
66114- atomic_t bytes_identical; /* saved effort with backbuffer comparison */
66115- atomic_t bytes_sent; /* to usb, after compression including overhead */
66116- atomic_t cpu_kcycles_used; /* transpired during pixel processing */
66117+ atomic_unchecked_t bytes_rendered; /* raw pixel-bytes driver asked to render */
66118+ atomic_unchecked_t bytes_identical; /* saved effort with backbuffer comparison */
66119+ atomic_unchecked_t bytes_sent; /* to usb, after compression including overhead */
66120+ atomic_unchecked_t cpu_kcycles_used; /* transpired during pixel processing */
66121 };
66122
66123 #define NR_USB_REQUEST_I2C_SUB_IO 0x02
66124diff -urNp linux-2.6.39/include/video/uvesafb.h linux-2.6.39/include/video/uvesafb.h
66125--- linux-2.6.39/include/video/uvesafb.h 2011-05-19 00:06:34.000000000 -0400
66126+++ linux-2.6.39/include/video/uvesafb.h 2011-05-22 19:36:33.000000000 -0400
66127@@ -177,6 +177,7 @@ struct uvesafb_par {
66128 u8 ypan; /* 0 - nothing, 1 - ypan, 2 - ywrap */
66129 u8 pmi_setpal; /* PMI for palette changes */
66130 u16 *pmi_base; /* protected mode interface location */
66131+ u8 *pmi_code; /* protected mode code location */
66132 void *pmi_start;
66133 void *pmi_pal;
66134 u8 *vbe_state_orig; /*
66135diff -urNp linux-2.6.39/init/do_mounts.c linux-2.6.39/init/do_mounts.c
66136--- linux-2.6.39/init/do_mounts.c 2011-05-19 00:06:34.000000000 -0400
66137+++ linux-2.6.39/init/do_mounts.c 2011-05-22 19:36:33.000000000 -0400
66138@@ -287,7 +287,7 @@ static void __init get_fs_names(char *pa
66139
66140 static int __init do_mount_root(char *name, char *fs, int flags, void *data)
66141 {
66142- int err = sys_mount(name, "/root", fs, flags, data);
66143+ int err = sys_mount((__force char __user *)name, (__force char __user *)"/root", (__force char __user *)fs, flags, (__force void __user *)data);
66144 if (err)
66145 return err;
66146
66147@@ -383,18 +383,18 @@ void __init change_floppy(char *fmt, ...
66148 va_start(args, fmt);
66149 vsprintf(buf, fmt, args);
66150 va_end(args);
66151- fd = sys_open("/dev/root", O_RDWR | O_NDELAY, 0);
66152+ fd = sys_open((char __user *)"/dev/root", O_RDWR | O_NDELAY, 0);
66153 if (fd >= 0) {
66154 sys_ioctl(fd, FDEJECT, 0);
66155 sys_close(fd);
66156 }
66157 printk(KERN_NOTICE "VFS: Insert %s and press ENTER\n", buf);
66158- fd = sys_open("/dev/console", O_RDWR, 0);
66159+ fd = sys_open((__force const char __user *)"/dev/console", O_RDWR, 0);
66160 if (fd >= 0) {
66161 sys_ioctl(fd, TCGETS, (long)&termios);
66162 termios.c_lflag &= ~ICANON;
66163 sys_ioctl(fd, TCSETSF, (long)&termios);
66164- sys_read(fd, &c, 1);
66165+ sys_read(fd, (char __user *)&c, 1);
66166 termios.c_lflag |= ICANON;
66167 sys_ioctl(fd, TCSETSF, (long)&termios);
66168 sys_close(fd);
66169@@ -488,6 +488,6 @@ void __init prepare_namespace(void)
66170 mount_root();
66171 out:
66172 devtmpfs_mount("dev");
66173- sys_mount(".", "/", NULL, MS_MOVE, NULL);
66174+ sys_mount((__force char __user *)".", (__force char __user *)"/", NULL, MS_MOVE, NULL);
66175 sys_chroot((const char __user __force *)".");
66176 }
66177diff -urNp linux-2.6.39/init/do_mounts.h linux-2.6.39/init/do_mounts.h
66178--- linux-2.6.39/init/do_mounts.h 2011-05-19 00:06:34.000000000 -0400
66179+++ linux-2.6.39/init/do_mounts.h 2011-05-22 19:36:33.000000000 -0400
66180@@ -15,15 +15,15 @@ extern int root_mountflags;
66181
66182 static inline int create_dev(char *name, dev_t dev)
66183 {
66184- sys_unlink(name);
66185- return sys_mknod(name, S_IFBLK|0600, new_encode_dev(dev));
66186+ sys_unlink((__force char __user *)name);
66187+ return sys_mknod((__force char __user *)name, S_IFBLK|0600, new_encode_dev(dev));
66188 }
66189
66190 #if BITS_PER_LONG == 32
66191 static inline u32 bstat(char *name)
66192 {
66193 struct stat64 stat;
66194- if (sys_stat64(name, &stat) != 0)
66195+ if (sys_stat64((__force char __user *)name, (__force struct stat64 __user *)&stat) != 0)
66196 return 0;
66197 if (!S_ISBLK(stat.st_mode))
66198 return 0;
66199diff -urNp linux-2.6.39/init/do_mounts_initrd.c linux-2.6.39/init/do_mounts_initrd.c
66200--- linux-2.6.39/init/do_mounts_initrd.c 2011-05-19 00:06:34.000000000 -0400
66201+++ linux-2.6.39/init/do_mounts_initrd.c 2011-05-22 19:36:33.000000000 -0400
66202@@ -44,13 +44,13 @@ static void __init handle_initrd(void)
66203 create_dev("/dev/root.old", Root_RAM0);
66204 /* mount initrd on rootfs' /root */
66205 mount_block_root("/dev/root.old", root_mountflags & ~MS_RDONLY);
66206- sys_mkdir("/old", 0700);
66207- root_fd = sys_open("/", 0, 0);
66208- old_fd = sys_open("/old", 0, 0);
66209+ sys_mkdir((__force const char __user *)"/old", 0700);
66210+ root_fd = sys_open((__force const char __user *)"/", 0, 0);
66211+ old_fd = sys_open((__force const char __user *)"/old", 0, 0);
66212 /* move initrd over / and chdir/chroot in initrd root */
66213- sys_chdir("/root");
66214- sys_mount(".", "/", NULL, MS_MOVE, NULL);
66215- sys_chroot(".");
66216+ sys_chdir((__force const char __user *)"/root");
66217+ sys_mount((__force char __user *)".", (__force char __user *)"/", NULL, MS_MOVE, NULL);
66218+ sys_chroot((__force const char __user *)".");
66219
66220 /*
66221 * In case that a resume from disk is carried out by linuxrc or one of
66222@@ -67,15 +67,15 @@ static void __init handle_initrd(void)
66223
66224 /* move initrd to rootfs' /old */
66225 sys_fchdir(old_fd);
66226- sys_mount("/", ".", NULL, MS_MOVE, NULL);
66227+ sys_mount((__force char __user *)"/", (__force char __user *)".", NULL, MS_MOVE, NULL);
66228 /* switch root and cwd back to / of rootfs */
66229 sys_fchdir(root_fd);
66230- sys_chroot(".");
66231+ sys_chroot((__force const char __user *)".");
66232 sys_close(old_fd);
66233 sys_close(root_fd);
66234
66235 if (new_decode_dev(real_root_dev) == Root_RAM0) {
66236- sys_chdir("/old");
66237+ sys_chdir((__force const char __user *)"/old");
66238 return;
66239 }
66240
66241@@ -83,17 +83,17 @@ static void __init handle_initrd(void)
66242 mount_root();
66243
66244 printk(KERN_NOTICE "Trying to move old root to /initrd ... ");
66245- error = sys_mount("/old", "/root/initrd", NULL, MS_MOVE, NULL);
66246+ error = sys_mount((__force char __user *)"/old", (__force char __user *)"/root/initrd", NULL, MS_MOVE, NULL);
66247 if (!error)
66248 printk("okay\n");
66249 else {
66250- int fd = sys_open("/dev/root.old", O_RDWR, 0);
66251+ int fd = sys_open((__force const char __user *)"/dev/root.old", O_RDWR, 0);
66252 if (error == -ENOENT)
66253 printk("/initrd does not exist. Ignored.\n");
66254 else
66255 printk("failed\n");
66256 printk(KERN_NOTICE "Unmounting old root\n");
66257- sys_umount("/old", MNT_DETACH);
66258+ sys_umount((__force char __user *)"/old", MNT_DETACH);
66259 printk(KERN_NOTICE "Trying to free ramdisk memory ... ");
66260 if (fd < 0) {
66261 error = fd;
66262@@ -116,11 +116,11 @@ int __init initrd_load(void)
66263 * mounted in the normal path.
66264 */
66265 if (rd_load_image("/initrd.image") && ROOT_DEV != Root_RAM0) {
66266- sys_unlink("/initrd.image");
66267+ sys_unlink((__force const char __user *)"/initrd.image");
66268 handle_initrd();
66269 return 1;
66270 }
66271 }
66272- sys_unlink("/initrd.image");
66273+ sys_unlink((__force const char __user *)"/initrd.image");
66274 return 0;
66275 }
66276diff -urNp linux-2.6.39/init/do_mounts_md.c linux-2.6.39/init/do_mounts_md.c
66277--- linux-2.6.39/init/do_mounts_md.c 2011-05-19 00:06:34.000000000 -0400
66278+++ linux-2.6.39/init/do_mounts_md.c 2011-05-22 19:36:33.000000000 -0400
66279@@ -170,7 +170,7 @@ static void __init md_setup_drive(void)
66280 partitioned ? "_d" : "", minor,
66281 md_setup_args[ent].device_names);
66282
66283- fd = sys_open(name, 0, 0);
66284+ fd = sys_open((__force char __user *)name, 0, 0);
66285 if (fd < 0) {
66286 printk(KERN_ERR "md: open failed - cannot start "
66287 "array %s\n", name);
66288@@ -233,7 +233,7 @@ static void __init md_setup_drive(void)
66289 * array without it
66290 */
66291 sys_close(fd);
66292- fd = sys_open(name, 0, 0);
66293+ fd = sys_open((__force char __user *)name, 0, 0);
66294 sys_ioctl(fd, BLKRRPART, 0);
66295 }
66296 sys_close(fd);
66297diff -urNp linux-2.6.39/init/initramfs.c linux-2.6.39/init/initramfs.c
66298--- linux-2.6.39/init/initramfs.c 2011-05-19 00:06:34.000000000 -0400
66299+++ linux-2.6.39/init/initramfs.c 2011-05-22 19:36:33.000000000 -0400
66300@@ -74,7 +74,7 @@ static void __init free_hash(void)
66301 }
66302 }
66303
66304-static long __init do_utime(char __user *filename, time_t mtime)
66305+static long __init do_utime(__force char __user *filename, time_t mtime)
66306 {
66307 struct timespec t[2];
66308
66309@@ -109,7 +109,7 @@ static void __init dir_utime(void)
66310 struct dir_entry *de, *tmp;
66311 list_for_each_entry_safe(de, tmp, &dir_list, list) {
66312 list_del(&de->list);
66313- do_utime(de->name, de->mtime);
66314+ do_utime((__force char __user *)de->name, de->mtime);
66315 kfree(de->name);
66316 kfree(de);
66317 }
66318@@ -271,7 +271,7 @@ static int __init maybe_link(void)
66319 if (nlink >= 2) {
66320 char *old = find_link(major, minor, ino, mode, collected);
66321 if (old)
66322- return (sys_link(old, collected) < 0) ? -1 : 1;
66323+ return (sys_link((__force char __user *)old, (__force char __user *)collected) < 0) ? -1 : 1;
66324 }
66325 return 0;
66326 }
66327@@ -280,11 +280,11 @@ static void __init clean_path(char *path
66328 {
66329 struct stat st;
66330
66331- if (!sys_newlstat(path, &st) && (st.st_mode^mode) & S_IFMT) {
66332+ if (!sys_newlstat((__force char __user *)path, (__force struct stat __user *)&st) && (st.st_mode^mode) & S_IFMT) {
66333 if (S_ISDIR(st.st_mode))
66334- sys_rmdir(path);
66335+ sys_rmdir((__force char __user *)path);
66336 else
66337- sys_unlink(path);
66338+ sys_unlink((__force char __user *)path);
66339 }
66340 }
66341
66342@@ -305,7 +305,7 @@ static int __init do_name(void)
66343 int openflags = O_WRONLY|O_CREAT;
66344 if (ml != 1)
66345 openflags |= O_TRUNC;
66346- wfd = sys_open(collected, openflags, mode);
66347+ wfd = sys_open((__force char __user *)collected, openflags, mode);
66348
66349 if (wfd >= 0) {
66350 sys_fchown(wfd, uid, gid);
66351@@ -317,17 +317,17 @@ static int __init do_name(void)
66352 }
66353 }
66354 } else if (S_ISDIR(mode)) {
66355- sys_mkdir(collected, mode);
66356- sys_chown(collected, uid, gid);
66357- sys_chmod(collected, mode);
66358+ sys_mkdir((__force char __user *)collected, mode);
66359+ sys_chown((__force char __user *)collected, uid, gid);
66360+ sys_chmod((__force char __user *)collected, mode);
66361 dir_add(collected, mtime);
66362 } else if (S_ISBLK(mode) || S_ISCHR(mode) ||
66363 S_ISFIFO(mode) || S_ISSOCK(mode)) {
66364 if (maybe_link() == 0) {
66365- sys_mknod(collected, mode, rdev);
66366- sys_chown(collected, uid, gid);
66367- sys_chmod(collected, mode);
66368- do_utime(collected, mtime);
66369+ sys_mknod((__force char __user *)collected, mode, rdev);
66370+ sys_chown((__force char __user *)collected, uid, gid);
66371+ sys_chmod((__force char __user *)collected, mode);
66372+ do_utime((__force char __user *)collected, mtime);
66373 }
66374 }
66375 return 0;
66376@@ -336,15 +336,15 @@ static int __init do_name(void)
66377 static int __init do_copy(void)
66378 {
66379 if (count >= body_len) {
66380- sys_write(wfd, victim, body_len);
66381+ sys_write(wfd, (__force char __user *)victim, body_len);
66382 sys_close(wfd);
66383- do_utime(vcollected, mtime);
66384+ do_utime((__force char __user *)vcollected, mtime);
66385 kfree(vcollected);
66386 eat(body_len);
66387 state = SkipIt;
66388 return 0;
66389 } else {
66390- sys_write(wfd, victim, count);
66391+ sys_write(wfd, (__force char __user *)victim, count);
66392 body_len -= count;
66393 eat(count);
66394 return 1;
66395@@ -355,9 +355,9 @@ static int __init do_symlink(void)
66396 {
66397 collected[N_ALIGN(name_len) + body_len] = '\0';
66398 clean_path(collected, 0);
66399- sys_symlink(collected + N_ALIGN(name_len), collected);
66400- sys_lchown(collected, uid, gid);
66401- do_utime(collected, mtime);
66402+ sys_symlink((__force char __user *)collected + N_ALIGN(name_len), (__force char __user *)collected);
66403+ sys_lchown((__force char __user *)collected, uid, gid);
66404+ do_utime((__force char __user *)collected, mtime);
66405 state = SkipIt;
66406 next_state = Reset;
66407 return 0;
66408diff -urNp linux-2.6.39/init/Kconfig linux-2.6.39/init/Kconfig
66409--- linux-2.6.39/init/Kconfig 2011-05-19 00:06:34.000000000 -0400
66410+++ linux-2.6.39/init/Kconfig 2011-05-22 19:36:33.000000000 -0400
66411@@ -1202,7 +1202,7 @@ config SLUB_DEBUG
66412
66413 config COMPAT_BRK
66414 bool "Disable heap randomization"
66415- default y
66416+ default n
66417 help
66418 Randomizing heap placement makes heap exploits harder, but it
66419 also breaks ancient binaries (including anything libc5 based).
66420diff -urNp linux-2.6.39/init/main.c linux-2.6.39/init/main.c
66421--- linux-2.6.39/init/main.c 2011-05-19 00:06:34.000000000 -0400
66422+++ linux-2.6.39/init/main.c 2011-05-22 19:41:42.000000000 -0400
66423@@ -96,6 +96,8 @@ static inline void mark_rodata_ro(void)
66424 extern void tc_init(void);
66425 #endif
66426
66427+extern void grsecurity_init(void);
66428+
66429 /*
66430 * Debug helper: via this flag we know that we are in 'early bootup code'
66431 * where only the boot processor is running with IRQ disabled. This means
66432@@ -149,6 +151,49 @@ static int __init set_reset_devices(char
66433
66434 __setup("reset_devices", set_reset_devices);
66435
66436+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
66437+extern char pax_enter_kernel_user[];
66438+extern char pax_exit_kernel_user[];
66439+extern pgdval_t clone_pgd_mask;
66440+#endif
66441+
66442+#if defined(CONFIG_X86) && defined(CONFIG_PAX_MEMORY_UDEREF)
66443+static int __init setup_pax_nouderef(char *str)
66444+{
66445+#ifdef CONFIG_X86_32
66446+ unsigned int cpu;
66447+ struct desc_struct *gdt;
66448+
66449+ for (cpu = 0; cpu < NR_CPUS; cpu++) {
66450+ gdt = get_cpu_gdt_table(cpu);
66451+ gdt[GDT_ENTRY_KERNEL_DS].type = 3;
66452+ gdt[GDT_ENTRY_KERNEL_DS].limit = 0xf;
66453+ gdt[GDT_ENTRY_DEFAULT_USER_CS].limit = 0xf;
66454+ gdt[GDT_ENTRY_DEFAULT_USER_DS].limit = 0xf;
66455+ }
66456+ asm("mov %0, %%ds; mov %0, %%es; mov %0, %%ss" : : "r" (__KERNEL_DS) : "memory");
66457+#else
66458+ memcpy(pax_enter_kernel_user, (unsigned char []){0xc3}, 1);
66459+ memcpy(pax_exit_kernel_user, (unsigned char []){0xc3}, 1);
66460+ clone_pgd_mask = ~(pgdval_t)0UL;
66461+#endif
66462+
66463+ return 0;
66464+}
66465+early_param("pax_nouderef", setup_pax_nouderef);
66466+#endif
66467+
66468+#ifdef CONFIG_PAX_SOFTMODE
66469+unsigned int pax_softmode;
66470+
66471+static int __init setup_pax_softmode(char *str)
66472+{
66473+ get_option(&str, &pax_softmode);
66474+ return 1;
66475+}
66476+__setup("pax_softmode=", setup_pax_softmode);
66477+#endif
66478+
66479 static const char * argv_init[MAX_INIT_ARGS+2] = { "init", NULL, };
66480 const char * envp_init[MAX_INIT_ENVS+2] = { "HOME=/", "TERM=linux", NULL, };
66481 static const char *panic_later, *panic_param;
66482@@ -663,6 +708,7 @@ int __init_or_module do_one_initcall(ini
66483 {
66484 int count = preempt_count();
66485 int ret;
66486+ const char *msg1 = "", *msg2 = "";
66487
66488 if (initcall_debug)
66489 ret = do_one_initcall_debug(fn);
66490@@ -675,15 +721,15 @@ int __init_or_module do_one_initcall(ini
66491 sprintf(msgbuf, "error code %d ", ret);
66492
66493 if (preempt_count() != count) {
66494- strlcat(msgbuf, "preemption imbalance ", sizeof(msgbuf));
66495+ msg1 = " preemption imbalance";
66496 preempt_count() = count;
66497 }
66498 if (irqs_disabled()) {
66499- strlcat(msgbuf, "disabled interrupts ", sizeof(msgbuf));
66500+ msg2 = " disabled interrupts";
66501 local_irq_enable();
66502 }
66503- if (msgbuf[0]) {
66504- printk("initcall %pF returned with %s\n", fn, msgbuf);
66505+ if (msgbuf[0] || *msg1 || *msg2) {
66506+ printk("initcall %pF returned with %s%s%s\n", fn, msgbuf, msg1, msg2);
66507 }
66508
66509 return ret;
66510@@ -801,7 +847,7 @@ static int __init kernel_init(void * unu
66511 do_basic_setup();
66512
66513 /* Open the /dev/console on the rootfs, this should never fail */
66514- if (sys_open((const char __user *) "/dev/console", O_RDWR, 0) < 0)
66515+ if (sys_open((__force const char __user *) "/dev/console", O_RDWR, 0) < 0)
66516 printk(KERN_WARNING "Warning: unable to open an initial console.\n");
66517
66518 (void) sys_dup(0);
66519@@ -814,11 +860,13 @@ static int __init kernel_init(void * unu
66520 if (!ramdisk_execute_command)
66521 ramdisk_execute_command = "/init";
66522
66523- if (sys_access((const char __user *) ramdisk_execute_command, 0) != 0) {
66524+ if (sys_access((__force const char __user *) ramdisk_execute_command, 0) != 0) {
66525 ramdisk_execute_command = NULL;
66526 prepare_namespace();
66527 }
66528
66529+ grsecurity_init();
66530+
66531 /*
66532 * Ok, we have completed the initial bootup, and
66533 * we're essentially up and running. Get rid of the
66534diff -urNp linux-2.6.39/ipc/mqueue.c linux-2.6.39/ipc/mqueue.c
66535--- linux-2.6.39/ipc/mqueue.c 2011-05-19 00:06:34.000000000 -0400
66536+++ linux-2.6.39/ipc/mqueue.c 2011-05-22 19:41:42.000000000 -0400
66537@@ -154,6 +154,7 @@ static struct inode *mqueue_get_inode(st
66538 mq_bytes = (mq_msg_tblsz +
66539 (info->attr.mq_maxmsg * info->attr.mq_msgsize));
66540
66541+ gr_learn_resource(current, RLIMIT_MSGQUEUE, u->mq_bytes + mq_bytes, 1);
66542 spin_lock(&mq_lock);
66543 if (u->mq_bytes + mq_bytes < u->mq_bytes ||
66544 u->mq_bytes + mq_bytes >
66545diff -urNp linux-2.6.39/ipc/sem.c linux-2.6.39/ipc/sem.c
66546--- linux-2.6.39/ipc/sem.c 2011-05-19 00:06:34.000000000 -0400
66547+++ linux-2.6.39/ipc/sem.c 2011-05-22 19:36:33.000000000 -0400
66548@@ -854,6 +854,8 @@ static int semctl_main(struct ipc_namesp
66549 int nsems;
66550 struct list_head tasks;
66551
66552+ pax_track_stack();
66553+
66554 sma = sem_lock_check(ns, semid);
66555 if (IS_ERR(sma))
66556 return PTR_ERR(sma);
66557@@ -1301,6 +1303,8 @@ SYSCALL_DEFINE4(semtimedop, int, semid,
66558 struct ipc_namespace *ns;
66559 struct list_head tasks;
66560
66561+ pax_track_stack();
66562+
66563 ns = current->nsproxy->ipc_ns;
66564
66565 if (nsops < 1 || semid < 0)
66566diff -urNp linux-2.6.39/ipc/shm.c linux-2.6.39/ipc/shm.c
66567--- linux-2.6.39/ipc/shm.c 2011-05-19 00:06:34.000000000 -0400
66568+++ linux-2.6.39/ipc/shm.c 2011-05-22 19:41:42.000000000 -0400
66569@@ -69,6 +69,14 @@ static void shm_destroy (struct ipc_name
66570 static int sysvipc_shm_proc_show(struct seq_file *s, void *it);
66571 #endif
66572
66573+#ifdef CONFIG_GRKERNSEC
66574+extern int gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
66575+ const time_t shm_createtime, const uid_t cuid,
66576+ const int shmid);
66577+extern int gr_chroot_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
66578+ const time_t shm_createtime);
66579+#endif
66580+
66581 void shm_init_ns(struct ipc_namespace *ns)
66582 {
66583 ns->shm_ctlmax = SHMMAX;
66584@@ -401,6 +409,14 @@ static int newseg(struct ipc_namespace *
66585 shp->shm_lprid = 0;
66586 shp->shm_atim = shp->shm_dtim = 0;
66587 shp->shm_ctim = get_seconds();
66588+#ifdef CONFIG_GRKERNSEC
66589+ {
66590+ struct timespec timeval;
66591+ do_posix_clock_monotonic_gettime(&timeval);
66592+
66593+ shp->shm_createtime = timeval.tv_sec;
66594+ }
66595+#endif
66596 shp->shm_segsz = size;
66597 shp->shm_nattch = 0;
66598 shp->shm_file = file;
66599@@ -762,8 +778,6 @@ SYSCALL_DEFINE3(shmctl, int, shmid, int,
66600 case SHM_LOCK:
66601 case SHM_UNLOCK:
66602 {
66603- struct file *uninitialized_var(shm_file);
66604-
66605 lru_add_drain_all(); /* drain pagevecs to lru lists */
66606
66607 shp = shm_lock_check(ns, shmid);
66608@@ -896,9 +910,21 @@ long do_shmat(int shmid, char __user *sh
66609 if (err)
66610 goto out_unlock;
66611
66612+#ifdef CONFIG_GRKERNSEC
66613+ if (!gr_handle_shmat(shp->shm_cprid, shp->shm_lapid, shp->shm_createtime,
66614+ shp->shm_perm.cuid, shmid) ||
66615+ !gr_chroot_shmat(shp->shm_cprid, shp->shm_lapid, shp->shm_createtime)) {
66616+ err = -EACCES;
66617+ goto out_unlock;
66618+ }
66619+#endif
66620+
66621 path = shp->shm_file->f_path;
66622 path_get(&path);
66623 shp->shm_nattch++;
66624+#ifdef CONFIG_GRKERNSEC
66625+ shp->shm_lapid = current->pid;
66626+#endif
66627 size = i_size_read(path.dentry->d_inode);
66628 shm_unlock(shp);
66629
66630diff -urNp linux-2.6.39/kernel/acct.c linux-2.6.39/kernel/acct.c
66631--- linux-2.6.39/kernel/acct.c 2011-05-19 00:06:34.000000000 -0400
66632+++ linux-2.6.39/kernel/acct.c 2011-05-22 19:36:33.000000000 -0400
66633@@ -570,7 +570,7 @@ static void do_acct_process(struct bsd_a
66634 */
66635 flim = current->signal->rlim[RLIMIT_FSIZE].rlim_cur;
66636 current->signal->rlim[RLIMIT_FSIZE].rlim_cur = RLIM_INFINITY;
66637- file->f_op->write(file, (char *)&ac,
66638+ file->f_op->write(file, (__force char __user *)&ac,
66639 sizeof(acct_t), &file->f_pos);
66640 current->signal->rlim[RLIMIT_FSIZE].rlim_cur = flim;
66641 set_fs(fs);
66642diff -urNp linux-2.6.39/kernel/audit.c linux-2.6.39/kernel/audit.c
66643--- linux-2.6.39/kernel/audit.c 2011-05-19 00:06:34.000000000 -0400
66644+++ linux-2.6.39/kernel/audit.c 2011-05-22 19:36:33.000000000 -0400
66645@@ -112,7 +112,7 @@ u32 audit_sig_sid = 0;
66646 3) suppressed due to audit_rate_limit
66647 4) suppressed due to audit_backlog_limit
66648 */
66649-static atomic_t audit_lost = ATOMIC_INIT(0);
66650+static atomic_unchecked_t audit_lost = ATOMIC_INIT(0);
66651
66652 /* The netlink socket. */
66653 static struct sock *audit_sock;
66654@@ -234,7 +234,7 @@ void audit_log_lost(const char *message)
66655 unsigned long now;
66656 int print;
66657
66658- atomic_inc(&audit_lost);
66659+ atomic_inc_unchecked(&audit_lost);
66660
66661 print = (audit_failure == AUDIT_FAIL_PANIC || !audit_rate_limit);
66662
66663@@ -253,7 +253,7 @@ void audit_log_lost(const char *message)
66664 printk(KERN_WARNING
66665 "audit: audit_lost=%d audit_rate_limit=%d "
66666 "audit_backlog_limit=%d\n",
66667- atomic_read(&audit_lost),
66668+ atomic_read_unchecked(&audit_lost),
66669 audit_rate_limit,
66670 audit_backlog_limit);
66671 audit_panic(message);
66672@@ -686,7 +686,7 @@ static int audit_receive_msg(struct sk_b
66673 status_set.pid = audit_pid;
66674 status_set.rate_limit = audit_rate_limit;
66675 status_set.backlog_limit = audit_backlog_limit;
66676- status_set.lost = atomic_read(&audit_lost);
66677+ status_set.lost = atomic_read_unchecked(&audit_lost);
66678 status_set.backlog = skb_queue_len(&audit_skb_queue);
66679 audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_GET, 0, 0,
66680 &status_set, sizeof(status_set));
66681diff -urNp linux-2.6.39/kernel/auditsc.c linux-2.6.39/kernel/auditsc.c
66682--- linux-2.6.39/kernel/auditsc.c 2011-05-19 00:06:34.000000000 -0400
66683+++ linux-2.6.39/kernel/auditsc.c 2011-05-22 19:36:33.000000000 -0400
66684@@ -2111,7 +2111,7 @@ int auditsc_get_stamp(struct audit_conte
66685 }
66686
66687 /* global counter which is incremented every time something logs in */
66688-static atomic_t session_id = ATOMIC_INIT(0);
66689+static atomic_unchecked_t session_id = ATOMIC_INIT(0);
66690
66691 /**
66692 * audit_set_loginuid - set a task's audit_context loginuid
66693@@ -2124,7 +2124,7 @@ static atomic_t session_id = ATOMIC_INIT
66694 */
66695 int audit_set_loginuid(struct task_struct *task, uid_t loginuid)
66696 {
66697- unsigned int sessionid = atomic_inc_return(&session_id);
66698+ unsigned int sessionid = atomic_inc_return_unchecked(&session_id);
66699 struct audit_context *context = task->audit_context;
66700
66701 if (context && context->in_syscall) {
66702diff -urNp linux-2.6.39/kernel/capability.c linux-2.6.39/kernel/capability.c
66703--- linux-2.6.39/kernel/capability.c 2011-05-19 00:06:34.000000000 -0400
66704+++ linux-2.6.39/kernel/capability.c 2011-05-22 21:02:23.000000000 -0400
66705@@ -206,6 +206,9 @@ SYSCALL_DEFINE2(capget, cap_user_header_
66706 * before modification is attempted and the application
66707 * fails.
66708 */
66709+ if (tocopy > ARRAY_SIZE(kdata))
66710+ return -EFAULT;
66711+
66712 if (copy_to_user(dataptr, kdata, tocopy
66713 * sizeof(struct __user_cap_data_struct))) {
66714 return -EFAULT;
66715@@ -378,7 +381,7 @@ bool ns_capable(struct user_namespace *n
66716 BUG();
66717 }
66718
66719- if (security_capable(ns, current_cred(), cap) == 0) {
66720+ if (security_capable(ns, current_cred(), cap) == 0 && gr_is_capable(cap)) {
66721 current->flags |= PF_SUPERPRIV;
66722 return true;
66723 }
66724@@ -386,6 +389,27 @@ bool ns_capable(struct user_namespace *n
66725 }
66726 EXPORT_SYMBOL(ns_capable);
66727
66728+bool ns_capable_nolog(struct user_namespace *ns, int cap)
66729+{
66730+ if (unlikely(!cap_valid(cap))) {
66731+ printk(KERN_CRIT "capable() called with invalid cap=%u\n", cap);
66732+ BUG();
66733+ }
66734+
66735+ if (security_capable(ns, current_cred(), cap) == 0 && gr_is_capable_nolog(cap)) {
66736+ current->flags |= PF_SUPERPRIV;
66737+ return true;
66738+ }
66739+ return false;
66740+}
66741+EXPORT_SYMBOL(ns_capable_nolog);
66742+
66743+bool capable_nolog(int cap)
66744+{
66745+ return ns_capable_nolog(&init_user_ns, cap);
66746+}
66747+EXPORT_SYMBOL(capable_nolog);
66748+
66749 /**
66750 * task_ns_capable - Determine whether current task has a superior
66751 * capability targeted at a specific task's user namespace.
66752@@ -400,6 +424,12 @@ bool task_ns_capable(struct task_struct
66753 }
66754 EXPORT_SYMBOL(task_ns_capable);
66755
66756+bool task_ns_capable_nolog(struct task_struct *t, int cap)
66757+{
66758+ return ns_capable_nolog(task_cred_xxx(t, user)->user_ns, cap);
66759+}
66760+EXPORT_SYMBOL(task_ns_capable_nolog);
66761+
66762 /**
66763 * nsown_capable - Check superior capability to one's own user_ns
66764 * @cap: The capability in question
66765diff -urNp linux-2.6.39/kernel/cgroup.c linux-2.6.39/kernel/cgroup.c
66766--- linux-2.6.39/kernel/cgroup.c 2011-05-19 00:06:34.000000000 -0400
66767+++ linux-2.6.39/kernel/cgroup.c 2011-05-22 19:36:33.000000000 -0400
66768@@ -598,6 +598,8 @@ static struct css_set *find_css_set(
66769 struct hlist_head *hhead;
66770 struct cg_cgroup_link *link;
66771
66772+ pax_track_stack();
66773+
66774 /* First see if we already have a cgroup group that matches
66775 * the desired set */
66776 read_lock(&css_set_lock);
66777diff -urNp linux-2.6.39/kernel/compat.c linux-2.6.39/kernel/compat.c
66778--- linux-2.6.39/kernel/compat.c 2011-05-19 00:06:34.000000000 -0400
66779+++ linux-2.6.39/kernel/compat.c 2011-05-22 19:41:42.000000000 -0400
66780@@ -13,6 +13,7 @@
66781
66782 #include <linux/linkage.h>
66783 #include <linux/compat.h>
66784+#include <linux/module.h>
66785 #include <linux/errno.h>
66786 #include <linux/time.h>
66787 #include <linux/signal.h>
66788diff -urNp linux-2.6.39/kernel/configs.c linux-2.6.39/kernel/configs.c
66789--- linux-2.6.39/kernel/configs.c 2011-05-19 00:06:34.000000000 -0400
66790+++ linux-2.6.39/kernel/configs.c 2011-05-22 19:41:42.000000000 -0400
66791@@ -74,8 +74,19 @@ static int __init ikconfig_init(void)
66792 struct proc_dir_entry *entry;
66793
66794 /* create the current config file */
66795+#if defined(CONFIG_GRKERNSEC_PROC_ADD) || defined(CONFIG_GRKERNSEC_HIDESYM)
66796+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_HIDESYM)
66797+ entry = proc_create("config.gz", S_IFREG | S_IRUSR, NULL,
66798+ &ikconfig_file_ops);
66799+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
66800+ entry = proc_create("config.gz", S_IFREG | S_IRUSR | S_IRGRP, NULL,
66801+ &ikconfig_file_ops);
66802+#endif
66803+#else
66804 entry = proc_create("config.gz", S_IFREG | S_IRUGO, NULL,
66805 &ikconfig_file_ops);
66806+#endif
66807+
66808 if (!entry)
66809 return -ENOMEM;
66810
66811diff -urNp linux-2.6.39/kernel/cred.c linux-2.6.39/kernel/cred.c
66812--- linux-2.6.39/kernel/cred.c 2011-05-19 00:06:34.000000000 -0400
66813+++ linux-2.6.39/kernel/cred.c 2011-05-22 19:41:42.000000000 -0400
66814@@ -158,6 +158,8 @@ static void put_cred_rcu(struct rcu_head
66815 */
66816 void __put_cred(struct cred *cred)
66817 {
66818+ pax_track_stack();
66819+
66820 kdebug("__put_cred(%p{%d,%d})", cred,
66821 atomic_read(&cred->usage),
66822 read_cred_subscribers(cred));
66823@@ -182,6 +184,8 @@ void exit_creds(struct task_struct *tsk)
66824 {
66825 struct cred *cred;
66826
66827+ pax_track_stack();
66828+
66829 kdebug("exit_creds(%u,%p,%p,{%d,%d})", tsk->pid, tsk->real_cred, tsk->cred,
66830 atomic_read(&tsk->cred->usage),
66831 read_cred_subscribers(tsk->cred));
66832@@ -220,6 +224,8 @@ const struct cred *get_task_cred(struct
66833 {
66834 const struct cred *cred;
66835
66836+ pax_track_stack();
66837+
66838 rcu_read_lock();
66839
66840 do {
66841@@ -239,6 +245,8 @@ struct cred *cred_alloc_blank(void)
66842 {
66843 struct cred *new;
66844
66845+ pax_track_stack();
66846+
66847 new = kmem_cache_zalloc(cred_jar, GFP_KERNEL);
66848 if (!new)
66849 return NULL;
66850@@ -287,6 +295,8 @@ struct cred *prepare_creds(void)
66851 const struct cred *old;
66852 struct cred *new;
66853
66854+ pax_track_stack();
66855+
66856 validate_process_creds();
66857
66858 new = kmem_cache_alloc(cred_jar, GFP_KERNEL);
66859@@ -333,6 +343,8 @@ struct cred *prepare_exec_creds(void)
66860 struct thread_group_cred *tgcred = NULL;
66861 struct cred *new;
66862
66863+ pax_track_stack();
66864+
66865 #ifdef CONFIG_KEYS
66866 tgcred = kmalloc(sizeof(*tgcred), GFP_KERNEL);
66867 if (!tgcred)
66868@@ -385,6 +397,8 @@ int copy_creds(struct task_struct *p, un
66869 struct cred *new;
66870 int ret;
66871
66872+ pax_track_stack();
66873+
66874 if (
66875 #ifdef CONFIG_KEYS
66876 !p->cred->thread_keyring &&
66877@@ -475,6 +489,8 @@ int commit_creds(struct cred *new)
66878 struct task_struct *task = current;
66879 const struct cred *old = task->real_cred;
66880
66881+ pax_track_stack();
66882+
66883 kdebug("commit_creds(%p{%d,%d})", new,
66884 atomic_read(&new->usage),
66885 read_cred_subscribers(new));
66886@@ -489,6 +505,8 @@ int commit_creds(struct cred *new)
66887
66888 get_cred(new); /* we will require a ref for the subj creds too */
66889
66890+ gr_set_role_label(task, new->uid, new->gid);
66891+
66892 /* dumpability changes */
66893 if (old->euid != new->euid ||
66894 old->egid != new->egid ||
66895@@ -551,6 +569,8 @@ EXPORT_SYMBOL(commit_creds);
66896 */
66897 void abort_creds(struct cred *new)
66898 {
66899+ pax_track_stack();
66900+
66901 kdebug("abort_creds(%p{%d,%d})", new,
66902 atomic_read(&new->usage),
66903 read_cred_subscribers(new));
66904@@ -574,6 +594,8 @@ const struct cred *override_creds(const
66905 {
66906 const struct cred *old = current->cred;
66907
66908+ pax_track_stack();
66909+
66910 kdebug("override_creds(%p{%d,%d})", new,
66911 atomic_read(&new->usage),
66912 read_cred_subscribers(new));
66913@@ -603,6 +625,8 @@ void revert_creds(const struct cred *old
66914 {
66915 const struct cred *override = current->cred;
66916
66917+ pax_track_stack();
66918+
66919 kdebug("revert_creds(%p{%d,%d})", old,
66920 atomic_read(&old->usage),
66921 read_cred_subscribers(old));
66922@@ -649,6 +673,8 @@ struct cred *prepare_kernel_cred(struct
66923 const struct cred *old;
66924 struct cred *new;
66925
66926+ pax_track_stack();
66927+
66928 new = kmem_cache_alloc(cred_jar, GFP_KERNEL);
66929 if (!new)
66930 return NULL;
66931@@ -703,6 +729,8 @@ EXPORT_SYMBOL(prepare_kernel_cred);
66932 */
66933 int set_security_override(struct cred *new, u32 secid)
66934 {
66935+ pax_track_stack();
66936+
66937 return security_kernel_act_as(new, secid);
66938 }
66939 EXPORT_SYMBOL(set_security_override);
66940@@ -722,6 +750,8 @@ int set_security_override_from_ctx(struc
66941 u32 secid;
66942 int ret;
66943
66944+ pax_track_stack();
66945+
66946 ret = security_secctx_to_secid(secctx, strlen(secctx), &secid);
66947 if (ret < 0)
66948 return ret;
66949diff -urNp linux-2.6.39/kernel/debug/debug_core.c linux-2.6.39/kernel/debug/debug_core.c
66950--- linux-2.6.39/kernel/debug/debug_core.c 2011-05-19 00:06:34.000000000 -0400
66951+++ linux-2.6.39/kernel/debug/debug_core.c 2011-05-22 19:36:33.000000000 -0400
66952@@ -72,7 +72,7 @@ int kgdb_io_module_registered;
66953 /* Guard for recursive entry */
66954 static int exception_level;
66955
66956-struct kgdb_io *dbg_io_ops;
66957+const struct kgdb_io *dbg_io_ops;
66958 static DEFINE_SPINLOCK(kgdb_registration_lock);
66959
66960 /* kgdb console driver is loaded */
66961@@ -119,7 +119,7 @@ static DEFINE_RAW_SPINLOCK(dbg_slave_loc
66962 */
66963 static atomic_t masters_in_kgdb;
66964 static atomic_t slaves_in_kgdb;
66965-static atomic_t kgdb_break_tasklet_var;
66966+static atomic_unchecked_t kgdb_break_tasklet_var;
66967 atomic_t kgdb_setting_breakpoint;
66968
66969 struct task_struct *kgdb_usethread;
66970@@ -129,7 +129,7 @@ int kgdb_single_step;
66971 static pid_t kgdb_sstep_pid;
66972
66973 /* to keep track of the CPU which is doing the single stepping*/
66974-atomic_t kgdb_cpu_doing_single_step = ATOMIC_INIT(-1);
66975+atomic_unchecked_t kgdb_cpu_doing_single_step = ATOMIC_INIT(-1);
66976
66977 /*
66978 * If you are debugging a problem where roundup (the collection of
66979@@ -542,7 +542,7 @@ return_normal:
66980 * kernel will only try for the value of sstep_tries before
66981 * giving up and continuing on.
66982 */
66983- if (atomic_read(&kgdb_cpu_doing_single_step) != -1 &&
66984+ if (atomic_read_unchecked(&kgdb_cpu_doing_single_step) != -1 &&
66985 (kgdb_info[cpu].task &&
66986 kgdb_info[cpu].task->pid != kgdb_sstep_pid) && --sstep_tries) {
66987 atomic_set(&kgdb_active, -1);
66988@@ -636,8 +636,8 @@ cpu_master_loop:
66989 }
66990
66991 kgdb_restore:
66992- if (atomic_read(&kgdb_cpu_doing_single_step) != -1) {
66993- int sstep_cpu = atomic_read(&kgdb_cpu_doing_single_step);
66994+ if (atomic_read_unchecked(&kgdb_cpu_doing_single_step) != -1) {
66995+ int sstep_cpu = atomic_read_unchecked(&kgdb_cpu_doing_single_step);
66996 if (kgdb_info[sstep_cpu].task)
66997 kgdb_sstep_pid = kgdb_info[sstep_cpu].task->pid;
66998 else
66999@@ -834,18 +834,18 @@ static void kgdb_unregister_callbacks(vo
67000 static void kgdb_tasklet_bpt(unsigned long ing)
67001 {
67002 kgdb_breakpoint();
67003- atomic_set(&kgdb_break_tasklet_var, 0);
67004+ atomic_set_unchecked(&kgdb_break_tasklet_var, 0);
67005 }
67006
67007 static DECLARE_TASKLET(kgdb_tasklet_breakpoint, kgdb_tasklet_bpt, 0);
67008
67009 void kgdb_schedule_breakpoint(void)
67010 {
67011- if (atomic_read(&kgdb_break_tasklet_var) ||
67012+ if (atomic_read_unchecked(&kgdb_break_tasklet_var) ||
67013 atomic_read(&kgdb_active) != -1 ||
67014 atomic_read(&kgdb_setting_breakpoint))
67015 return;
67016- atomic_inc(&kgdb_break_tasklet_var);
67017+ atomic_inc_unchecked(&kgdb_break_tasklet_var);
67018 tasklet_schedule(&kgdb_tasklet_breakpoint);
67019 }
67020 EXPORT_SYMBOL_GPL(kgdb_schedule_breakpoint);
67021@@ -864,7 +864,7 @@ static void kgdb_initial_breakpoint(void
67022 *
67023 * Register it with the KGDB core.
67024 */
67025-int kgdb_register_io_module(struct kgdb_io *new_dbg_io_ops)
67026+int kgdb_register_io_module(const struct kgdb_io *new_dbg_io_ops)
67027 {
67028 int err;
67029
67030@@ -909,7 +909,7 @@ EXPORT_SYMBOL_GPL(kgdb_register_io_modul
67031 *
67032 * Unregister it with the KGDB core.
67033 */
67034-void kgdb_unregister_io_module(struct kgdb_io *old_dbg_io_ops)
67035+void kgdb_unregister_io_module(const struct kgdb_io *old_dbg_io_ops)
67036 {
67037 BUG_ON(kgdb_connected);
67038
67039diff -urNp linux-2.6.39/kernel/debug/kdb/kdb_main.c linux-2.6.39/kernel/debug/kdb/kdb_main.c
67040--- linux-2.6.39/kernel/debug/kdb/kdb_main.c 2011-05-19 00:06:34.000000000 -0400
67041+++ linux-2.6.39/kernel/debug/kdb/kdb_main.c 2011-05-22 19:36:33.000000000 -0400
67042@@ -1980,7 +1980,7 @@ static int kdb_lsmod(int argc, const cha
67043 list_for_each_entry(mod, kdb_modules, list) {
67044
67045 kdb_printf("%-20s%8u 0x%p ", mod->name,
67046- mod->core_size, (void *)mod);
67047+ mod->core_size_rx + mod->core_size_rw, (void *)mod);
67048 #ifdef CONFIG_MODULE_UNLOAD
67049 kdb_printf("%4d ", module_refcount(mod));
67050 #endif
67051@@ -1990,7 +1990,7 @@ static int kdb_lsmod(int argc, const cha
67052 kdb_printf(" (Loading)");
67053 else
67054 kdb_printf(" (Live)");
67055- kdb_printf(" 0x%p", mod->module_core);
67056+ kdb_printf(" 0x%p 0x%p", mod->module_core_rx, mod->module_core_rw);
67057
67058 #ifdef CONFIG_MODULE_UNLOAD
67059 {
67060diff -urNp linux-2.6.39/kernel/exit.c linux-2.6.39/kernel/exit.c
67061--- linux-2.6.39/kernel/exit.c 2011-05-19 00:06:34.000000000 -0400
67062+++ linux-2.6.39/kernel/exit.c 2011-05-22 20:02:30.000000000 -0400
67063@@ -57,6 +57,10 @@
67064 #include <asm/pgtable.h>
67065 #include <asm/mmu_context.h>
67066
67067+#ifdef CONFIG_GRKERNSEC
67068+extern rwlock_t grsec_exec_file_lock;
67069+#endif
67070+
67071 static void exit_mm(struct task_struct * tsk);
67072
67073 static void __unhash_process(struct task_struct *p, bool group_dead)
67074@@ -169,6 +173,8 @@ void release_task(struct task_struct * p
67075 struct task_struct *leader;
67076 int zap_leader;
67077 repeat:
67078+ gr_del_task_from_ip_table(p);
67079+
67080 tracehook_prepare_release_task(p);
67081 /* don't need to get the RCU readlock here - the process is dead and
67082 * can't be modifying its own credentials. But shut RCU-lockdep up */
67083@@ -338,11 +344,22 @@ static void reparent_to_kthreadd(void)
67084 {
67085 write_lock_irq(&tasklist_lock);
67086
67087+#ifdef CONFIG_GRKERNSEC
67088+ write_lock(&grsec_exec_file_lock);
67089+ if (current->exec_file) {
67090+ fput(current->exec_file);
67091+ current->exec_file = NULL;
67092+ }
67093+ write_unlock(&grsec_exec_file_lock);
67094+#endif
67095+
67096 ptrace_unlink(current);
67097 /* Reparent to init */
67098 current->real_parent = current->parent = kthreadd_task;
67099 list_move_tail(&current->sibling, &current->real_parent->children);
67100
67101+ gr_set_kernel_label(current);
67102+
67103 /* Set the exit signal to SIGCHLD so we signal init on exit */
67104 current->exit_signal = SIGCHLD;
67105
67106@@ -394,7 +411,7 @@ int allow_signal(int sig)
67107 * know it'll be handled, so that they don't get converted to
67108 * SIGKILL or just silently dropped.
67109 */
67110- current->sighand->action[(sig)-1].sa.sa_handler = (void __user *)2;
67111+ current->sighand->action[(sig)-1].sa.sa_handler = (__force void __user *)2;
67112 recalc_sigpending();
67113 spin_unlock_irq(&current->sighand->siglock);
67114 return 0;
67115@@ -430,6 +447,17 @@ void daemonize(const char *name, ...)
67116 vsnprintf(current->comm, sizeof(current->comm), name, args);
67117 va_end(args);
67118
67119+#ifdef CONFIG_GRKERNSEC
67120+ write_lock(&grsec_exec_file_lock);
67121+ if (current->exec_file) {
67122+ fput(current->exec_file);
67123+ current->exec_file = NULL;
67124+ }
67125+ write_unlock(&grsec_exec_file_lock);
67126+#endif
67127+
67128+ gr_set_kernel_label(current);
67129+
67130 /*
67131 * If we were started as result of loading a module, close all of the
67132 * user space pages. We don't need them, and if we didn't close them
67133@@ -905,15 +933,8 @@ NORET_TYPE void do_exit(long code)
67134 struct task_struct *tsk = current;
67135 int group_dead;
67136
67137- profile_task_exit(tsk);
67138-
67139- WARN_ON(atomic_read(&tsk->fs_excl));
67140- WARN_ON(blk_needs_flush_plug(tsk));
67141-
67142 if (unlikely(in_interrupt()))
67143 panic("Aiee, killing interrupt handler!");
67144- if (unlikely(!tsk->pid))
67145- panic("Attempted to kill the idle task!");
67146
67147 /*
67148 * If do_exit is called because this processes oopsed, it's possible
67149@@ -924,6 +945,14 @@ NORET_TYPE void do_exit(long code)
67150 */
67151 set_fs(USER_DS);
67152
67153+ profile_task_exit(tsk);
67154+
67155+ WARN_ON(atomic_read(&tsk->fs_excl));
67156+ WARN_ON(blk_needs_flush_plug(tsk));
67157+
67158+ if (unlikely(!tsk->pid))
67159+ panic("Attempted to kill the idle task!");
67160+
67161 tracehook_report_exit(&code);
67162
67163 validate_creds_for_do_exit(tsk);
67164@@ -984,6 +1013,9 @@ NORET_TYPE void do_exit(long code)
67165 tsk->exit_code = code;
67166 taskstats_exit(tsk, group_dead);
67167
67168+ gr_acl_handle_psacct(tsk, code);
67169+ gr_acl_handle_exit();
67170+
67171 exit_mm(tsk);
67172
67173 if (group_dead)
67174diff -urNp linux-2.6.39/kernel/fork.c linux-2.6.39/kernel/fork.c
67175--- linux-2.6.39/kernel/fork.c 2011-05-19 00:06:34.000000000 -0400
67176+++ linux-2.6.39/kernel/fork.c 2011-05-22 19:41:42.000000000 -0400
67177@@ -287,7 +287,7 @@ static struct task_struct *dup_task_stru
67178 *stackend = STACK_END_MAGIC; /* for overflow detection */
67179
67180 #ifdef CONFIG_CC_STACKPROTECTOR
67181- tsk->stack_canary = get_random_int();
67182+ tsk->stack_canary = pax_get_random_long();
67183 #endif
67184
67185 /* One for us, one for whoever does the "release_task()" (usually parent) */
67186@@ -309,13 +309,78 @@ out:
67187 }
67188
67189 #ifdef CONFIG_MMU
67190+static struct vm_area_struct *dup_vma(struct mm_struct *mm, struct vm_area_struct *mpnt)
67191+{
67192+ struct vm_area_struct *tmp;
67193+ unsigned long charge;
67194+ struct mempolicy *pol;
67195+ struct file *file;
67196+
67197+ charge = 0;
67198+ if (mpnt->vm_flags & VM_ACCOUNT) {
67199+ unsigned int len = (mpnt->vm_end - mpnt->vm_start) >> PAGE_SHIFT;
67200+ if (security_vm_enough_memory(len))
67201+ goto fail_nomem;
67202+ charge = len;
67203+ }
67204+ tmp = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
67205+ if (!tmp)
67206+ goto fail_nomem;
67207+ *tmp = *mpnt;
67208+ tmp->vm_mm = mm;
67209+ INIT_LIST_HEAD(&tmp->anon_vma_chain);
67210+ pol = mpol_dup(vma_policy(mpnt));
67211+ if (IS_ERR(pol))
67212+ goto fail_nomem_policy;
67213+ vma_set_policy(tmp, pol);
67214+ if (anon_vma_fork(tmp, mpnt))
67215+ goto fail_nomem_anon_vma_fork;
67216+ tmp->vm_flags &= ~VM_LOCKED;
67217+ tmp->vm_next = tmp->vm_prev = NULL;
67218+ tmp->vm_mirror = NULL;
67219+ file = tmp->vm_file;
67220+ if (file) {
67221+ struct inode *inode = file->f_path.dentry->d_inode;
67222+ struct address_space *mapping = file->f_mapping;
67223+
67224+ get_file(file);
67225+ if (tmp->vm_flags & VM_DENYWRITE)
67226+ atomic_dec(&inode->i_writecount);
67227+ spin_lock(&mapping->i_mmap_lock);
67228+ if (tmp->vm_flags & VM_SHARED)
67229+ mapping->i_mmap_writable++;
67230+ tmp->vm_truncate_count = mpnt->vm_truncate_count;
67231+ flush_dcache_mmap_lock(mapping);
67232+ /* insert tmp into the share list, just after mpnt */
67233+ vma_prio_tree_add(tmp, mpnt);
67234+ flush_dcache_mmap_unlock(mapping);
67235+ spin_unlock(&mapping->i_mmap_lock);
67236+ }
67237+
67238+ /*
67239+ * Clear hugetlb-related page reserves for children. This only
67240+ * affects MAP_PRIVATE mappings. Faults generated by the child
67241+ * are not guaranteed to succeed, even if read-only
67242+ */
67243+ if (is_vm_hugetlb_page(tmp))
67244+ reset_vma_resv_huge_pages(tmp);
67245+
67246+ return tmp;
67247+
67248+fail_nomem_anon_vma_fork:
67249+ mpol_put(pol);
67250+fail_nomem_policy:
67251+ kmem_cache_free(vm_area_cachep, tmp);
67252+fail_nomem:
67253+ vm_unacct_memory(charge);
67254+ return NULL;
67255+}
67256+
67257 static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
67258 {
67259 struct vm_area_struct *mpnt, *tmp, *prev, **pprev;
67260 struct rb_node **rb_link, *rb_parent;
67261 int retval;
67262- unsigned long charge;
67263- struct mempolicy *pol;
67264
67265 down_write(&oldmm->mmap_sem);
67266 flush_cache_dup_mm(oldmm);
67267@@ -327,8 +392,8 @@ static int dup_mmap(struct mm_struct *mm
67268 mm->locked_vm = 0;
67269 mm->mmap = NULL;
67270 mm->mmap_cache = NULL;
67271- mm->free_area_cache = oldmm->mmap_base;
67272- mm->cached_hole_size = ~0UL;
67273+ mm->free_area_cache = oldmm->free_area_cache;
67274+ mm->cached_hole_size = oldmm->cached_hole_size;
67275 mm->map_count = 0;
67276 cpumask_clear(mm_cpumask(mm));
67277 mm->mm_rb = RB_ROOT;
67278@@ -344,8 +409,6 @@ static int dup_mmap(struct mm_struct *mm
67279
67280 prev = NULL;
67281 for (mpnt = oldmm->mmap; mpnt; mpnt = mpnt->vm_next) {
67282- struct file *file;
67283-
67284 if (mpnt->vm_flags & VM_DONTCOPY) {
67285 long pages = vma_pages(mpnt);
67286 mm->total_vm -= pages;
67287@@ -353,56 +416,13 @@ static int dup_mmap(struct mm_struct *mm
67288 -pages);
67289 continue;
67290 }
67291- charge = 0;
67292- if (mpnt->vm_flags & VM_ACCOUNT) {
67293- unsigned int len = (mpnt->vm_end - mpnt->vm_start) >> PAGE_SHIFT;
67294- if (security_vm_enough_memory(len))
67295- goto fail_nomem;
67296- charge = len;
67297- }
67298- tmp = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
67299- if (!tmp)
67300- goto fail_nomem;
67301- *tmp = *mpnt;
67302- INIT_LIST_HEAD(&tmp->anon_vma_chain);
67303- pol = mpol_dup(vma_policy(mpnt));
67304- retval = PTR_ERR(pol);
67305- if (IS_ERR(pol))
67306- goto fail_nomem_policy;
67307- vma_set_policy(tmp, pol);
67308- tmp->vm_mm = mm;
67309- if (anon_vma_fork(tmp, mpnt))
67310- goto fail_nomem_anon_vma_fork;
67311- tmp->vm_flags &= ~VM_LOCKED;
67312- tmp->vm_next = tmp->vm_prev = NULL;
67313- file = tmp->vm_file;
67314- if (file) {
67315- struct inode *inode = file->f_path.dentry->d_inode;
67316- struct address_space *mapping = file->f_mapping;
67317-
67318- get_file(file);
67319- if (tmp->vm_flags & VM_DENYWRITE)
67320- atomic_dec(&inode->i_writecount);
67321- spin_lock(&mapping->i_mmap_lock);
67322- if (tmp->vm_flags & VM_SHARED)
67323- mapping->i_mmap_writable++;
67324- tmp->vm_truncate_count = mpnt->vm_truncate_count;
67325- flush_dcache_mmap_lock(mapping);
67326- /* insert tmp into the share list, just after mpnt */
67327- vma_prio_tree_add(tmp, mpnt);
67328- flush_dcache_mmap_unlock(mapping);
67329- spin_unlock(&mapping->i_mmap_lock);
67330+ tmp = dup_vma(mm, mpnt);
67331+ if (!tmp) {
67332+ retval = -ENOMEM;
67333+ goto out;
67334 }
67335
67336 /*
67337- * Clear hugetlb-related page reserves for children. This only
67338- * affects MAP_PRIVATE mappings. Faults generated by the child
67339- * are not guaranteed to succeed, even if read-only
67340- */
67341- if (is_vm_hugetlb_page(tmp))
67342- reset_vma_resv_huge_pages(tmp);
67343-
67344- /*
67345 * Link in the new vma and copy the page table entries.
67346 */
67347 *pprev = tmp;
67348@@ -423,6 +443,31 @@ static int dup_mmap(struct mm_struct *mm
67349 if (retval)
67350 goto out;
67351 }
67352+
67353+#ifdef CONFIG_PAX_SEGMEXEC
67354+ if (oldmm->pax_flags & MF_PAX_SEGMEXEC) {
67355+ struct vm_area_struct *mpnt_m;
67356+
67357+ for (mpnt = oldmm->mmap, mpnt_m = mm->mmap; mpnt; mpnt = mpnt->vm_next, mpnt_m = mpnt_m->vm_next) {
67358+ BUG_ON(!mpnt_m || mpnt_m->vm_mirror || mpnt->vm_mm != oldmm || mpnt_m->vm_mm != mm);
67359+
67360+ if (!mpnt->vm_mirror)
67361+ continue;
67362+
67363+ if (mpnt->vm_end <= SEGMEXEC_TASK_SIZE) {
67364+ BUG_ON(mpnt->vm_mirror->vm_mirror != mpnt);
67365+ mpnt->vm_mirror = mpnt_m;
67366+ } else {
67367+ BUG_ON(mpnt->vm_mirror->vm_mirror == mpnt || mpnt->vm_mirror->vm_mirror->vm_mm != mm);
67368+ mpnt_m->vm_mirror = mpnt->vm_mirror->vm_mirror;
67369+ mpnt_m->vm_mirror->vm_mirror = mpnt_m;
67370+ mpnt->vm_mirror->vm_mirror = mpnt;
67371+ }
67372+ }
67373+ BUG_ON(mpnt_m);
67374+ }
67375+#endif
67376+
67377 /* a new mm has just been created */
67378 arch_dup_mmap(oldmm, mm);
67379 retval = 0;
67380@@ -431,14 +476,6 @@ out:
67381 flush_tlb_mm(oldmm);
67382 up_write(&oldmm->mmap_sem);
67383 return retval;
67384-fail_nomem_anon_vma_fork:
67385- mpol_put(pol);
67386-fail_nomem_policy:
67387- kmem_cache_free(vm_area_cachep, tmp);
67388-fail_nomem:
67389- retval = -ENOMEM;
67390- vm_unacct_memory(charge);
67391- goto out;
67392 }
67393
67394 static inline int mm_alloc_pgd(struct mm_struct * mm)
67395@@ -785,13 +822,14 @@ static int copy_fs(unsigned long clone_f
67396 spin_unlock(&fs->lock);
67397 return -EAGAIN;
67398 }
67399- fs->users++;
67400+ atomic_inc(&fs->users);
67401 spin_unlock(&fs->lock);
67402 return 0;
67403 }
67404 tsk->fs = copy_fs_struct(fs);
67405 if (!tsk->fs)
67406 return -ENOMEM;
67407+ gr_set_chroot_entries(tsk, &tsk->fs->root);
67408 return 0;
67409 }
67410
67411@@ -1049,10 +1087,13 @@ static struct task_struct *copy_process(
67412 DEBUG_LOCKS_WARN_ON(!p->softirqs_enabled);
67413 #endif
67414 retval = -EAGAIN;
67415+
67416+ gr_learn_resource(p, RLIMIT_NPROC, atomic_read(&p->real_cred->user->processes), 0);
67417+
67418 if (atomic_read(&p->real_cred->user->processes) >=
67419 task_rlimit(p, RLIMIT_NPROC)) {
67420- if (!capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE) &&
67421- p->real_cred->user != INIT_USER)
67422+ if (p->real_cred->user != INIT_USER &&
67423+ !capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE))
67424 goto bad_fork_free;
67425 }
67426
67427@@ -1200,6 +1241,8 @@ static struct task_struct *copy_process(
67428 goto bad_fork_free_pid;
67429 }
67430
67431+ gr_copy_label(p);
67432+
67433 p->set_child_tid = (clone_flags & CLONE_CHILD_SETTID) ? child_tidptr : NULL;
67434 /*
67435 * Clear TID on mm_release()?
67436@@ -1360,6 +1403,8 @@ bad_fork_cleanup_count:
67437 bad_fork_free:
67438 free_task(p);
67439 fork_out:
67440+ gr_log_forkfail(retval);
67441+
67442 return ERR_PTR(retval);
67443 }
67444
67445@@ -1448,6 +1493,8 @@ long do_fork(unsigned long clone_flags,
67446 if (clone_flags & CLONE_PARENT_SETTID)
67447 put_user(nr, parent_tidptr);
67448
67449+ gr_handle_brute_check();
67450+
67451 if (clone_flags & CLONE_VFORK) {
67452 p->vfork_done = &vfork;
67453 init_completion(&vfork);
67454@@ -1549,7 +1596,7 @@ static int unshare_fs(unsigned long unsh
67455 return 0;
67456
67457 /* don't need lock here; in the worst case we'll do useless copy */
67458- if (fs->users == 1)
67459+ if (atomic_read(&fs->users) == 1)
67460 return 0;
67461
67462 *new_fsp = copy_fs_struct(fs);
67463@@ -1636,7 +1683,8 @@ SYSCALL_DEFINE1(unshare, unsigned long,
67464 fs = current->fs;
67465 spin_lock(&fs->lock);
67466 current->fs = new_fs;
67467- if (--fs->users)
67468+ gr_set_chroot_entries(current, &current->fs->root);
67469+ if (atomic_dec_return(&fs->users))
67470 new_fs = NULL;
67471 else
67472 new_fs = fs;
67473diff -urNp linux-2.6.39/kernel/futex.c linux-2.6.39/kernel/futex.c
67474--- linux-2.6.39/kernel/futex.c 2011-05-19 00:06:34.000000000 -0400
67475+++ linux-2.6.39/kernel/futex.c 2011-05-22 22:41:57.000000000 -0400
67476@@ -54,6 +54,7 @@
67477 #include <linux/mount.h>
67478 #include <linux/pagemap.h>
67479 #include <linux/syscalls.h>
67480+#include <linux/ptrace.h>
67481 #include <linux/signal.h>
67482 #include <linux/module.h>
67483 #include <linux/magic.h>
67484@@ -236,6 +237,11 @@ get_futex_key(u32 __user *uaddr, int fsh
67485 struct page *page, *page_head;
67486 int err;
67487
67488+#ifdef CONFIG_PAX_SEGMEXEC
67489+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && address >= SEGMEXEC_TASK_SIZE)
67490+ return -EFAULT;
67491+#endif
67492+
67493 /*
67494 * The futex address must be "naturally" aligned.
67495 */
67496@@ -1833,6 +1839,8 @@ static int futex_wait(u32 __user *uaddr,
67497 struct futex_q q = futex_q_init;
67498 int ret;
67499
67500+ pax_track_stack();
67501+
67502 if (!bitset)
67503 return -EINVAL;
67504 q.bitset = bitset;
67505@@ -2229,6 +2237,8 @@ static int futex_wait_requeue_pi(u32 __u
67506 struct futex_q q = futex_q_init;
67507 int res, ret;
67508
67509+ pax_track_stack();
67510+
67511 if (!bitset)
67512 return -EINVAL;
67513
67514@@ -2401,7 +2411,9 @@ SYSCALL_DEFINE3(get_robust_list, int, pi
67515 {
67516 struct robust_list_head __user *head;
67517 unsigned long ret;
67518+#ifndef CONFIG_GRKERNSEC_PROC_MEMMAP
67519 const struct cred *cred = current_cred(), *pcred;
67520+#endif
67521
67522 if (!futex_cmpxchg_enabled)
67523 return -ENOSYS;
67524@@ -2417,6 +2429,10 @@ SYSCALL_DEFINE3(get_robust_list, int, pi
67525 if (!p)
67526 goto err_unlock;
67527 ret = -EPERM;
67528+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
67529+ if (!ptrace_may_access(p, PTRACE_MODE_READ))
67530+ goto err_unlock;
67531+#else
67532 pcred = __task_cred(p);
67533 /* If victim is in different user_ns, then uids are not
67534 comparable, so we must have CAP_SYS_PTRACE */
67535@@ -2431,6 +2447,7 @@ SYSCALL_DEFINE3(get_robust_list, int, pi
67536 !ns_capable(pcred->user->user_ns, CAP_SYS_PTRACE))
67537 goto err_unlock;
67538 ok:
67539+#endif
67540 head = p->robust_list;
67541 rcu_read_unlock();
67542 }
67543@@ -2682,6 +2699,7 @@ static int __init futex_init(void)
67544 {
67545 u32 curval;
67546 int i;
67547+ mm_segment_t oldfs;
67548
67549 /*
67550 * This will fail and we want it. Some arch implementations do
67551@@ -2693,8 +2711,11 @@ static int __init futex_init(void)
67552 * implementation, the non-functional ones will return
67553 * -ENOSYS.
67554 */
67555+ oldfs = get_fs();
67556+ set_fs(USER_DS);
67557 if (cmpxchg_futex_value_locked(&curval, NULL, 0, 0) == -EFAULT)
67558 futex_cmpxchg_enabled = 1;
67559+ set_fs(oldfs);
67560
67561 for (i = 0; i < ARRAY_SIZE(futex_queues); i++) {
67562 plist_head_init(&futex_queues[i].chain, &futex_queues[i].lock);
67563diff -urNp linux-2.6.39/kernel/futex_compat.c linux-2.6.39/kernel/futex_compat.c
67564--- linux-2.6.39/kernel/futex_compat.c 2011-05-19 00:06:34.000000000 -0400
67565+++ linux-2.6.39/kernel/futex_compat.c 2011-05-22 22:42:09.000000000 -0400
67566@@ -10,6 +10,7 @@
67567 #include <linux/compat.h>
67568 #include <linux/nsproxy.h>
67569 #include <linux/futex.h>
67570+#include <linux/ptrace.h>
67571
67572 #include <asm/uaccess.h>
67573
67574@@ -136,7 +137,10 @@ compat_sys_get_robust_list(int pid, comp
67575 {
67576 struct compat_robust_list_head __user *head;
67577 unsigned long ret;
67578- const struct cred *cred = current_cred(), *pcred;
67579+#ifndef CONFIG_GRKERNSEC_PROC_MEMMAP
67580+ const struct cred *cred = current_cred();
67581+ const struct cred *pcred;
67582+#endif
67583
67584 if (!futex_cmpxchg_enabled)
67585 return -ENOSYS;
67586@@ -152,6 +156,10 @@ compat_sys_get_robust_list(int pid, comp
67587 if (!p)
67588 goto err_unlock;
67589 ret = -EPERM;
67590+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
67591+ if (!ptrace_may_access(p, PTRACE_MODE_READ))
67592+ goto err_unlock;
67593+#else
67594 pcred = __task_cred(p);
67595 /* If victim is in different user_ns, then uids are not
67596 comparable, so we must have CAP_SYS_PTRACE */
67597@@ -166,6 +174,7 @@ compat_sys_get_robust_list(int pid, comp
67598 !ns_capable(pcred->user->user_ns, CAP_SYS_PTRACE))
67599 goto err_unlock;
67600 ok:
67601+#endif
67602 head = p->compat_robust_list;
67603 rcu_read_unlock();
67604 }
67605diff -urNp linux-2.6.39/kernel/gcov/base.c linux-2.6.39/kernel/gcov/base.c
67606--- linux-2.6.39/kernel/gcov/base.c 2011-05-19 00:06:34.000000000 -0400
67607+++ linux-2.6.39/kernel/gcov/base.c 2011-05-22 19:36:33.000000000 -0400
67608@@ -102,11 +102,6 @@ void gcov_enable_events(void)
67609 }
67610
67611 #ifdef CONFIG_MODULES
67612-static inline int within(void *addr, void *start, unsigned long size)
67613-{
67614- return ((addr >= start) && (addr < start + size));
67615-}
67616-
67617 /* Update list and generate events when modules are unloaded. */
67618 static int gcov_module_notifier(struct notifier_block *nb, unsigned long event,
67619 void *data)
67620@@ -121,7 +116,7 @@ static int gcov_module_notifier(struct n
67621 prev = NULL;
67622 /* Remove entries located in module from linked list. */
67623 for (info = gcov_info_head; info; info = info->next) {
67624- if (within(info, mod->module_core, mod->core_size)) {
67625+ if (within_module_core_rw((unsigned long)info, mod)) {
67626 if (prev)
67627 prev->next = info->next;
67628 else
67629diff -urNp linux-2.6.39/kernel/hrtimer.c linux-2.6.39/kernel/hrtimer.c
67630--- linux-2.6.39/kernel/hrtimer.c 2011-05-19 00:06:34.000000000 -0400
67631+++ linux-2.6.39/kernel/hrtimer.c 2011-05-22 19:36:33.000000000 -0400
67632@@ -1383,7 +1383,7 @@ void hrtimer_peek_ahead_timers(void)
67633 local_irq_restore(flags);
67634 }
67635
67636-static void run_hrtimer_softirq(struct softirq_action *h)
67637+static void run_hrtimer_softirq(void)
67638 {
67639 hrtimer_peek_ahead_timers();
67640 }
67641diff -urNp linux-2.6.39/kernel/jump_label.c linux-2.6.39/kernel/jump_label.c
67642--- linux-2.6.39/kernel/jump_label.c 2011-05-19 00:06:34.000000000 -0400
67643+++ linux-2.6.39/kernel/jump_label.c 2011-05-22 19:36:33.000000000 -0400
67644@@ -49,6 +49,17 @@ void jump_label_unlock(void)
67645 mutex_unlock(&jump_label_mutex);
67646 }
67647
67648+static void jump_label_swap(void *a, void *b, int size)
67649+{
67650+ struct jump_entry t;
67651+
67652+ t = *(struct jump_entry *)a;
67653+ pax_open_kernel();
67654+ *(struct jump_entry *)a = *(struct jump_entry *)b;
67655+ *(struct jump_entry *)b = t;
67656+ pax_close_kernel();
67657+}
67658+
67659 static int jump_label_cmp(const void *a, const void *b)
67660 {
67661 const struct jump_entry *jea = a;
67662@@ -70,7 +81,7 @@ sort_jump_label_entries(struct jump_entr
67663
67664 size = (((unsigned long)stop - (unsigned long)start)
67665 / sizeof(struct jump_entry));
67666- sort(start, size, sizeof(struct jump_entry), jump_label_cmp, NULL);
67667+ sort(start, size, sizeof(struct jump_entry), jump_label_cmp, jump_label_swap);
67668 }
67669
67670 static struct jump_label_entry *get_jump_label_entry(jump_label_t key)
67671@@ -407,8 +418,11 @@ static void remove_jump_label_module_ini
67672 count = e_module->nr_entries;
67673 iter = e_module->table;
67674 while (count--) {
67675- if (within_module_init(iter->code, mod))
67676+ if (within_module_init(iter->code, mod)) {
67677+ pax_open_kernel();
67678 iter->key = 0;
67679+ pax_close_kernel();
67680+ }
67681 iter++;
67682 }
67683 }
67684diff -urNp linux-2.6.39/kernel/kallsyms.c linux-2.6.39/kernel/kallsyms.c
67685--- linux-2.6.39/kernel/kallsyms.c 2011-05-19 00:06:34.000000000 -0400
67686+++ linux-2.6.39/kernel/kallsyms.c 2011-05-22 19:41:42.000000000 -0400
67687@@ -11,6 +11,9 @@
67688 * Changed the compression method from stem compression to "table lookup"
67689 * compression (see scripts/kallsyms.c for a more complete description)
67690 */
67691+#ifdef CONFIG_GRKERNSEC_HIDESYM
67692+#define __INCLUDED_BY_HIDESYM 1
67693+#endif
67694 #include <linux/kallsyms.h>
67695 #include <linux/module.h>
67696 #include <linux/init.h>
67697@@ -53,12 +56,33 @@ extern const unsigned long kallsyms_mark
67698
67699 static inline int is_kernel_inittext(unsigned long addr)
67700 {
67701+ if (system_state != SYSTEM_BOOTING)
67702+ return 0;
67703+
67704 if (addr >= (unsigned long)_sinittext
67705 && addr <= (unsigned long)_einittext)
67706 return 1;
67707 return 0;
67708 }
67709
67710+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
67711+#ifdef CONFIG_MODULES
67712+static inline int is_module_text(unsigned long addr)
67713+{
67714+ if ((unsigned long)MODULES_EXEC_VADDR <= addr && addr <= (unsigned long)MODULES_EXEC_END)
67715+ return 1;
67716+
67717+ addr = ktla_ktva(addr);
67718+ return (unsigned long)MODULES_EXEC_VADDR <= addr && addr <= (unsigned long)MODULES_EXEC_END;
67719+}
67720+#else
67721+static inline int is_module_text(unsigned long addr)
67722+{
67723+ return 0;
67724+}
67725+#endif
67726+#endif
67727+
67728 static inline int is_kernel_text(unsigned long addr)
67729 {
67730 if ((addr >= (unsigned long)_stext && addr <= (unsigned long)_etext) ||
67731@@ -69,13 +93,28 @@ static inline int is_kernel_text(unsigne
67732
67733 static inline int is_kernel(unsigned long addr)
67734 {
67735+
67736+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
67737+ if (is_kernel_text(addr) || is_kernel_inittext(addr))
67738+ return 1;
67739+
67740+ if (ktla_ktva((unsigned long)_text) <= addr && addr < (unsigned long)_end)
67741+#else
67742 if (addr >= (unsigned long)_stext && addr <= (unsigned long)_end)
67743+#endif
67744+
67745 return 1;
67746 return in_gate_area_no_mm(addr);
67747 }
67748
67749 static int is_ksym_addr(unsigned long addr)
67750 {
67751+
67752+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
67753+ if (is_module_text(addr))
67754+ return 0;
67755+#endif
67756+
67757 if (all_var)
67758 return is_kernel(addr);
67759
67760@@ -454,7 +493,6 @@ static unsigned long get_ksymbol_core(st
67761
67762 static void reset_iter(struct kallsym_iter *iter, loff_t new_pos)
67763 {
67764- iter->name[0] = '\0';
67765 iter->nameoff = get_symbol_offset(new_pos);
67766 iter->pos = new_pos;
67767 }
67768@@ -502,6 +540,11 @@ static int s_show(struct seq_file *m, vo
67769 {
67770 struct kallsym_iter *iter = m->private;
67771
67772+#ifdef CONFIG_GRKERNSEC_HIDESYM
67773+ if (current_uid())
67774+ return 0;
67775+#endif
67776+
67777 /* Some debugging symbols have no name. Ignore them. */
67778 if (!iter->name[0])
67779 return 0;
67780@@ -540,7 +583,7 @@ static int kallsyms_open(struct inode *i
67781 struct kallsym_iter *iter;
67782 int ret;
67783
67784- iter = kmalloc(sizeof(*iter), GFP_KERNEL);
67785+ iter = kzalloc(sizeof(*iter), GFP_KERNEL);
67786 if (!iter)
67787 return -ENOMEM;
67788 reset_iter(iter, 0);
67789diff -urNp linux-2.6.39/kernel/kmod.c linux-2.6.39/kernel/kmod.c
67790--- linux-2.6.39/kernel/kmod.c 2011-05-19 00:06:34.000000000 -0400
67791+++ linux-2.6.39/kernel/kmod.c 2011-05-22 19:41:42.000000000 -0400
67792@@ -65,13 +65,12 @@ char modprobe_path[KMOD_PATH_LEN] = "/sb
67793 * If module auto-loading support is disabled then this function
67794 * becomes a no-operation.
67795 */
67796-int __request_module(bool wait, const char *fmt, ...)
67797+static int ____request_module(bool wait, char *module_param, const char *fmt, va_list ap)
67798 {
67799- va_list args;
67800 char module_name[MODULE_NAME_LEN];
67801 unsigned int max_modprobes;
67802 int ret;
67803- char *argv[] = { modprobe_path, "-q", "--", module_name, NULL };
67804+ char *argv[] = { modprobe_path, "-q", "--", module_name, module_param, NULL };
67805 static char *envp[] = { "HOME=/",
67806 "TERM=linux",
67807 "PATH=/sbin:/usr/sbin:/bin:/usr/bin",
67808@@ -80,9 +79,7 @@ int __request_module(bool wait, const ch
67809 #define MAX_KMOD_CONCURRENT 50 /* Completely arbitrary value - KAO */
67810 static int kmod_loop_msg;
67811
67812- va_start(args, fmt);
67813- ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, args);
67814- va_end(args);
67815+ ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, ap);
67816 if (ret >= MODULE_NAME_LEN)
67817 return -ENAMETOOLONG;
67818
67819@@ -90,6 +87,20 @@ int __request_module(bool wait, const ch
67820 if (ret)
67821 return ret;
67822
67823+#ifdef CONFIG_GRKERNSEC_MODHARDEN
67824+ if (!current_uid()) {
67825+ /* hack to workaround consolekit/udisks stupidity */
67826+ read_lock(&tasklist_lock);
67827+ if (!strcmp(current->comm, "mount") &&
67828+ current->real_parent && !strncmp(current->real_parent->comm, "udisk", 5)) {
67829+ read_unlock(&tasklist_lock);
67830+ printk(KERN_ALERT "grsec: denied attempt to auto-load fs module %.64s by udisks\n", module_name);
67831+ return -EPERM;
67832+ }
67833+ read_unlock(&tasklist_lock);
67834+ }
67835+#endif
67836+
67837 /* If modprobe needs a service that is in a module, we get a recursive
67838 * loop. Limit the number of running kmod threads to max_threads/2 or
67839 * MAX_KMOD_CONCURRENT, whichever is the smaller. A cleaner method
67840@@ -123,6 +134,47 @@ int __request_module(bool wait, const ch
67841 atomic_dec(&kmod_concurrent);
67842 return ret;
67843 }
67844+
67845+int ___request_module(bool wait, char *module_param, const char *fmt, ...)
67846+{
67847+ va_list args;
67848+ int ret;
67849+
67850+ va_start(args, fmt);
67851+ ret = ____request_module(wait, module_param, fmt, args);
67852+ va_end(args);
67853+
67854+ return ret;
67855+}
67856+
67857+int __request_module(bool wait, const char *fmt, ...)
67858+{
67859+ va_list args;
67860+ int ret;
67861+
67862+#ifdef CONFIG_GRKERNSEC_MODHARDEN
67863+ if (current_uid()) {
67864+ char module_param[MODULE_NAME_LEN];
67865+
67866+ memset(module_param, 0, sizeof(module_param));
67867+
67868+ snprintf(module_param, sizeof(module_param) - 1, "grsec_modharden_normal%u_", current_uid());
67869+
67870+ va_start(args, fmt);
67871+ ret = ____request_module(wait, module_param, fmt, args);
67872+ va_end(args);
67873+
67874+ return ret;
67875+ }
67876+#endif
67877+
67878+ va_start(args, fmt);
67879+ ret = ____request_module(wait, NULL, fmt, args);
67880+ va_end(args);
67881+
67882+ return ret;
67883+}
67884+
67885 EXPORT_SYMBOL(__request_module);
67886 #endif /* CONFIG_MODULES */
67887
67888diff -urNp linux-2.6.39/kernel/kprobes.c linux-2.6.39/kernel/kprobes.c
67889--- linux-2.6.39/kernel/kprobes.c 2011-05-19 00:06:34.000000000 -0400
67890+++ linux-2.6.39/kernel/kprobes.c 2011-05-22 19:36:33.000000000 -0400
67891@@ -185,7 +185,7 @@ static kprobe_opcode_t __kprobes *__get_
67892 * kernel image and loaded module images reside. This is required
67893 * so x86_64 can correctly handle the %rip-relative fixups.
67894 */
67895- kip->insns = module_alloc(PAGE_SIZE);
67896+ kip->insns = module_alloc_exec(PAGE_SIZE);
67897 if (!kip->insns) {
67898 kfree(kip);
67899 return NULL;
67900@@ -225,7 +225,7 @@ static int __kprobes collect_one_slot(st
67901 */
67902 if (!list_is_singular(&kip->list)) {
67903 list_del(&kip->list);
67904- module_free(NULL, kip->insns);
67905+ module_free_exec(NULL, kip->insns);
67906 kfree(kip);
67907 }
67908 return 1;
67909@@ -1936,7 +1936,7 @@ static int __init init_kprobes(void)
67910 {
67911 int i, err = 0;
67912 unsigned long offset = 0, size = 0;
67913- char *modname, namebuf[128];
67914+ char *modname, namebuf[KSYM_NAME_LEN];
67915 const char *symbol_name;
67916 void *addr;
67917 struct kprobe_blackpoint *kb;
67918@@ -2062,7 +2062,7 @@ static int __kprobes show_kprobe_addr(st
67919 const char *sym = NULL;
67920 unsigned int i = *(loff_t *) v;
67921 unsigned long offset = 0;
67922- char *modname, namebuf[128];
67923+ char *modname, namebuf[KSYM_NAME_LEN];
67924
67925 head = &kprobe_table[i];
67926 preempt_disable();
67927diff -urNp linux-2.6.39/kernel/lockdep.c linux-2.6.39/kernel/lockdep.c
67928--- linux-2.6.39/kernel/lockdep.c 2011-05-19 00:06:34.000000000 -0400
67929+++ linux-2.6.39/kernel/lockdep.c 2011-05-22 19:36:33.000000000 -0400
67930@@ -571,6 +571,10 @@ static int static_obj(void *obj)
67931 end = (unsigned long) &_end,
67932 addr = (unsigned long) obj;
67933
67934+#ifdef CONFIG_PAX_KERNEXEC
67935+ start = ktla_ktva(start);
67936+#endif
67937+
67938 /*
67939 * static variable?
67940 */
67941@@ -706,6 +710,7 @@ register_lock_class(struct lockdep_map *
67942 if (!static_obj(lock->key)) {
67943 debug_locks_off();
67944 printk("INFO: trying to register non-static key.\n");
67945+ printk("lock:%pS key:%pS.\n", lock, lock->key);
67946 printk("the code is fine but needs lockdep annotation.\n");
67947 printk("turning off the locking correctness validator.\n");
67948 dump_stack();
67949@@ -2752,7 +2757,7 @@ static int __lock_acquire(struct lockdep
67950 if (!class)
67951 return 0;
67952 }
67953- atomic_inc((atomic_t *)&class->ops);
67954+ atomic_inc_unchecked((atomic_unchecked_t *)&class->ops);
67955 if (very_verbose(class)) {
67956 printk("\nacquire class [%p] %s", class->key, class->name);
67957 if (class->name_version > 1)
67958diff -urNp linux-2.6.39/kernel/lockdep_proc.c linux-2.6.39/kernel/lockdep_proc.c
67959--- linux-2.6.39/kernel/lockdep_proc.c 2011-05-19 00:06:34.000000000 -0400
67960+++ linux-2.6.39/kernel/lockdep_proc.c 2011-05-22 19:36:33.000000000 -0400
67961@@ -39,7 +39,7 @@ static void l_stop(struct seq_file *m, v
67962
67963 static void print_name(struct seq_file *m, struct lock_class *class)
67964 {
67965- char str[128];
67966+ char str[KSYM_NAME_LEN];
67967 const char *name = class->name;
67968
67969 if (!name) {
67970diff -urNp linux-2.6.39/kernel/module.c linux-2.6.39/kernel/module.c
67971--- linux-2.6.39/kernel/module.c 2011-05-19 00:06:34.000000000 -0400
67972+++ linux-2.6.39/kernel/module.c 2011-05-22 19:41:42.000000000 -0400
67973@@ -57,6 +57,7 @@
67974 #include <linux/kmemleak.h>
67975 #include <linux/jump_label.h>
67976 #include <linux/pfn.h>
67977+#include <linux/grsecurity.h>
67978
67979 #define CREATE_TRACE_POINTS
67980 #include <trace/events/module.h>
67981@@ -118,7 +119,8 @@ static BLOCKING_NOTIFIER_HEAD(module_not
67982
67983 /* Bounds of module allocation, for speeding __module_address.
67984 * Protected by module_mutex. */
67985-static unsigned long module_addr_min = -1UL, module_addr_max = 0;
67986+static unsigned long module_addr_min_rw = -1UL, module_addr_max_rw = 0;
67987+static unsigned long module_addr_min_rx = -1UL, module_addr_max_rx = 0;
67988
67989 int register_module_notifier(struct notifier_block * nb)
67990 {
67991@@ -282,7 +284,7 @@ bool each_symbol(bool (*fn)(const struct
67992 return true;
67993
67994 list_for_each_entry_rcu(mod, &modules, list) {
67995- struct symsearch arr[] = {
67996+ struct symsearch modarr[] = {
67997 { mod->syms, mod->syms + mod->num_syms, mod->crcs,
67998 NOT_GPL_ONLY, false },
67999 { mod->gpl_syms, mod->gpl_syms + mod->num_gpl_syms,
68000@@ -304,7 +306,7 @@ bool each_symbol(bool (*fn)(const struct
68001 #endif
68002 };
68003
68004- if (each_symbol_in_section(arr, ARRAY_SIZE(arr), mod, fn, data))
68005+ if (each_symbol_in_section(modarr, ARRAY_SIZE(modarr), mod, fn, data))
68006 return true;
68007 }
68008 return false;
68009@@ -415,7 +417,7 @@ static inline void __percpu *mod_percpu(
68010 static int percpu_modalloc(struct module *mod,
68011 unsigned long size, unsigned long align)
68012 {
68013- if (align > PAGE_SIZE) {
68014+ if (align-1 >= PAGE_SIZE) {
68015 printk(KERN_WARNING "%s: per-cpu alignment %li > %li\n",
68016 mod->name, align, PAGE_SIZE);
68017 align = PAGE_SIZE;
68018@@ -1143,7 +1145,7 @@ resolve_symbol_wait(struct module *mod,
68019 */
68020 #ifdef CONFIG_SYSFS
68021
68022-#ifdef CONFIG_KALLSYMS
68023+#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
68024 static inline bool sect_empty(const Elf_Shdr *sect)
68025 {
68026 return !(sect->sh_flags & SHF_ALLOC) || sect->sh_size == 0;
68027@@ -1612,17 +1614,17 @@ void unset_section_ro_nx(struct module *
68028 {
68029 unsigned long total_pages;
68030
68031- if (mod->module_core == module_region) {
68032+ if (mod->module_core_rx == module_region) {
68033 /* Set core as NX+RW */
68034- total_pages = MOD_NUMBER_OF_PAGES(mod->module_core, mod->core_size);
68035- set_memory_nx((unsigned long)mod->module_core, total_pages);
68036- set_memory_rw((unsigned long)mod->module_core, total_pages);
68037+ total_pages = MOD_NUMBER_OF_PAGES(mod->module_core_rx, mod->core_size_rx);
68038+ set_memory_nx((unsigned long)mod->module_core_rx, total_pages);
68039+ set_memory_rw((unsigned long)mod->module_core_rx, total_pages);
68040
68041- } else if (mod->module_init == module_region) {
68042+ } else if (mod->module_init_rx == module_region) {
68043 /* Set init as NX+RW */
68044- total_pages = MOD_NUMBER_OF_PAGES(mod->module_init, mod->init_size);
68045- set_memory_nx((unsigned long)mod->module_init, total_pages);
68046- set_memory_rw((unsigned long)mod->module_init, total_pages);
68047+ total_pages = MOD_NUMBER_OF_PAGES(mod->module_init_rx, mod->init_size_rx);
68048+ set_memory_nx((unsigned long)mod->module_init_rx, total_pages);
68049+ set_memory_rw((unsigned long)mod->module_init_rx, total_pages);
68050 }
68051 }
68052
68053@@ -1633,14 +1635,14 @@ void set_all_modules_text_rw()
68054
68055 mutex_lock(&module_mutex);
68056 list_for_each_entry_rcu(mod, &modules, list) {
68057- if ((mod->module_core) && (mod->core_text_size)) {
68058- set_page_attributes(mod->module_core,
68059- mod->module_core + mod->core_text_size,
68060+ if ((mod->module_core_rx) && (mod->core_size_rx)) {
68061+ set_page_attributes(mod->module_core_rx,
68062+ mod->module_core_rx + mod->core_size_rx,
68063 set_memory_rw);
68064 }
68065- if ((mod->module_init) && (mod->init_text_size)) {
68066- set_page_attributes(mod->module_init,
68067- mod->module_init + mod->init_text_size,
68068+ if ((mod->module_init_rx) && (mod->init_size_rx)) {
68069+ set_page_attributes(mod->module_init_rx,
68070+ mod->module_init_rx + mod->init_size_rx,
68071 set_memory_rw);
68072 }
68073 }
68074@@ -1654,14 +1656,14 @@ void set_all_modules_text_ro()
68075
68076 mutex_lock(&module_mutex);
68077 list_for_each_entry_rcu(mod, &modules, list) {
68078- if ((mod->module_core) && (mod->core_text_size)) {
68079- set_page_attributes(mod->module_core,
68080- mod->module_core + mod->core_text_size,
68081+ if ((mod->module_core_rx) && (mod->core_size_rx)) {
68082+ set_page_attributes(mod->module_core_rx,
68083+ mod->module_core_rx + mod->core_size_rx,
68084 set_memory_ro);
68085 }
68086- if ((mod->module_init) && (mod->init_text_size)) {
68087- set_page_attributes(mod->module_init,
68088- mod->module_init + mod->init_text_size,
68089+ if ((mod->module_init_rx) && (mod->init_size_rx)) {
68090+ set_page_attributes(mod->module_init_rx,
68091+ mod->module_init_rx + mod->init_size_rx,
68092 set_memory_ro);
68093 }
68094 }
68095@@ -1696,17 +1698,20 @@ static void free_module(struct module *m
68096 destroy_params(mod->kp, mod->num_kp);
68097
68098 /* This may be NULL, but that's OK */
68099- unset_section_ro_nx(mod, mod->module_init);
68100- module_free(mod, mod->module_init);
68101+ unset_section_ro_nx(mod, mod->module_init_rx);
68102+ module_free(mod, mod->module_init_rw);
68103+ module_free_exec(mod, mod->module_init_rx);
68104 kfree(mod->args);
68105 percpu_modfree(mod);
68106
68107 /* Free lock-classes: */
68108- lockdep_free_key_range(mod->module_core, mod->core_size);
68109+ lockdep_free_key_range(mod->module_core_rx, mod->core_size_rx);
68110+ lockdep_free_key_range(mod->module_core_rw, mod->core_size_rw);
68111
68112 /* Finally, free the core (containing the module structure) */
68113- unset_section_ro_nx(mod, mod->module_core);
68114- module_free(mod, mod->module_core);
68115+ unset_section_ro_nx(mod, mod->module_core_rx);
68116+ module_free_exec(mod, mod->module_core_rx);
68117+ module_free(mod, mod->module_core_rw);
68118
68119 #ifdef CONFIG_MPU
68120 update_protections(current->mm);
68121@@ -1775,10 +1780,31 @@ static int simplify_symbols(struct modul
68122 unsigned int i;
68123 int ret = 0;
68124 const struct kernel_symbol *ksym;
68125+#ifdef CONFIG_GRKERNSEC_MODHARDEN
68126+ int is_fs_load = 0;
68127+ int register_filesystem_found = 0;
68128+ char *p;
68129+
68130+ p = strstr(mod->args, "grsec_modharden_fs");
68131+ if (p) {
68132+ char *endptr = p + strlen("grsec_modharden_fs");
68133+ /* copy \0 as well */
68134+ memmove(p, endptr, strlen(mod->args) - (unsigned int)(endptr - mod->args) + 1);
68135+ is_fs_load = 1;
68136+ }
68137+#endif
68138
68139 for (i = 1; i < symsec->sh_size / sizeof(Elf_Sym); i++) {
68140 const char *name = info->strtab + sym[i].st_name;
68141
68142+#ifdef CONFIG_GRKERNSEC_MODHARDEN
68143+ /* it's a real shame this will never get ripped and copied
68144+ upstream! ;(
68145+ */
68146+ if (is_fs_load && !strcmp(name, "register_filesystem"))
68147+ register_filesystem_found = 1;
68148+#endif
68149+
68150 switch (sym[i].st_shndx) {
68151 case SHN_COMMON:
68152 /* We compiled with -fno-common. These are not
68153@@ -1799,7 +1825,9 @@ static int simplify_symbols(struct modul
68154 ksym = resolve_symbol_wait(mod, info, name);
68155 /* Ok if resolved. */
68156 if (ksym && !IS_ERR(ksym)) {
68157+ pax_open_kernel();
68158 sym[i].st_value = ksym->value;
68159+ pax_close_kernel();
68160 break;
68161 }
68162
68163@@ -1818,11 +1846,20 @@ static int simplify_symbols(struct modul
68164 secbase = (unsigned long)mod_percpu(mod);
68165 else
68166 secbase = info->sechdrs[sym[i].st_shndx].sh_addr;
68167+ pax_open_kernel();
68168 sym[i].st_value += secbase;
68169+ pax_close_kernel();
68170 break;
68171 }
68172 }
68173
68174+#ifdef CONFIG_GRKERNSEC_MODHARDEN
68175+ if (is_fs_load && !register_filesystem_found) {
68176+ printk(KERN_ALERT "grsec: Denied attempt to load non-fs module %.64s through mount\n", mod->name);
68177+ ret = -EPERM;
68178+ }
68179+#endif
68180+
68181 return ret;
68182 }
68183
68184@@ -1906,22 +1943,12 @@ static void layout_sections(struct modul
68185 || s->sh_entsize != ~0UL
68186 || strstarts(sname, ".init"))
68187 continue;
68188- s->sh_entsize = get_offset(mod, &mod->core_size, s, i);
68189+ if ((s->sh_flags & SHF_WRITE) || !(s->sh_flags & SHF_ALLOC))
68190+ s->sh_entsize = get_offset(mod, &mod->core_size_rw, s, i);
68191+ else
68192+ s->sh_entsize = get_offset(mod, &mod->core_size_rx, s, i);
68193 DEBUGP("\t%s\n", name);
68194 }
68195- switch (m) {
68196- case 0: /* executable */
68197- mod->core_size = debug_align(mod->core_size);
68198- mod->core_text_size = mod->core_size;
68199- break;
68200- case 1: /* RO: text and ro-data */
68201- mod->core_size = debug_align(mod->core_size);
68202- mod->core_ro_size = mod->core_size;
68203- break;
68204- case 3: /* whole core */
68205- mod->core_size = debug_align(mod->core_size);
68206- break;
68207- }
68208 }
68209
68210 DEBUGP("Init section allocation order:\n");
68211@@ -1935,23 +1962,13 @@ static void layout_sections(struct modul
68212 || s->sh_entsize != ~0UL
68213 || !strstarts(sname, ".init"))
68214 continue;
68215- s->sh_entsize = (get_offset(mod, &mod->init_size, s, i)
68216- | INIT_OFFSET_MASK);
68217+ if ((s->sh_flags & SHF_WRITE) || !(s->sh_flags & SHF_ALLOC))
68218+ s->sh_entsize = get_offset(mod, &mod->init_size_rw, s, i);
68219+ else
68220+ s->sh_entsize = get_offset(mod, &mod->init_size_rx, s, i);
68221+ s->sh_entsize |= INIT_OFFSET_MASK;
68222 DEBUGP("\t%s\n", sname);
68223 }
68224- switch (m) {
68225- case 0: /* executable */
68226- mod->init_size = debug_align(mod->init_size);
68227- mod->init_text_size = mod->init_size;
68228- break;
68229- case 1: /* RO: text and ro-data */
68230- mod->init_size = debug_align(mod->init_size);
68231- mod->init_ro_size = mod->init_size;
68232- break;
68233- case 3: /* whole init */
68234- mod->init_size = debug_align(mod->init_size);
68235- break;
68236- }
68237 }
68238 }
68239
68240@@ -2119,7 +2136,7 @@ static void layout_symtab(struct module
68241
68242 /* Put symbol section at end of init part of module. */
68243 symsect->sh_flags |= SHF_ALLOC;
68244- symsect->sh_entsize = get_offset(mod, &mod->init_size, symsect,
68245+ symsect->sh_entsize = get_offset(mod, &mod->init_size_rx, symsect,
68246 info->index.sym) | INIT_OFFSET_MASK;
68247 DEBUGP("\t%s\n", info->secstrings + symsect->sh_name);
68248
68249@@ -2136,19 +2153,19 @@ static void layout_symtab(struct module
68250 }
68251
68252 /* Append room for core symbols at end of core part. */
68253- info->symoffs = ALIGN(mod->core_size, symsect->sh_addralign ?: 1);
68254- mod->core_size = info->symoffs + ndst * sizeof(Elf_Sym);
68255+ info->symoffs = ALIGN(mod->core_size_rx, symsect->sh_addralign ?: 1);
68256+ mod->core_size_rx = info->symoffs + ndst * sizeof(Elf_Sym);
68257
68258 /* Put string table section at end of init part of module. */
68259 strsect->sh_flags |= SHF_ALLOC;
68260- strsect->sh_entsize = get_offset(mod, &mod->init_size, strsect,
68261+ strsect->sh_entsize = get_offset(mod, &mod->init_size_rx, strsect,
68262 info->index.str) | INIT_OFFSET_MASK;
68263 DEBUGP("\t%s\n", info->secstrings + strsect->sh_name);
68264
68265 /* Append room for core symbols' strings at end of core part. */
68266- info->stroffs = mod->core_size;
68267+ info->stroffs = mod->core_size_rx;
68268 __set_bit(0, info->strmap);
68269- mod->core_size += bitmap_weight(info->strmap, strsect->sh_size);
68270+ mod->core_size_rx += bitmap_weight(info->strmap, strsect->sh_size);
68271 }
68272
68273 static void add_kallsyms(struct module *mod, const struct load_info *info)
68274@@ -2164,11 +2181,13 @@ static void add_kallsyms(struct module *
68275 /* Make sure we get permanent strtab: don't use info->strtab. */
68276 mod->strtab = (void *)info->sechdrs[info->index.str].sh_addr;
68277
68278+ pax_open_kernel();
68279+
68280 /* Set types up while we still have access to sections. */
68281 for (i = 0; i < mod->num_symtab; i++)
68282 mod->symtab[i].st_info = elf_type(&mod->symtab[i], info);
68283
68284- mod->core_symtab = dst = mod->module_core + info->symoffs;
68285+ mod->core_symtab = dst = mod->module_core_rx + info->symoffs;
68286 src = mod->symtab;
68287 *dst = *src;
68288 for (ndst = i = 1; i < mod->num_symtab; ++i, ++src) {
68289@@ -2181,10 +2200,12 @@ static void add_kallsyms(struct module *
68290 }
68291 mod->core_num_syms = ndst;
68292
68293- mod->core_strtab = s = mod->module_core + info->stroffs;
68294+ mod->core_strtab = s = mod->module_core_rx + info->stroffs;
68295 for (*s = 0, i = 1; i < info->sechdrs[info->index.str].sh_size; ++i)
68296 if (test_bit(i, info->strmap))
68297 *++s = mod->strtab[i];
68298+
68299+ pax_close_kernel();
68300 }
68301 #else
68302 static inline void layout_symtab(struct module *mod, struct load_info *info)
68303@@ -2213,17 +2234,33 @@ static void dynamic_debug_remove(struct
68304 ddebug_remove_module(debug->modname);
68305 }
68306
68307-static void *module_alloc_update_bounds(unsigned long size)
68308+static void *module_alloc_update_bounds_rw(unsigned long size)
68309 {
68310 void *ret = module_alloc(size);
68311
68312 if (ret) {
68313 mutex_lock(&module_mutex);
68314 /* Update module bounds. */
68315- if ((unsigned long)ret < module_addr_min)
68316- module_addr_min = (unsigned long)ret;
68317- if ((unsigned long)ret + size > module_addr_max)
68318- module_addr_max = (unsigned long)ret + size;
68319+ if ((unsigned long)ret < module_addr_min_rw)
68320+ module_addr_min_rw = (unsigned long)ret;
68321+ if ((unsigned long)ret + size > module_addr_max_rw)
68322+ module_addr_max_rw = (unsigned long)ret + size;
68323+ mutex_unlock(&module_mutex);
68324+ }
68325+ return ret;
68326+}
68327+
68328+static void *module_alloc_update_bounds_rx(unsigned long size)
68329+{
68330+ void *ret = module_alloc_exec(size);
68331+
68332+ if (ret) {
68333+ mutex_lock(&module_mutex);
68334+ /* Update module bounds. */
68335+ if ((unsigned long)ret < module_addr_min_rx)
68336+ module_addr_min_rx = (unsigned long)ret;
68337+ if ((unsigned long)ret + size > module_addr_max_rx)
68338+ module_addr_max_rx = (unsigned long)ret + size;
68339 mutex_unlock(&module_mutex);
68340 }
68341 return ret;
68342@@ -2516,7 +2553,7 @@ static int move_module(struct module *mo
68343 void *ptr;
68344
68345 /* Do the allocs. */
68346- ptr = module_alloc_update_bounds(mod->core_size);
68347+ ptr = module_alloc_update_bounds_rw(mod->core_size_rw);
68348 /*
68349 * The pointer to this block is stored in the module structure
68350 * which is inside the block. Just mark it as not being a
68351@@ -2526,23 +2563,50 @@ static int move_module(struct module *mo
68352 if (!ptr)
68353 return -ENOMEM;
68354
68355- memset(ptr, 0, mod->core_size);
68356- mod->module_core = ptr;
68357+ memset(ptr, 0, mod->core_size_rw);
68358+ mod->module_core_rw = ptr;
68359
68360- ptr = module_alloc_update_bounds(mod->init_size);
68361+ ptr = module_alloc_update_bounds_rw(mod->init_size_rw);
68362 /*
68363 * The pointer to this block is stored in the module structure
68364 * which is inside the block. This block doesn't need to be
68365 * scanned as it contains data and code that will be freed
68366 * after the module is initialized.
68367 */
68368- kmemleak_ignore(ptr);
68369- if (!ptr && mod->init_size) {
68370- module_free(mod, mod->module_core);
68371+ kmemleak_not_leak(ptr);
68372+ if (!ptr && mod->init_size_rw) {
68373+ module_free(mod, mod->module_core_rw);
68374 return -ENOMEM;
68375 }
68376- memset(ptr, 0, mod->init_size);
68377- mod->module_init = ptr;
68378+ memset(ptr, 0, mod->init_size_rw);
68379+ mod->module_init_rw = ptr;
68380+
68381+ ptr = module_alloc_update_bounds_rx(mod->core_size_rx);
68382+ kmemleak_not_leak(ptr);
68383+ if (!ptr) {
68384+ module_free(mod, mod->module_init_rw);
68385+ module_free(mod, mod->module_core_rw);
68386+ return -ENOMEM;
68387+ }
68388+
68389+ pax_open_kernel();
68390+ memset(ptr, 0, mod->core_size_rx);
68391+ pax_close_kernel();
68392+ mod->module_core_rx = ptr;
68393+
68394+ ptr = module_alloc_update_bounds_rx(mod->init_size_rx);
68395+ kmemleak_not_leak(ptr);
68396+ if (!ptr && mod->init_size_rx) {
68397+ module_free_exec(mod, mod->module_core_rx);
68398+ module_free(mod, mod->module_init_rw);
68399+ module_free(mod, mod->module_core_rw);
68400+ return -ENOMEM;
68401+ }
68402+
68403+ pax_open_kernel();
68404+ memset(ptr, 0, mod->init_size_rx);
68405+ pax_close_kernel();
68406+ mod->module_init_rx = ptr;
68407
68408 /* Transfer each section which specifies SHF_ALLOC */
68409 DEBUGP("final section addresses:\n");
68410@@ -2553,16 +2617,45 @@ static int move_module(struct module *mo
68411 if (!(shdr->sh_flags & SHF_ALLOC))
68412 continue;
68413
68414- if (shdr->sh_entsize & INIT_OFFSET_MASK)
68415- dest = mod->module_init
68416- + (shdr->sh_entsize & ~INIT_OFFSET_MASK);
68417- else
68418- dest = mod->module_core + shdr->sh_entsize;
68419+ if (shdr->sh_entsize & INIT_OFFSET_MASK) {
68420+ if ((shdr->sh_flags & SHF_WRITE) || !(shdr->sh_flags & SHF_ALLOC))
68421+ dest = mod->module_init_rw
68422+ + (shdr->sh_entsize & ~INIT_OFFSET_MASK);
68423+ else
68424+ dest = mod->module_init_rx
68425+ + (shdr->sh_entsize & ~INIT_OFFSET_MASK);
68426+ } else {
68427+ if ((shdr->sh_flags & SHF_WRITE) || !(shdr->sh_flags & SHF_ALLOC))
68428+ dest = mod->module_core_rw + shdr->sh_entsize;
68429+ else
68430+ dest = mod->module_core_rx + shdr->sh_entsize;
68431+ }
68432+
68433+ if (shdr->sh_type != SHT_NOBITS) {
68434+
68435+#ifdef CONFIG_PAX_KERNEXEC
68436+#ifdef CONFIG_X86_64
68437+ if ((shdr->sh_flags & SHF_WRITE) && (shdr->sh_flags & SHF_EXECINSTR))
68438+ set_memory_x((unsigned long)dest, (shdr->sh_size + PAGE_SIZE) >> PAGE_SHIFT);
68439+#endif
68440+ if (!(shdr->sh_flags & SHF_WRITE) && (shdr->sh_flags & SHF_ALLOC)) {
68441+ pax_open_kernel();
68442+ memcpy(dest, (void *)shdr->sh_addr, shdr->sh_size);
68443+ pax_close_kernel();
68444+ } else
68445+#endif
68446
68447- if (shdr->sh_type != SHT_NOBITS)
68448 memcpy(dest, (void *)shdr->sh_addr, shdr->sh_size);
68449+ }
68450 /* Update sh_addr to point to copy in image. */
68451- shdr->sh_addr = (unsigned long)dest;
68452+
68453+#ifdef CONFIG_PAX_KERNEXEC
68454+ if (shdr->sh_flags & SHF_EXECINSTR)
68455+ shdr->sh_addr = ktva_ktla((unsigned long)dest);
68456+ else
68457+#endif
68458+
68459+ shdr->sh_addr = (unsigned long)dest;
68460 DEBUGP("\t0x%lx %s\n",
68461 shdr->sh_addr, info->secstrings + shdr->sh_name);
68462 }
68463@@ -2613,12 +2706,12 @@ static void flush_module_icache(const st
68464 * Do it before processing of module parameters, so the module
68465 * can provide parameter accessor functions of its own.
68466 */
68467- if (mod->module_init)
68468- flush_icache_range((unsigned long)mod->module_init,
68469- (unsigned long)mod->module_init
68470- + mod->init_size);
68471- flush_icache_range((unsigned long)mod->module_core,
68472- (unsigned long)mod->module_core + mod->core_size);
68473+ if (mod->module_init_rx)
68474+ flush_icache_range((unsigned long)mod->module_init_rx,
68475+ (unsigned long)mod->module_init_rx
68476+ + mod->init_size_rx);
68477+ flush_icache_range((unsigned long)mod->module_core_rx,
68478+ (unsigned long)mod->module_core_rx + mod->core_size_rx);
68479
68480 set_fs(old_fs);
68481 }
68482@@ -2690,8 +2783,10 @@ static void module_deallocate(struct mod
68483 {
68484 kfree(info->strmap);
68485 percpu_modfree(mod);
68486- module_free(mod, mod->module_init);
68487- module_free(mod, mod->module_core);
68488+ module_free_exec(mod, mod->module_init_rx);
68489+ module_free_exec(mod, mod->module_core_rx);
68490+ module_free(mod, mod->module_init_rw);
68491+ module_free(mod, mod->module_core_rw);
68492 }
68493
68494 static int post_relocation(struct module *mod, const struct load_info *info)
68495@@ -2748,9 +2843,38 @@ static struct module *load_module(void _
68496 if (err)
68497 goto free_unload;
68498
68499+ /* Now copy in args */
68500+ mod->args = strndup_user(uargs, ~0UL >> 1);
68501+ if (IS_ERR(mod->args)) {
68502+ err = PTR_ERR(mod->args);
68503+ goto free_unload;
68504+ }
68505+
68506 /* Set up MODINFO_ATTR fields */
68507 setup_modinfo(mod, &info);
68508
68509+#ifdef CONFIG_GRKERNSEC_MODHARDEN
68510+ {
68511+ char *p, *p2;
68512+
68513+ if (strstr(mod->args, "grsec_modharden_netdev")) {
68514+ printk(KERN_ALERT "grsec: denied auto-loading kernel module for a network device with CAP_SYS_MODULE (deprecated). Use CAP_NET_ADMIN and alias netdev-%.64s instead.", mod->name);
68515+ err = -EPERM;
68516+ goto free_modinfo;
68517+ } else if ((p = strstr(mod->args, "grsec_modharden_normal"))) {
68518+ p += strlen("grsec_modharden_normal");
68519+ p2 = strstr(p, "_");
68520+ if (p2) {
68521+ *p2 = '\0';
68522+ printk(KERN_ALERT "grsec: denied kernel module auto-load of %.64s by uid %.9s\n", mod->name, p);
68523+ *p2 = '_';
68524+ }
68525+ err = -EPERM;
68526+ goto free_modinfo;
68527+ }
68528+ }
68529+#endif
68530+
68531 /* Fix up syms, so that st_value is a pointer to location. */
68532 err = simplify_symbols(mod, &info);
68533 if (err < 0)
68534@@ -2766,13 +2890,6 @@ static struct module *load_module(void _
68535
68536 flush_module_icache(mod);
68537
68538- /* Now copy in args */
68539- mod->args = strndup_user(uargs, ~0UL >> 1);
68540- if (IS_ERR(mod->args)) {
68541- err = PTR_ERR(mod->args);
68542- goto free_arch_cleanup;
68543- }
68544-
68545 /* Mark state as coming so strong_try_module_get() ignores us. */
68546 mod->state = MODULE_STATE_COMING;
68547
68548@@ -2832,11 +2949,10 @@ static struct module *load_module(void _
68549 unlock:
68550 mutex_unlock(&module_mutex);
68551 synchronize_sched();
68552- kfree(mod->args);
68553- free_arch_cleanup:
68554 module_arch_cleanup(mod);
68555 free_modinfo:
68556 free_modinfo(mod);
68557+ kfree(mod->args);
68558 free_unload:
68559 module_unload_free(mod);
68560 free_module:
68561@@ -2877,16 +2993,16 @@ SYSCALL_DEFINE3(init_module, void __user
68562 MODULE_STATE_COMING, mod);
68563
68564 /* Set RO and NX regions for core */
68565- set_section_ro_nx(mod->module_core,
68566- mod->core_text_size,
68567- mod->core_ro_size,
68568- mod->core_size);
68569+ set_section_ro_nx(mod->module_core_rx,
68570+ mod->core_size_rx,
68571+ mod->core_size_rx,
68572+ mod->core_size_rx);
68573
68574 /* Set RO and NX regions for init */
68575- set_section_ro_nx(mod->module_init,
68576- mod->init_text_size,
68577- mod->init_ro_size,
68578- mod->init_size);
68579+ set_section_ro_nx(mod->module_init_rx,
68580+ mod->init_size_rx,
68581+ mod->init_size_rx,
68582+ mod->init_size_rx);
68583
68584 do_mod_ctors(mod);
68585 /* Start the module */
68586@@ -2931,11 +3047,13 @@ SYSCALL_DEFINE3(init_module, void __user
68587 mod->symtab = mod->core_symtab;
68588 mod->strtab = mod->core_strtab;
68589 #endif
68590- unset_section_ro_nx(mod, mod->module_init);
68591- module_free(mod, mod->module_init);
68592- mod->module_init = NULL;
68593- mod->init_size = 0;
68594- mod->init_text_size = 0;
68595+ unset_section_ro_nx(mod, mod->module_init_rx);
68596+ module_free(mod, mod->module_init_rw);
68597+ module_free_exec(mod, mod->module_init_rx);
68598+ mod->module_init_rw = NULL;
68599+ mod->module_init_rx = NULL;
68600+ mod->init_size_rw = 0;
68601+ mod->init_size_rx = 0;
68602 mutex_unlock(&module_mutex);
68603
68604 return 0;
68605@@ -2966,10 +3084,16 @@ static const char *get_ksymbol(struct mo
68606 unsigned long nextval;
68607
68608 /* At worse, next value is at end of module */
68609- if (within_module_init(addr, mod))
68610- nextval = (unsigned long)mod->module_init+mod->init_text_size;
68611+ if (within_module_init_rx(addr, mod))
68612+ nextval = (unsigned long)mod->module_init_rx+mod->init_size_rx;
68613+ else if (within_module_init_rw(addr, mod))
68614+ nextval = (unsigned long)mod->module_init_rw+mod->init_size_rw;
68615+ else if (within_module_core_rx(addr, mod))
68616+ nextval = (unsigned long)mod->module_core_rx+mod->core_size_rx;
68617+ else if (within_module_core_rw(addr, mod))
68618+ nextval = (unsigned long)mod->module_core_rw+mod->core_size_rw;
68619 else
68620- nextval = (unsigned long)mod->module_core+mod->core_text_size;
68621+ return NULL;
68622
68623 /* Scan for closest preceding symbol, and next symbol. (ELF
68624 starts real symbols at 1). */
68625@@ -3215,7 +3339,7 @@ static int m_show(struct seq_file *m, vo
68626 char buf[8];
68627
68628 seq_printf(m, "%s %u",
68629- mod->name, mod->init_size + mod->core_size);
68630+ mod->name, mod->init_size_rx + mod->init_size_rw + mod->core_size_rx + mod->core_size_rw);
68631 print_unload_info(m, mod);
68632
68633 /* Informative for users. */
68634@@ -3224,7 +3348,7 @@ static int m_show(struct seq_file *m, vo
68635 mod->state == MODULE_STATE_COMING ? "Loading":
68636 "Live");
68637 /* Used by oprofile and other similar tools. */
68638- seq_printf(m, " 0x%pK", mod->module_core);
68639+ seq_printf(m, " 0x%pK 0x%pK", mod->module_core_rx, mod->module_core_rw);
68640
68641 /* Taints info */
68642 if (mod->taints)
68643@@ -3260,7 +3384,17 @@ static const struct file_operations proc
68644
68645 static int __init proc_modules_init(void)
68646 {
68647+#ifndef CONFIG_GRKERNSEC_HIDESYM
68648+#ifdef CONFIG_GRKERNSEC_PROC_USER
68649+ proc_create("modules", S_IRUSR, NULL, &proc_modules_operations);
68650+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
68651+ proc_create("modules", S_IRUSR | S_IRGRP, NULL, &proc_modules_operations);
68652+#else
68653 proc_create("modules", 0, NULL, &proc_modules_operations);
68654+#endif
68655+#else
68656+ proc_create("modules", S_IRUSR, NULL, &proc_modules_operations);
68657+#endif
68658 return 0;
68659 }
68660 module_init(proc_modules_init);
68661@@ -3319,12 +3453,12 @@ struct module *__module_address(unsigned
68662 {
68663 struct module *mod;
68664
68665- if (addr < module_addr_min || addr > module_addr_max)
68666+ if ((addr < module_addr_min_rx || addr > module_addr_max_rx) &&
68667+ (addr < module_addr_min_rw || addr > module_addr_max_rw))
68668 return NULL;
68669
68670 list_for_each_entry_rcu(mod, &modules, list)
68671- if (within_module_core(addr, mod)
68672- || within_module_init(addr, mod))
68673+ if (within_module_init(addr, mod) || within_module_core(addr, mod))
68674 return mod;
68675 return NULL;
68676 }
68677@@ -3358,11 +3492,20 @@ bool is_module_text_address(unsigned lon
68678 */
68679 struct module *__module_text_address(unsigned long addr)
68680 {
68681- struct module *mod = __module_address(addr);
68682+ struct module *mod;
68683+
68684+#ifdef CONFIG_X86_32
68685+ addr = ktla_ktva(addr);
68686+#endif
68687+
68688+ if (addr < module_addr_min_rx || addr > module_addr_max_rx)
68689+ return NULL;
68690+
68691+ mod = __module_address(addr);
68692+
68693 if (mod) {
68694 /* Make sure it's within the text section. */
68695- if (!within(addr, mod->module_init, mod->init_text_size)
68696- && !within(addr, mod->module_core, mod->core_text_size))
68697+ if (!within_module_init_rx(addr, mod) && !within_module_core_rx(addr, mod))
68698 mod = NULL;
68699 }
68700 return mod;
68701diff -urNp linux-2.6.39/kernel/mutex.c linux-2.6.39/kernel/mutex.c
68702--- linux-2.6.39/kernel/mutex.c 2011-05-19 00:06:34.000000000 -0400
68703+++ linux-2.6.39/kernel/mutex.c 2011-05-22 19:36:33.000000000 -0400
68704@@ -160,7 +160,7 @@ __mutex_lock_common(struct mutex *lock,
68705 */
68706
68707 for (;;) {
68708- struct thread_info *owner;
68709+ struct task_struct *owner;
68710
68711 /*
68712 * If we own the BKL, then don't spin. The owner of
68713@@ -205,7 +205,7 @@ __mutex_lock_common(struct mutex *lock,
68714 spin_lock_mutex(&lock->wait_lock, flags);
68715
68716 debug_mutex_lock_common(lock, &waiter);
68717- debug_mutex_add_waiter(lock, &waiter, task_thread_info(task));
68718+ debug_mutex_add_waiter(lock, &waiter, task);
68719
68720 /* add waiting tasks to the end of the waitqueue (FIFO): */
68721 list_add_tail(&waiter.list, &lock->wait_list);
68722@@ -234,8 +234,7 @@ __mutex_lock_common(struct mutex *lock,
68723 * TASK_UNINTERRUPTIBLE case.)
68724 */
68725 if (unlikely(signal_pending_state(state, task))) {
68726- mutex_remove_waiter(lock, &waiter,
68727- task_thread_info(task));
68728+ mutex_remove_waiter(lock, &waiter, task);
68729 mutex_release(&lock->dep_map, 1, ip);
68730 spin_unlock_mutex(&lock->wait_lock, flags);
68731
68732@@ -256,7 +255,7 @@ __mutex_lock_common(struct mutex *lock,
68733 done:
68734 lock_acquired(&lock->dep_map, ip);
68735 /* got the lock - rejoice! */
68736- mutex_remove_waiter(lock, &waiter, current_thread_info());
68737+ mutex_remove_waiter(lock, &waiter, task);
68738 mutex_set_owner(lock);
68739
68740 /* set it to 0 if there are no waiters left: */
68741diff -urNp linux-2.6.39/kernel/mutex-debug.c linux-2.6.39/kernel/mutex-debug.c
68742--- linux-2.6.39/kernel/mutex-debug.c 2011-05-19 00:06:34.000000000 -0400
68743+++ linux-2.6.39/kernel/mutex-debug.c 2011-05-22 19:36:33.000000000 -0400
68744@@ -49,21 +49,21 @@ void debug_mutex_free_waiter(struct mute
68745 }
68746
68747 void debug_mutex_add_waiter(struct mutex *lock, struct mutex_waiter *waiter,
68748- struct thread_info *ti)
68749+ struct task_struct *task)
68750 {
68751 SMP_DEBUG_LOCKS_WARN_ON(!spin_is_locked(&lock->wait_lock));
68752
68753 /* Mark the current thread as blocked on the lock: */
68754- ti->task->blocked_on = waiter;
68755+ task->blocked_on = waiter;
68756 }
68757
68758 void mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter,
68759- struct thread_info *ti)
68760+ struct task_struct *task)
68761 {
68762 DEBUG_LOCKS_WARN_ON(list_empty(&waiter->list));
68763- DEBUG_LOCKS_WARN_ON(waiter->task != ti->task);
68764- DEBUG_LOCKS_WARN_ON(ti->task->blocked_on != waiter);
68765- ti->task->blocked_on = NULL;
68766+ DEBUG_LOCKS_WARN_ON(waiter->task != task);
68767+ DEBUG_LOCKS_WARN_ON(task->blocked_on != waiter);
68768+ task->blocked_on = NULL;
68769
68770 list_del_init(&waiter->list);
68771 waiter->task = NULL;
68772@@ -75,7 +75,7 @@ void debug_mutex_unlock(struct mutex *lo
68773 return;
68774
68775 DEBUG_LOCKS_WARN_ON(lock->magic != lock);
68776- DEBUG_LOCKS_WARN_ON(lock->owner != current_thread_info());
68777+ DEBUG_LOCKS_WARN_ON(lock->owner != current);
68778 DEBUG_LOCKS_WARN_ON(!lock->wait_list.prev && !lock->wait_list.next);
68779 mutex_clear_owner(lock);
68780 }
68781diff -urNp linux-2.6.39/kernel/mutex-debug.h linux-2.6.39/kernel/mutex-debug.h
68782--- linux-2.6.39/kernel/mutex-debug.h 2011-05-19 00:06:34.000000000 -0400
68783+++ linux-2.6.39/kernel/mutex-debug.h 2011-05-22 19:36:33.000000000 -0400
68784@@ -20,16 +20,16 @@ extern void debug_mutex_wake_waiter(stru
68785 extern void debug_mutex_free_waiter(struct mutex_waiter *waiter);
68786 extern void debug_mutex_add_waiter(struct mutex *lock,
68787 struct mutex_waiter *waiter,
68788- struct thread_info *ti);
68789+ struct task_struct *task);
68790 extern void mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter,
68791- struct thread_info *ti);
68792+ struct task_struct *task);
68793 extern void debug_mutex_unlock(struct mutex *lock);
68794 extern void debug_mutex_init(struct mutex *lock, const char *name,
68795 struct lock_class_key *key);
68796
68797 static inline void mutex_set_owner(struct mutex *lock)
68798 {
68799- lock->owner = current_thread_info();
68800+ lock->owner = current;
68801 }
68802
68803 static inline void mutex_clear_owner(struct mutex *lock)
68804diff -urNp linux-2.6.39/kernel/mutex.h linux-2.6.39/kernel/mutex.h
68805--- linux-2.6.39/kernel/mutex.h 2011-05-19 00:06:34.000000000 -0400
68806+++ linux-2.6.39/kernel/mutex.h 2011-05-22 19:36:33.000000000 -0400
68807@@ -19,7 +19,7 @@
68808 #ifdef CONFIG_SMP
68809 static inline void mutex_set_owner(struct mutex *lock)
68810 {
68811- lock->owner = current_thread_info();
68812+ lock->owner = current;
68813 }
68814
68815 static inline void mutex_clear_owner(struct mutex *lock)
68816diff -urNp linux-2.6.39/kernel/padata.c linux-2.6.39/kernel/padata.c
68817--- linux-2.6.39/kernel/padata.c 2011-05-19 00:06:34.000000000 -0400
68818+++ linux-2.6.39/kernel/padata.c 2011-05-22 19:36:33.000000000 -0400
68819@@ -132,10 +132,10 @@ int padata_do_parallel(struct padata_ins
68820 padata->pd = pd;
68821 padata->cb_cpu = cb_cpu;
68822
68823- if (unlikely(atomic_read(&pd->seq_nr) == pd->max_seq_nr))
68824- atomic_set(&pd->seq_nr, -1);
68825+ if (unlikely(atomic_read_unchecked(&pd->seq_nr) == pd->max_seq_nr))
68826+ atomic_set_unchecked(&pd->seq_nr, -1);
68827
68828- padata->seq_nr = atomic_inc_return(&pd->seq_nr);
68829+ padata->seq_nr = atomic_inc_return_unchecked(&pd->seq_nr);
68830
68831 target_cpu = padata_cpu_hash(padata);
68832 queue = per_cpu_ptr(pd->pqueue, target_cpu);
68833@@ -444,7 +444,7 @@ static struct parallel_data *padata_allo
68834 padata_init_pqueues(pd);
68835 padata_init_squeues(pd);
68836 setup_timer(&pd->timer, padata_reorder_timer, (unsigned long)pd);
68837- atomic_set(&pd->seq_nr, -1);
68838+ atomic_set_unchecked(&pd->seq_nr, -1);
68839 atomic_set(&pd->reorder_objects, 0);
68840 atomic_set(&pd->refcnt, 0);
68841 pd->pinst = pinst;
68842diff -urNp linux-2.6.39/kernel/panic.c linux-2.6.39/kernel/panic.c
68843--- linux-2.6.39/kernel/panic.c 2011-05-19 00:06:34.000000000 -0400
68844+++ linux-2.6.39/kernel/panic.c 2011-05-22 19:41:42.000000000 -0400
68845@@ -369,7 +369,7 @@ static void warn_slowpath_common(const c
68846 const char *board;
68847
68848 printk(KERN_WARNING "------------[ cut here ]------------\n");
68849- printk(KERN_WARNING "WARNING: at %s:%d %pS()\n", file, line, caller);
68850+ printk(KERN_WARNING "WARNING: at %s:%d %pA()\n", file, line, caller);
68851 board = dmi_get_system_info(DMI_PRODUCT_NAME);
68852 if (board)
68853 printk(KERN_WARNING "Hardware name: %s\n", board);
68854@@ -424,7 +424,8 @@ EXPORT_SYMBOL(warn_slowpath_null);
68855 */
68856 void __stack_chk_fail(void)
68857 {
68858- panic("stack-protector: Kernel stack is corrupted in: %p\n",
68859+ dump_stack();
68860+ panic("stack-protector: Kernel stack is corrupted in: %pA\n",
68861 __builtin_return_address(0));
68862 }
68863 EXPORT_SYMBOL(__stack_chk_fail);
68864diff -urNp linux-2.6.39/kernel/params.c linux-2.6.39/kernel/params.c
68865--- linux-2.6.39/kernel/params.c 2011-05-19 00:06:34.000000000 -0400
68866+++ linux-2.6.39/kernel/params.c 2011-05-22 19:36:33.000000000 -0400
68867@@ -234,7 +234,7 @@ int parse_args(const char *name,
68868 { \
68869 return sprintf(buffer, format, *((type *)kp->arg)); \
68870 } \
68871- struct kernel_param_ops param_ops_##name = { \
68872+ const struct kernel_param_ops param_ops_##name = { \
68873 .set = param_set_##name, \
68874 .get = param_get_##name, \
68875 }; \
68876@@ -286,7 +286,7 @@ static void param_free_charp(void *arg)
68877 maybe_kfree_parameter(*((char **)arg));
68878 }
68879
68880-struct kernel_param_ops param_ops_charp = {
68881+const struct kernel_param_ops param_ops_charp = {
68882 .set = param_set_charp,
68883 .get = param_get_charp,
68884 .free = param_free_charp,
68885@@ -334,7 +334,7 @@ int param_get_bool(char *buffer, const s
68886 }
68887 EXPORT_SYMBOL(param_get_bool);
68888
68889-struct kernel_param_ops param_ops_bool = {
68890+const struct kernel_param_ops param_ops_bool = {
68891 .set = param_set_bool,
68892 .get = param_get_bool,
68893 };
68894@@ -362,7 +362,7 @@ int param_get_invbool(char *buffer, cons
68895 }
68896 EXPORT_SYMBOL(param_get_invbool);
68897
68898-struct kernel_param_ops param_ops_invbool = {
68899+const struct kernel_param_ops param_ops_invbool = {
68900 .set = param_set_invbool,
68901 .get = param_get_invbool,
68902 };
68903@@ -460,7 +460,7 @@ static void param_array_free(void *arg)
68904 arr->ops->free(arr->elem + arr->elemsize * i);
68905 }
68906
68907-struct kernel_param_ops param_array_ops = {
68908+const struct kernel_param_ops param_array_ops = {
68909 .set = param_array_set,
68910 .get = param_array_get,
68911 .free = param_array_free,
68912@@ -488,7 +488,7 @@ int param_get_string(char *buffer, const
68913 }
68914 EXPORT_SYMBOL(param_get_string);
68915
68916-struct kernel_param_ops param_ops_string = {
68917+const struct kernel_param_ops param_ops_string = {
68918 .set = param_set_copystring,
68919 .get = param_get_string,
68920 };
68921diff -urNp linux-2.6.39/kernel/perf_event.c linux-2.6.39/kernel/perf_event.c
68922--- linux-2.6.39/kernel/perf_event.c 2011-05-19 00:06:34.000000000 -0400
68923+++ linux-2.6.39/kernel/perf_event.c 2011-05-22 19:36:33.000000000 -0400
68924@@ -170,7 +170,7 @@ int perf_proc_update_handler(struct ctl_
68925 return 0;
68926 }
68927
68928-static atomic64_t perf_event_id;
68929+static atomic64_unchecked_t perf_event_id;
68930
68931 static void cpu_ctx_sched_out(struct perf_cpu_context *cpuctx,
68932 enum event_type_t event_type);
68933@@ -2496,7 +2496,7 @@ static void __perf_event_read(void *info
68934
68935 static inline u64 perf_event_count(struct perf_event *event)
68936 {
68937- return local64_read(&event->count) + atomic64_read(&event->child_count);
68938+ return local64_read(&event->count) + atomic64_read_unchecked(&event->child_count);
68939 }
68940
68941 static u64 perf_event_read(struct perf_event *event)
68942@@ -3031,9 +3031,9 @@ u64 perf_event_read_value(struct perf_ev
68943 mutex_lock(&event->child_mutex);
68944 total += perf_event_read(event);
68945 *enabled += event->total_time_enabled +
68946- atomic64_read(&event->child_total_time_enabled);
68947+ atomic64_read_unchecked(&event->child_total_time_enabled);
68948 *running += event->total_time_running +
68949- atomic64_read(&event->child_total_time_running);
68950+ atomic64_read_unchecked(&event->child_total_time_running);
68951
68952 list_for_each_entry(child, &event->child_list, child_list) {
68953 total += perf_event_read(child);
68954@@ -3396,10 +3396,10 @@ void perf_event_update_userpage(struct p
68955 userpg->offset -= local64_read(&event->hw.prev_count);
68956
68957 userpg->time_enabled = event->total_time_enabled +
68958- atomic64_read(&event->child_total_time_enabled);
68959+ atomic64_read_unchecked(&event->child_total_time_enabled);
68960
68961 userpg->time_running = event->total_time_running +
68962- atomic64_read(&event->child_total_time_running);
68963+ atomic64_read_unchecked(&event->child_total_time_running);
68964
68965 barrier();
68966 ++userpg->lock;
68967@@ -3884,16 +3884,16 @@ static void perf_pending_event(struct ir
68968 * Later on, we might change it to a list if there is
68969 * another virtualization implementation supporting the callbacks.
68970 */
68971-struct perf_guest_info_callbacks *perf_guest_cbs;
68972+const struct perf_guest_info_callbacks *perf_guest_cbs;
68973
68974-int perf_register_guest_info_callbacks(struct perf_guest_info_callbacks *cbs)
68975+int perf_register_guest_info_callbacks(const struct perf_guest_info_callbacks *cbs)
68976 {
68977 perf_guest_cbs = cbs;
68978 return 0;
68979 }
68980 EXPORT_SYMBOL_GPL(perf_register_guest_info_callbacks);
68981
68982-int perf_unregister_guest_info_callbacks(struct perf_guest_info_callbacks *cbs)
68983+int perf_unregister_guest_info_callbacks(const struct perf_guest_info_callbacks *cbs)
68984 {
68985 perf_guest_cbs = NULL;
68986 return 0;
68987@@ -4196,11 +4196,11 @@ static void perf_output_read_one(struct
68988 values[n++] = perf_event_count(event);
68989 if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) {
68990 values[n++] = enabled +
68991- atomic64_read(&event->child_total_time_enabled);
68992+ atomic64_read_unchecked(&event->child_total_time_enabled);
68993 }
68994 if (read_format & PERF_FORMAT_TOTAL_TIME_RUNNING) {
68995 values[n++] = running +
68996- atomic64_read(&event->child_total_time_running);
68997+ atomic64_read_unchecked(&event->child_total_time_running);
68998 }
68999 if (read_format & PERF_FORMAT_ID)
69000 values[n++] = primary_event_id(event);
69001@@ -6201,7 +6201,7 @@ perf_event_alloc(struct perf_event_attr
69002 event->parent = parent_event;
69003
69004 event->ns = get_pid_ns(current->nsproxy->pid_ns);
69005- event->id = atomic64_inc_return(&perf_event_id);
69006+ event->id = atomic64_inc_return_unchecked(&perf_event_id);
69007
69008 event->state = PERF_EVENT_STATE_INACTIVE;
69009
69010@@ -6724,10 +6724,10 @@ static void sync_child_event(struct perf
69011 /*
69012 * Add back the child's count to the parent's count:
69013 */
69014- atomic64_add(child_val, &parent_event->child_count);
69015- atomic64_add(child_event->total_time_enabled,
69016+ atomic64_add_unchecked(child_val, &parent_event->child_count);
69017+ atomic64_add_unchecked(child_event->total_time_enabled,
69018 &parent_event->child_total_time_enabled);
69019- atomic64_add(child_event->total_time_running,
69020+ atomic64_add_unchecked(child_event->total_time_running,
69021 &parent_event->child_total_time_running);
69022
69023 /*
69024diff -urNp linux-2.6.39/kernel/pid.c linux-2.6.39/kernel/pid.c
69025--- linux-2.6.39/kernel/pid.c 2011-05-19 00:06:34.000000000 -0400
69026+++ linux-2.6.39/kernel/pid.c 2011-05-22 19:41:42.000000000 -0400
69027@@ -33,6 +33,7 @@
69028 #include <linux/rculist.h>
69029 #include <linux/bootmem.h>
69030 #include <linux/hash.h>
69031+#include <linux/security.h>
69032 #include <linux/pid_namespace.h>
69033 #include <linux/init_task.h>
69034 #include <linux/syscalls.h>
69035@@ -45,7 +46,7 @@ struct pid init_struct_pid = INIT_STRUCT
69036
69037 int pid_max = PID_MAX_DEFAULT;
69038
69039-#define RESERVED_PIDS 300
69040+#define RESERVED_PIDS 500
69041
69042 int pid_max_min = RESERVED_PIDS + 1;
69043 int pid_max_max = PID_MAX_LIMIT;
69044@@ -419,8 +420,15 @@ EXPORT_SYMBOL(pid_task);
69045 */
69046 struct task_struct *find_task_by_pid_ns(pid_t nr, struct pid_namespace *ns)
69047 {
69048+ struct task_struct *task;
69049+
69050 rcu_lockdep_assert(rcu_read_lock_held());
69051- return pid_task(find_pid_ns(nr, ns), PIDTYPE_PID);
69052+ task = pid_task(find_pid_ns(nr, ns), PIDTYPE_PID);
69053+
69054+ if (gr_pid_is_chrooted(task))
69055+ return NULL;
69056+
69057+ return task;
69058 }
69059
69060 struct task_struct *find_task_by_vpid(pid_t vnr)
69061diff -urNp linux-2.6.39/kernel/posix-cpu-timers.c linux-2.6.39/kernel/posix-cpu-timers.c
69062--- linux-2.6.39/kernel/posix-cpu-timers.c 2011-05-19 00:06:34.000000000 -0400
69063+++ linux-2.6.39/kernel/posix-cpu-timers.c 2011-05-22 19:41:42.000000000 -0400
69064@@ -6,6 +6,7 @@
69065 #include <linux/posix-timers.h>
69066 #include <linux/errno.h>
69067 #include <linux/math64.h>
69068+#include <linux/security.h>
69069 #include <asm/uaccess.h>
69070 #include <linux/kernel_stat.h>
69071 #include <trace/events/timer.h>
69072@@ -1590,7 +1591,7 @@ static int thread_cpu_timer_create(struc
69073 return posix_cpu_timer_create(timer);
69074 }
69075
69076-struct k_clock clock_posix_cpu = {
69077+const struct k_clock clock_posix_cpu = {
69078 .clock_getres = posix_cpu_clock_getres,
69079 .clock_set = posix_cpu_clock_set,
69080 .clock_get = posix_cpu_clock_get,
69081@@ -1604,14 +1605,14 @@ struct k_clock clock_posix_cpu = {
69082
69083 static __init int init_posix_cpu_timers(void)
69084 {
69085- struct k_clock process = {
69086+ const struct k_clock process = {
69087 .clock_getres = process_cpu_clock_getres,
69088 .clock_get = process_cpu_clock_get,
69089 .timer_create = process_cpu_timer_create,
69090 .nsleep = process_cpu_nsleep,
69091 .nsleep_restart = process_cpu_nsleep_restart,
69092 };
69093- struct k_clock thread = {
69094+ const struct k_clock thread = {
69095 .clock_getres = thread_cpu_clock_getres,
69096 .clock_get = thread_cpu_clock_get,
69097 .timer_create = thread_cpu_timer_create,
69098diff -urNp linux-2.6.39/kernel/posix-timers.c linux-2.6.39/kernel/posix-timers.c
69099--- linux-2.6.39/kernel/posix-timers.c 2011-05-19 00:06:34.000000000 -0400
69100+++ linux-2.6.39/kernel/posix-timers.c 2011-05-22 20:13:41.000000000 -0400
69101@@ -43,6 +43,7 @@
69102 #include <linux/idr.h>
69103 #include <linux/posix-clock.h>
69104 #include <linux/posix-timers.h>
69105+#include <linux/grsecurity.h>
69106 #include <linux/syscalls.h>
69107 #include <linux/wait.h>
69108 #include <linux/workqueue.h>
69109@@ -227,7 +228,7 @@ static int posix_get_boottime(const cloc
69110 */
69111 static __init int init_posix_timers(void)
69112 {
69113- struct k_clock clock_realtime = {
69114+ const struct k_clock clock_realtime = {
69115 .clock_getres = hrtimer_get_res,
69116 .clock_get = posix_clock_realtime_get,
69117 .clock_set = posix_clock_realtime_set,
69118@@ -239,7 +240,7 @@ static __init int init_posix_timers(void
69119 .timer_get = common_timer_get,
69120 .timer_del = common_timer_del,
69121 };
69122- struct k_clock clock_monotonic = {
69123+ const struct k_clock clock_monotonic = {
69124 .clock_getres = hrtimer_get_res,
69125 .clock_get = posix_ktime_get_ts,
69126 .nsleep = common_nsleep,
69127@@ -249,19 +250,19 @@ static __init int init_posix_timers(void
69128 .timer_get = common_timer_get,
69129 .timer_del = common_timer_del,
69130 };
69131- struct k_clock clock_monotonic_raw = {
69132+ const struct k_clock clock_monotonic_raw = {
69133 .clock_getres = hrtimer_get_res,
69134 .clock_get = posix_get_monotonic_raw,
69135 };
69136- struct k_clock clock_realtime_coarse = {
69137+ const struct k_clock clock_realtime_coarse = {
69138 .clock_getres = posix_get_coarse_res,
69139 .clock_get = posix_get_realtime_coarse,
69140 };
69141- struct k_clock clock_monotonic_coarse = {
69142+ const struct k_clock clock_monotonic_coarse = {
69143 .clock_getres = posix_get_coarse_res,
69144 .clock_get = posix_get_monotonic_coarse,
69145 };
69146- struct k_clock clock_boottime = {
69147+ const struct k_clock clock_boottime = {
69148 .clock_getres = hrtimer_get_res,
69149 .clock_get = posix_get_boottime,
69150 .nsleep = common_nsleep,
69151@@ -272,6 +273,8 @@ static __init int init_posix_timers(void
69152 .timer_del = common_timer_del,
69153 };
69154
69155+ pax_track_stack();
69156+
69157 posix_timers_register_clock(CLOCK_REALTIME, &clock_realtime);
69158 posix_timers_register_clock(CLOCK_MONOTONIC, &clock_monotonic);
69159 posix_timers_register_clock(CLOCK_MONOTONIC_RAW, &clock_monotonic_raw);
69160@@ -454,7 +457,7 @@ static struct pid *good_sigevent(sigeven
69161 }
69162
69163 void posix_timers_register_clock(const clockid_t clock_id,
69164- struct k_clock *new_clock)
69165+ const struct k_clock *new_clock)
69166 {
69167 if ((unsigned) clock_id >= MAX_CLOCKS) {
69168 printk(KERN_WARNING "POSIX clock register failed for clock_id %d\n",
69169@@ -506,7 +509,7 @@ static void release_posix_timer(struct k
69170 kmem_cache_free(posix_timers_cache, tmr);
69171 }
69172
69173-static struct k_clock *clockid_to_kclock(const clockid_t id)
69174+static const struct k_clock *clockid_to_kclock(const clockid_t id)
69175 {
69176 if (id < 0)
69177 return (id & CLOCKFD_MASK) == CLOCKFD ?
69178@@ -529,7 +532,7 @@ SYSCALL_DEFINE3(timer_create, const cloc
69179 struct sigevent __user *, timer_event_spec,
69180 timer_t __user *, created_timer_id)
69181 {
69182- struct k_clock *kc = clockid_to_kclock(which_clock);
69183+ const struct k_clock *kc = clockid_to_kclock(which_clock);
69184 struct k_itimer *new_timer;
69185 int error, new_timer_id;
69186 sigevent_t event;
69187@@ -714,7 +717,7 @@ SYSCALL_DEFINE2(timer_gettime, timer_t,
69188 {
69189 struct itimerspec cur_setting;
69190 struct k_itimer *timr;
69191- struct k_clock *kc;
69192+ const struct k_clock *kc;
69193 unsigned long flags;
69194 int ret = 0;
69195
69196@@ -822,7 +825,7 @@ SYSCALL_DEFINE4(timer_settime, timer_t,
69197 int error = 0;
69198 unsigned long flag;
69199 struct itimerspec *rtn = old_setting ? &old_spec : NULL;
69200- struct k_clock *kc;
69201+ const struct k_clock *kc;
69202
69203 if (!new_setting)
69204 return -EINVAL;
69205@@ -868,7 +871,7 @@ static int common_timer_del(struct k_iti
69206
69207 static inline int timer_delete_hook(struct k_itimer *timer)
69208 {
69209- struct k_clock *kc = clockid_to_kclock(timer->it_clock);
69210+ const struct k_clock *kc = clockid_to_kclock(timer->it_clock);
69211
69212 if (WARN_ON_ONCE(!kc || !kc->timer_del))
69213 return -EINVAL;
69214@@ -947,7 +950,7 @@ void exit_itimers(struct signal_struct *
69215 SYSCALL_DEFINE2(clock_settime, const clockid_t, which_clock,
69216 const struct timespec __user *, tp)
69217 {
69218- struct k_clock *kc = clockid_to_kclock(which_clock);
69219+ const struct k_clock *kc = clockid_to_kclock(which_clock);
69220 struct timespec new_tp;
69221
69222 if (!kc || !kc->clock_set)
69223@@ -956,13 +959,20 @@ SYSCALL_DEFINE2(clock_settime, const clo
69224 if (copy_from_user(&new_tp, tp, sizeof (*tp)))
69225 return -EFAULT;
69226
69227+ /* only the CLOCK_REALTIME clock can be set, all other clocks
69228+ have their clock_set fptr set to a nosettime dummy function
69229+ CLOCK_REALTIME has a NULL clock_set fptr which causes it to
69230+ call common_clock_set, which calls do_sys_settimeofday, which
69231+ we hook
69232+ */
69233+
69234 return kc->clock_set(which_clock, &new_tp);
69235 }
69236
69237 SYSCALL_DEFINE2(clock_gettime, const clockid_t, which_clock,
69238 struct timespec __user *,tp)
69239 {
69240- struct k_clock *kc = clockid_to_kclock(which_clock);
69241+ const struct k_clock *kc = clockid_to_kclock(which_clock);
69242 struct timespec kernel_tp;
69243 int error;
69244
69245@@ -980,7 +990,7 @@ SYSCALL_DEFINE2(clock_gettime, const clo
69246 SYSCALL_DEFINE2(clock_adjtime, const clockid_t, which_clock,
69247 struct timex __user *, utx)
69248 {
69249- struct k_clock *kc = clockid_to_kclock(which_clock);
69250+ const struct k_clock *kc = clockid_to_kclock(which_clock);
69251 struct timex ktx;
69252 int err;
69253
69254@@ -1003,7 +1013,7 @@ SYSCALL_DEFINE2(clock_adjtime, const clo
69255 SYSCALL_DEFINE2(clock_getres, const clockid_t, which_clock,
69256 struct timespec __user *, tp)
69257 {
69258- struct k_clock *kc = clockid_to_kclock(which_clock);
69259+ const struct k_clock *kc = clockid_to_kclock(which_clock);
69260 struct timespec rtn_tp;
69261 int error;
69262
69263@@ -1033,7 +1043,7 @@ SYSCALL_DEFINE4(clock_nanosleep, const c
69264 const struct timespec __user *, rqtp,
69265 struct timespec __user *, rmtp)
69266 {
69267- struct k_clock *kc = clockid_to_kclock(which_clock);
69268+ const struct k_clock *kc = clockid_to_kclock(which_clock);
69269 struct timespec t;
69270
69271 if (!kc)
69272@@ -1057,7 +1067,7 @@ SYSCALL_DEFINE4(clock_nanosleep, const c
69273 long clock_nanosleep_restart(struct restart_block *restart_block)
69274 {
69275 clockid_t which_clock = restart_block->nanosleep.index;
69276- struct k_clock *kc = clockid_to_kclock(which_clock);
69277+ const struct k_clock *kc = clockid_to_kclock(which_clock);
69278
69279 if (WARN_ON_ONCE(!kc || !kc->nsleep_restart))
69280 return -EINVAL;
69281diff -urNp linux-2.6.39/kernel/power/poweroff.c linux-2.6.39/kernel/power/poweroff.c
69282--- linux-2.6.39/kernel/power/poweroff.c 2011-05-19 00:06:34.000000000 -0400
69283+++ linux-2.6.39/kernel/power/poweroff.c 2011-05-22 19:36:33.000000000 -0400
69284@@ -37,7 +37,7 @@ static struct sysrq_key_op sysrq_powerof
69285 .enable_mask = SYSRQ_ENABLE_BOOT,
69286 };
69287
69288-static int pm_sysrq_init(void)
69289+static int __init pm_sysrq_init(void)
69290 {
69291 register_sysrq_key('o', &sysrq_poweroff_op);
69292 return 0;
69293diff -urNp linux-2.6.39/kernel/power/process.c linux-2.6.39/kernel/power/process.c
69294--- linux-2.6.39/kernel/power/process.c 2011-05-19 00:06:34.000000000 -0400
69295+++ linux-2.6.39/kernel/power/process.c 2011-05-22 19:36:33.000000000 -0400
69296@@ -41,6 +41,7 @@ static int try_to_freeze_tasks(bool sig_
69297 u64 elapsed_csecs64;
69298 unsigned int elapsed_csecs;
69299 bool wakeup = false;
69300+ bool timedout = false;
69301
69302 do_gettimeofday(&start);
69303
69304@@ -51,6 +52,8 @@ static int try_to_freeze_tasks(bool sig_
69305
69306 while (true) {
69307 todo = 0;
69308+ if (time_after(jiffies, end_time))
69309+ timedout = true;
69310 read_lock(&tasklist_lock);
69311 do_each_thread(g, p) {
69312 if (frozen(p) || !freezable(p))
69313@@ -71,9 +74,13 @@ static int try_to_freeze_tasks(bool sig_
69314 * try_to_stop() after schedule() in ptrace/signal
69315 * stop sees TIF_FREEZE.
69316 */
69317- if (!task_is_stopped_or_traced(p) &&
69318- !freezer_should_skip(p))
69319+ if (!task_is_stopped_or_traced(p) && !freezer_should_skip(p)) {
69320 todo++;
69321+ if (timedout) {
69322+ printk(KERN_ERR "Task refusing to freeze:\n");
69323+ sched_show_task(p);
69324+ }
69325+ }
69326 } while_each_thread(g, p);
69327 read_unlock(&tasklist_lock);
69328
69329@@ -82,7 +89,7 @@ static int try_to_freeze_tasks(bool sig_
69330 todo += wq_busy;
69331 }
69332
69333- if (!todo || time_after(jiffies, end_time))
69334+ if (!todo || timedout)
69335 break;
69336
69337 if (pm_wakeup_pending()) {
69338diff -urNp linux-2.6.39/kernel/printk.c linux-2.6.39/kernel/printk.c
69339--- linux-2.6.39/kernel/printk.c 2011-05-19 00:06:34.000000000 -0400
69340+++ linux-2.6.39/kernel/printk.c 2011-05-22 19:41:42.000000000 -0400
69341@@ -284,12 +284,17 @@ static int check_syslog_permissions(int
69342 if (from_file && type != SYSLOG_ACTION_OPEN)
69343 return 0;
69344
69345+#ifdef CONFIG_GRKERNSEC_DMESG
69346+ if (grsec_enable_dmesg && !capable(CAP_SYSLOG) && !capable_nolog(CAP_SYS_ADMIN))
69347+ return -EPERM;
69348+#endif
69349+
69350 if (syslog_action_restricted(type)) {
69351 if (capable(CAP_SYSLOG))
69352 return 0;
69353 /* For historical reasons, accept CAP_SYS_ADMIN too, with a warning */
69354 if (capable(CAP_SYS_ADMIN)) {
69355- WARN_ONCE(1, "Attempt to access syslog with CAP_SYS_ADMIN "
69356+ printk_once(KERN_WARNING "Attempt to access syslog with CAP_SYS_ADMIN "
69357 "but no CAP_SYSLOG (deprecated).\n");
69358 return 0;
69359 }
69360diff -urNp linux-2.6.39/kernel/profile.c linux-2.6.39/kernel/profile.c
69361--- linux-2.6.39/kernel/profile.c 2011-05-19 00:06:34.000000000 -0400
69362+++ linux-2.6.39/kernel/profile.c 2011-05-22 19:36:33.000000000 -0400
69363@@ -39,7 +39,7 @@ struct profile_hit {
69364 /* Oprofile timer tick hook */
69365 static int (*timer_hook)(struct pt_regs *) __read_mostly;
69366
69367-static atomic_t *prof_buffer;
69368+static atomic_unchecked_t *prof_buffer;
69369 static unsigned long prof_len, prof_shift;
69370
69371 int prof_on __read_mostly;
69372@@ -283,7 +283,7 @@ static void profile_flip_buffers(void)
69373 hits[i].pc = 0;
69374 continue;
69375 }
69376- atomic_add(hits[i].hits, &prof_buffer[hits[i].pc]);
69377+ atomic_add_unchecked(hits[i].hits, &prof_buffer[hits[i].pc]);
69378 hits[i].hits = hits[i].pc = 0;
69379 }
69380 }
69381@@ -346,9 +346,9 @@ void profile_hits(int type, void *__pc,
69382 * Add the current hit(s) and flush the write-queue out
69383 * to the global buffer:
69384 */
69385- atomic_add(nr_hits, &prof_buffer[pc]);
69386+ atomic_add_unchecked(nr_hits, &prof_buffer[pc]);
69387 for (i = 0; i < NR_PROFILE_HIT; ++i) {
69388- atomic_add(hits[i].hits, &prof_buffer[hits[i].pc]);
69389+ atomic_add_unchecked(hits[i].hits, &prof_buffer[hits[i].pc]);
69390 hits[i].pc = hits[i].hits = 0;
69391 }
69392 out:
69393@@ -426,7 +426,7 @@ void profile_hits(int type, void *__pc,
69394 if (prof_on != type || !prof_buffer)
69395 return;
69396 pc = ((unsigned long)__pc - (unsigned long)_stext) >> prof_shift;
69397- atomic_add(nr_hits, &prof_buffer[min(pc, prof_len - 1)]);
69398+ atomic_add_unchecked(nr_hits, &prof_buffer[min(pc, prof_len - 1)]);
69399 }
69400 #endif /* !CONFIG_SMP */
69401 EXPORT_SYMBOL_GPL(profile_hits);
69402@@ -517,7 +517,7 @@ read_profile(struct file *file, char __u
69403 return -EFAULT;
69404 buf++; p++; count--; read++;
69405 }
69406- pnt = (char *)prof_buffer + p - sizeof(atomic_t);
69407+ pnt = (char *)prof_buffer + p - sizeof(atomic_unchecked_t);
69408 if (copy_to_user(buf, (void *)pnt, count))
69409 return -EFAULT;
69410 read += count;
69411@@ -548,7 +548,7 @@ static ssize_t write_profile(struct file
69412 }
69413 #endif
69414 profile_discard_flip_buffers();
69415- memset(prof_buffer, 0, prof_len * sizeof(atomic_t));
69416+ memset(prof_buffer, 0, prof_len * sizeof(atomic_unchecked_t));
69417 return count;
69418 }
69419
69420diff -urNp linux-2.6.39/kernel/ptrace.c linux-2.6.39/kernel/ptrace.c
69421--- linux-2.6.39/kernel/ptrace.c 2011-05-19 00:06:34.000000000 -0400
69422+++ linux-2.6.39/kernel/ptrace.c 2011-05-23 17:07:00.000000000 -0400
69423@@ -117,7 +117,8 @@ int ptrace_check_attach(struct task_stru
69424 return ret;
69425 }
69426
69427-int __ptrace_may_access(struct task_struct *task, unsigned int mode)
69428+static int __ptrace_may_access(struct task_struct *task, unsigned int mode,
69429+ unsigned int log)
69430 {
69431 const struct cred *cred = current_cred(), *tcred;
69432
69433@@ -143,7 +144,8 @@ int __ptrace_may_access(struct task_stru
69434 cred->gid == tcred->sgid &&
69435 cred->gid == tcred->gid))
69436 goto ok;
69437- if (ns_capable(tcred->user->user_ns, CAP_SYS_PTRACE))
69438+ if ((!log && ns_capable_nolog(tcred->user->user_ns, CAP_SYS_PTRACE)) ||
69439+ (log && ns_capable(tcred->user->user_ns, CAP_SYS_PTRACE)))
69440 goto ok;
69441 rcu_read_unlock();
69442 return -EPERM;
69443@@ -152,7 +154,9 @@ ok:
69444 smp_rmb();
69445 if (task->mm)
69446 dumpable = get_dumpable(task->mm);
69447- if (!dumpable && !task_ns_capable(task, CAP_SYS_PTRACE))
69448+ if (!dumpable &&
69449+ ((!log && !task_ns_capable_nolog(task, CAP_SYS_PTRACE)) ||
69450+ (log && !task_ns_capable(task, CAP_SYS_PTRACE))))
69451 return -EPERM;
69452
69453 return security_ptrace_access_check(task, mode);
69454@@ -162,7 +166,16 @@ bool ptrace_may_access(struct task_struc
69455 {
69456 int err;
69457 task_lock(task);
69458- err = __ptrace_may_access(task, mode);
69459+ err = __ptrace_may_access(task, mode, 0);
69460+ task_unlock(task);
69461+ return !err;
69462+}
69463+
69464+bool ptrace_may_access_log(struct task_struct *task, unsigned int mode)
69465+{
69466+ int err;
69467+ task_lock(task);
69468+ err = __ptrace_may_access(task, mode, 1);
69469 task_unlock(task);
69470 return !err;
69471 }
69472@@ -189,7 +202,7 @@ static int ptrace_attach(struct task_str
69473 goto out;
69474
69475 task_lock(task);
69476- retval = __ptrace_may_access(task, PTRACE_MODE_ATTACH);
69477+ retval = __ptrace_may_access(task, PTRACE_MODE_ATTACH, 1);
69478 task_unlock(task);
69479 if (retval)
69480 goto unlock_creds;
69481@@ -202,7 +215,7 @@ static int ptrace_attach(struct task_str
69482 goto unlock_tasklist;
69483
69484 task->ptrace = PT_PTRACED;
69485- if (task_ns_capable(task, CAP_SYS_PTRACE))
69486+ if (task_ns_capable_nolog(task, CAP_SYS_PTRACE))
69487 task->ptrace |= PT_PTRACE_CAP;
69488
69489 __ptrace_link(task, current);
69490@@ -362,6 +375,8 @@ int ptrace_readdata(struct task_struct *
69491 {
69492 int copied = 0;
69493
69494+ pax_track_stack();
69495+
69496 while (len > 0) {
69497 char buf[128];
69498 int this_len, retval;
69499@@ -373,7 +388,7 @@ int ptrace_readdata(struct task_struct *
69500 break;
69501 return -EIO;
69502 }
69503- if (copy_to_user(dst, buf, retval))
69504+ if (retval > sizeof(buf) || copy_to_user(dst, buf, retval))
69505 return -EFAULT;
69506 copied += retval;
69507 src += retval;
69508@@ -387,6 +402,8 @@ int ptrace_writedata(struct task_struct
69509 {
69510 int copied = 0;
69511
69512+ pax_track_stack();
69513+
69514 while (len > 0) {
69515 char buf[128];
69516 int this_len, retval;
69517@@ -569,9 +586,11 @@ int ptrace_request(struct task_struct *c
69518 {
69519 int ret = -EIO;
69520 siginfo_t siginfo;
69521- void __user *datavp = (void __user *) data;
69522+ void __user *datavp = (__force void __user *) data;
69523 unsigned long __user *datalp = datavp;
69524
69525+ pax_track_stack();
69526+
69527 switch (request) {
69528 case PTRACE_PEEKTEXT:
69529 case PTRACE_PEEKDATA:
69530@@ -717,14 +736,21 @@ SYSCALL_DEFINE4(ptrace, long, request, l
69531 goto out;
69532 }
69533
69534+ if (gr_handle_ptrace(child, request)) {
69535+ ret = -EPERM;
69536+ goto out_put_task_struct;
69537+ }
69538+
69539 if (request == PTRACE_ATTACH) {
69540 ret = ptrace_attach(child);
69541 /*
69542 * Some architectures need to do book-keeping after
69543 * a ptrace attach.
69544 */
69545- if (!ret)
69546+ if (!ret) {
69547 arch_ptrace_attach(child);
69548+ gr_audit_ptrace(child);
69549+ }
69550 goto out_put_task_struct;
69551 }
69552
69553@@ -749,7 +775,7 @@ int generic_ptrace_peekdata(struct task_
69554 copied = access_process_vm(tsk, addr, &tmp, sizeof(tmp), 0);
69555 if (copied != sizeof(tmp))
69556 return -EIO;
69557- return put_user(tmp, (unsigned long __user *)data);
69558+ return put_user(tmp, (__force unsigned long __user *)data);
69559 }
69560
69561 int generic_ptrace_pokedata(struct task_struct *tsk, unsigned long addr,
69562@@ -772,6 +798,8 @@ int compat_ptrace_request(struct task_st
69563 siginfo_t siginfo;
69564 int ret;
69565
69566+ pax_track_stack();
69567+
69568 switch (request) {
69569 case PTRACE_PEEKTEXT:
69570 case PTRACE_PEEKDATA:
69571@@ -859,14 +887,21 @@ asmlinkage long compat_sys_ptrace(compat
69572 goto out;
69573 }
69574
69575+ if (gr_handle_ptrace(child, request)) {
69576+ ret = -EPERM;
69577+ goto out_put_task_struct;
69578+ }
69579+
69580 if (request == PTRACE_ATTACH) {
69581 ret = ptrace_attach(child);
69582 /*
69583 * Some architectures need to do book-keeping after
69584 * a ptrace attach.
69585 */
69586- if (!ret)
69587+ if (!ret) {
69588 arch_ptrace_attach(child);
69589+ gr_audit_ptrace(child);
69590+ }
69591 goto out_put_task_struct;
69592 }
69593
69594diff -urNp linux-2.6.39/kernel/rcutorture.c linux-2.6.39/kernel/rcutorture.c
69595--- linux-2.6.39/kernel/rcutorture.c 2011-05-19 00:06:34.000000000 -0400
69596+++ linux-2.6.39/kernel/rcutorture.c 2011-05-22 19:36:33.000000000 -0400
69597@@ -138,12 +138,12 @@ static DEFINE_PER_CPU(long [RCU_TORTURE_
69598 { 0 };
69599 static DEFINE_PER_CPU(long [RCU_TORTURE_PIPE_LEN + 1], rcu_torture_batch) =
69600 { 0 };
69601-static atomic_t rcu_torture_wcount[RCU_TORTURE_PIPE_LEN + 1];
69602-static atomic_t n_rcu_torture_alloc;
69603-static atomic_t n_rcu_torture_alloc_fail;
69604-static atomic_t n_rcu_torture_free;
69605-static atomic_t n_rcu_torture_mberror;
69606-static atomic_t n_rcu_torture_error;
69607+static atomic_unchecked_t rcu_torture_wcount[RCU_TORTURE_PIPE_LEN + 1];
69608+static atomic_unchecked_t n_rcu_torture_alloc;
69609+static atomic_unchecked_t n_rcu_torture_alloc_fail;
69610+static atomic_unchecked_t n_rcu_torture_free;
69611+static atomic_unchecked_t n_rcu_torture_mberror;
69612+static atomic_unchecked_t n_rcu_torture_error;
69613 static long n_rcu_torture_boost_ktrerror;
69614 static long n_rcu_torture_boost_rterror;
69615 static long n_rcu_torture_boost_allocerror;
69616@@ -225,11 +225,11 @@ rcu_torture_alloc(void)
69617
69618 spin_lock_bh(&rcu_torture_lock);
69619 if (list_empty(&rcu_torture_freelist)) {
69620- atomic_inc(&n_rcu_torture_alloc_fail);
69621+ atomic_inc_unchecked(&n_rcu_torture_alloc_fail);
69622 spin_unlock_bh(&rcu_torture_lock);
69623 return NULL;
69624 }
69625- atomic_inc(&n_rcu_torture_alloc);
69626+ atomic_inc_unchecked(&n_rcu_torture_alloc);
69627 p = rcu_torture_freelist.next;
69628 list_del_init(p);
69629 spin_unlock_bh(&rcu_torture_lock);
69630@@ -242,7 +242,7 @@ rcu_torture_alloc(void)
69631 static void
69632 rcu_torture_free(struct rcu_torture *p)
69633 {
69634- atomic_inc(&n_rcu_torture_free);
69635+ atomic_inc_unchecked(&n_rcu_torture_free);
69636 spin_lock_bh(&rcu_torture_lock);
69637 list_add_tail(&p->rtort_free, &rcu_torture_freelist);
69638 spin_unlock_bh(&rcu_torture_lock);
69639@@ -362,7 +362,7 @@ rcu_torture_cb(struct rcu_head *p)
69640 i = rp->rtort_pipe_count;
69641 if (i > RCU_TORTURE_PIPE_LEN)
69642 i = RCU_TORTURE_PIPE_LEN;
69643- atomic_inc(&rcu_torture_wcount[i]);
69644+ atomic_inc_unchecked(&rcu_torture_wcount[i]);
69645 if (++rp->rtort_pipe_count >= RCU_TORTURE_PIPE_LEN) {
69646 rp->rtort_mbtest = 0;
69647 rcu_torture_free(rp);
69648@@ -409,7 +409,7 @@ static void rcu_sync_torture_deferred_fr
69649 i = rp->rtort_pipe_count;
69650 if (i > RCU_TORTURE_PIPE_LEN)
69651 i = RCU_TORTURE_PIPE_LEN;
69652- atomic_inc(&rcu_torture_wcount[i]);
69653+ atomic_inc_unchecked(&rcu_torture_wcount[i]);
69654 if (++rp->rtort_pipe_count >= RCU_TORTURE_PIPE_LEN) {
69655 rp->rtort_mbtest = 0;
69656 list_del(&rp->rtort_free);
69657@@ -882,7 +882,7 @@ rcu_torture_writer(void *arg)
69658 i = old_rp->rtort_pipe_count;
69659 if (i > RCU_TORTURE_PIPE_LEN)
69660 i = RCU_TORTURE_PIPE_LEN;
69661- atomic_inc(&rcu_torture_wcount[i]);
69662+ atomic_inc_unchecked(&rcu_torture_wcount[i]);
69663 old_rp->rtort_pipe_count++;
69664 cur_ops->deferred_free(old_rp);
69665 }
69666@@ -951,7 +951,7 @@ static void rcu_torture_timer(unsigned l
69667 return;
69668 }
69669 if (p->rtort_mbtest == 0)
69670- atomic_inc(&n_rcu_torture_mberror);
69671+ atomic_inc_unchecked(&n_rcu_torture_mberror);
69672 spin_lock(&rand_lock);
69673 cur_ops->read_delay(&rand);
69674 n_rcu_torture_timers++;
69675@@ -1013,7 +1013,7 @@ rcu_torture_reader(void *arg)
69676 continue;
69677 }
69678 if (p->rtort_mbtest == 0)
69679- atomic_inc(&n_rcu_torture_mberror);
69680+ atomic_inc_unchecked(&n_rcu_torture_mberror);
69681 cur_ops->read_delay(&rand);
69682 preempt_disable();
69683 pipe_count = p->rtort_pipe_count;
69684@@ -1072,10 +1072,10 @@ rcu_torture_printk(char *page)
69685 rcu_torture_current,
69686 rcu_torture_current_version,
69687 list_empty(&rcu_torture_freelist),
69688- atomic_read(&n_rcu_torture_alloc),
69689- atomic_read(&n_rcu_torture_alloc_fail),
69690- atomic_read(&n_rcu_torture_free),
69691- atomic_read(&n_rcu_torture_mberror),
69692+ atomic_read_unchecked(&n_rcu_torture_alloc),
69693+ atomic_read_unchecked(&n_rcu_torture_alloc_fail),
69694+ atomic_read_unchecked(&n_rcu_torture_free),
69695+ atomic_read_unchecked(&n_rcu_torture_mberror),
69696 n_rcu_torture_boost_ktrerror,
69697 n_rcu_torture_boost_rterror,
69698 n_rcu_torture_boost_allocerror,
69699@@ -1083,7 +1083,7 @@ rcu_torture_printk(char *page)
69700 n_rcu_torture_boost_failure,
69701 n_rcu_torture_boosts,
69702 n_rcu_torture_timers);
69703- if (atomic_read(&n_rcu_torture_mberror) != 0 ||
69704+ if (atomic_read_unchecked(&n_rcu_torture_mberror) != 0 ||
69705 n_rcu_torture_boost_ktrerror != 0 ||
69706 n_rcu_torture_boost_rterror != 0 ||
69707 n_rcu_torture_boost_allocerror != 0 ||
69708@@ -1093,7 +1093,7 @@ rcu_torture_printk(char *page)
69709 cnt += sprintf(&page[cnt], "\n%s%s ", torture_type, TORTURE_FLAG);
69710 if (i > 1) {
69711 cnt += sprintf(&page[cnt], "!!! ");
69712- atomic_inc(&n_rcu_torture_error);
69713+ atomic_inc_unchecked(&n_rcu_torture_error);
69714 WARN_ON_ONCE(1);
69715 }
69716 cnt += sprintf(&page[cnt], "Reader Pipe: ");
69717@@ -1107,7 +1107,7 @@ rcu_torture_printk(char *page)
69718 cnt += sprintf(&page[cnt], "Free-Block Circulation: ");
69719 for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++) {
69720 cnt += sprintf(&page[cnt], " %d",
69721- atomic_read(&rcu_torture_wcount[i]));
69722+ atomic_read_unchecked(&rcu_torture_wcount[i]));
69723 }
69724 cnt += sprintf(&page[cnt], "\n");
69725 if (cur_ops->stats)
69726@@ -1415,7 +1415,7 @@ rcu_torture_cleanup(void)
69727
69728 if (cur_ops->cleanup)
69729 cur_ops->cleanup();
69730- if (atomic_read(&n_rcu_torture_error))
69731+ if (atomic_read_unchecked(&n_rcu_torture_error))
69732 rcu_torture_print_module_parms(cur_ops, "End of test: FAILURE");
69733 else
69734 rcu_torture_print_module_parms(cur_ops, "End of test: SUCCESS");
69735@@ -1479,11 +1479,11 @@ rcu_torture_init(void)
69736
69737 rcu_torture_current = NULL;
69738 rcu_torture_current_version = 0;
69739- atomic_set(&n_rcu_torture_alloc, 0);
69740- atomic_set(&n_rcu_torture_alloc_fail, 0);
69741- atomic_set(&n_rcu_torture_free, 0);
69742- atomic_set(&n_rcu_torture_mberror, 0);
69743- atomic_set(&n_rcu_torture_error, 0);
69744+ atomic_set_unchecked(&n_rcu_torture_alloc, 0);
69745+ atomic_set_unchecked(&n_rcu_torture_alloc_fail, 0);
69746+ atomic_set_unchecked(&n_rcu_torture_free, 0);
69747+ atomic_set_unchecked(&n_rcu_torture_mberror, 0);
69748+ atomic_set_unchecked(&n_rcu_torture_error, 0);
69749 n_rcu_torture_boost_ktrerror = 0;
69750 n_rcu_torture_boost_rterror = 0;
69751 n_rcu_torture_boost_allocerror = 0;
69752@@ -1491,7 +1491,7 @@ rcu_torture_init(void)
69753 n_rcu_torture_boost_failure = 0;
69754 n_rcu_torture_boosts = 0;
69755 for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++)
69756- atomic_set(&rcu_torture_wcount[i], 0);
69757+ atomic_set_unchecked(&rcu_torture_wcount[i], 0);
69758 for_each_possible_cpu(cpu) {
69759 for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++) {
69760 per_cpu(rcu_torture_count, cpu)[i] = 0;
69761diff -urNp linux-2.6.39/kernel/rcutree.c linux-2.6.39/kernel/rcutree.c
69762--- linux-2.6.39/kernel/rcutree.c 2011-05-19 00:06:34.000000000 -0400
69763+++ linux-2.6.39/kernel/rcutree.c 2011-05-22 19:36:33.000000000 -0400
69764@@ -1389,7 +1389,7 @@ __rcu_process_callbacks(struct rcu_state
69765 /*
69766 * Do softirq processing for the current CPU.
69767 */
69768-static void rcu_process_callbacks(struct softirq_action *unused)
69769+static void rcu_process_callbacks(void)
69770 {
69771 /*
69772 * Memory references from any prior RCU read-side critical sections
69773diff -urNp linux-2.6.39/kernel/rcutree_plugin.h linux-2.6.39/kernel/rcutree_plugin.h
69774--- linux-2.6.39/kernel/rcutree_plugin.h 2011-05-19 00:06:34.000000000 -0400
69775+++ linux-2.6.39/kernel/rcutree_plugin.h 2011-05-22 19:36:33.000000000 -0400
69776@@ -730,7 +730,7 @@ void synchronize_rcu_expedited(void)
69777
69778 /* Clean up and exit. */
69779 smp_mb(); /* ensure expedited GP seen before counter increment. */
69780- ACCESS_ONCE(sync_rcu_preempt_exp_count)++;
69781+ ACCESS_ONCE_RW(sync_rcu_preempt_exp_count)++;
69782 unlock_mb_ret:
69783 mutex_unlock(&sync_rcu_preempt_exp_mutex);
69784 mb_ret:
69785@@ -1025,8 +1025,8 @@ EXPORT_SYMBOL_GPL(synchronize_sched_expe
69786
69787 #else /* #ifndef CONFIG_SMP */
69788
69789-static atomic_t sync_sched_expedited_started = ATOMIC_INIT(0);
69790-static atomic_t sync_sched_expedited_done = ATOMIC_INIT(0);
69791+static atomic_unchecked_t sync_sched_expedited_started = ATOMIC_INIT(0);
69792+static atomic_unchecked_t sync_sched_expedited_done = ATOMIC_INIT(0);
69793
69794 static int synchronize_sched_expedited_cpu_stop(void *data)
69795 {
69796@@ -1081,7 +1081,7 @@ void synchronize_sched_expedited(void)
69797 int firstsnap, s, snap, trycount = 0;
69798
69799 /* Note that atomic_inc_return() implies full memory barrier. */
69800- firstsnap = snap = atomic_inc_return(&sync_sched_expedited_started);
69801+ firstsnap = snap = atomic_inc_return_unchecked(&sync_sched_expedited_started);
69802 get_online_cpus();
69803
69804 /*
69805@@ -1102,7 +1102,7 @@ void synchronize_sched_expedited(void)
69806 }
69807
69808 /* Check to see if someone else did our work for us. */
69809- s = atomic_read(&sync_sched_expedited_done);
69810+ s = atomic_read_unchecked(&sync_sched_expedited_done);
69811 if (UINT_CMP_GE((unsigned)s, (unsigned)firstsnap)) {
69812 smp_mb(); /* ensure test happens before caller kfree */
69813 return;
69814@@ -1117,7 +1117,7 @@ void synchronize_sched_expedited(void)
69815 * grace period works for us.
69816 */
69817 get_online_cpus();
69818- snap = atomic_read(&sync_sched_expedited_started) - 1;
69819+ snap = atomic_read_unchecked(&sync_sched_expedited_started) - 1;
69820 smp_mb(); /* ensure read is before try_stop_cpus(). */
69821 }
69822
69823@@ -1128,12 +1128,12 @@ void synchronize_sched_expedited(void)
69824 * than we did beat us to the punch.
69825 */
69826 do {
69827- s = atomic_read(&sync_sched_expedited_done);
69828+ s = atomic_read_unchecked(&sync_sched_expedited_done);
69829 if (UINT_CMP_GE((unsigned)s, (unsigned)snap)) {
69830 smp_mb(); /* ensure test happens before caller kfree */
69831 break;
69832 }
69833- } while (atomic_cmpxchg(&sync_sched_expedited_done, s, snap) != s);
69834+ } while (atomic_cmpxchg_unchecked(&sync_sched_expedited_done, s, snap) != s);
69835
69836 put_online_cpus();
69837 }
69838diff -urNp linux-2.6.39/kernel/relay.c linux-2.6.39/kernel/relay.c
69839--- linux-2.6.39/kernel/relay.c 2011-05-19 00:06:34.000000000 -0400
69840+++ linux-2.6.39/kernel/relay.c 2011-05-22 19:36:33.000000000 -0400
69841@@ -1236,6 +1236,8 @@ static ssize_t subbuf_splice_actor(struc
69842 };
69843 ssize_t ret;
69844
69845+ pax_track_stack();
69846+
69847 if (rbuf->subbufs_produced == rbuf->subbufs_consumed)
69848 return 0;
69849 if (splice_grow_spd(pipe, &spd))
69850diff -urNp linux-2.6.39/kernel/resource.c linux-2.6.39/kernel/resource.c
69851--- linux-2.6.39/kernel/resource.c 2011-05-19 00:06:34.000000000 -0400
69852+++ linux-2.6.39/kernel/resource.c 2011-05-22 19:41:42.000000000 -0400
69853@@ -133,8 +133,18 @@ static const struct file_operations proc
69854
69855 static int __init ioresources_init(void)
69856 {
69857+#ifdef CONFIG_GRKERNSEC_PROC_ADD
69858+#ifdef CONFIG_GRKERNSEC_PROC_USER
69859+ proc_create("ioports", S_IRUSR, NULL, &proc_ioports_operations);
69860+ proc_create("iomem", S_IRUSR, NULL, &proc_iomem_operations);
69861+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
69862+ proc_create("ioports", S_IRUSR | S_IRGRP, NULL, &proc_ioports_operations);
69863+ proc_create("iomem", S_IRUSR | S_IRGRP, NULL, &proc_iomem_operations);
69864+#endif
69865+#else
69866 proc_create("ioports", 0, NULL, &proc_ioports_operations);
69867 proc_create("iomem", 0, NULL, &proc_iomem_operations);
69868+#endif
69869 return 0;
69870 }
69871 __initcall(ioresources_init);
69872diff -urNp linux-2.6.39/kernel/rtmutex-tester.c linux-2.6.39/kernel/rtmutex-tester.c
69873--- linux-2.6.39/kernel/rtmutex-tester.c 2011-05-19 00:06:34.000000000 -0400
69874+++ linux-2.6.39/kernel/rtmutex-tester.c 2011-05-22 19:36:33.000000000 -0400
69875@@ -20,7 +20,7 @@
69876 #define MAX_RT_TEST_MUTEXES 8
69877
69878 static spinlock_t rttest_lock;
69879-static atomic_t rttest_event;
69880+static atomic_unchecked_t rttest_event;
69881
69882 struct test_thread_data {
69883 int opcode;
69884@@ -61,7 +61,7 @@ static int handle_op(struct test_thread_
69885
69886 case RTTEST_LOCKCONT:
69887 td->mutexes[td->opdata] = 1;
69888- td->event = atomic_add_return(1, &rttest_event);
69889+ td->event = atomic_add_return_unchecked(1, &rttest_event);
69890 return 0;
69891
69892 case RTTEST_RESET:
69893@@ -74,7 +74,7 @@ static int handle_op(struct test_thread_
69894 return 0;
69895
69896 case RTTEST_RESETEVENT:
69897- atomic_set(&rttest_event, 0);
69898+ atomic_set_unchecked(&rttest_event, 0);
69899 return 0;
69900
69901 default:
69902@@ -91,9 +91,9 @@ static int handle_op(struct test_thread_
69903 return ret;
69904
69905 td->mutexes[id] = 1;
69906- td->event = atomic_add_return(1, &rttest_event);
69907+ td->event = atomic_add_return_unchecked(1, &rttest_event);
69908 rt_mutex_lock(&mutexes[id]);
69909- td->event = atomic_add_return(1, &rttest_event);
69910+ td->event = atomic_add_return_unchecked(1, &rttest_event);
69911 td->mutexes[id] = 4;
69912 return 0;
69913
69914@@ -104,9 +104,9 @@ static int handle_op(struct test_thread_
69915 return ret;
69916
69917 td->mutexes[id] = 1;
69918- td->event = atomic_add_return(1, &rttest_event);
69919+ td->event = atomic_add_return_unchecked(1, &rttest_event);
69920 ret = rt_mutex_lock_interruptible(&mutexes[id], 0);
69921- td->event = atomic_add_return(1, &rttest_event);
69922+ td->event = atomic_add_return_unchecked(1, &rttest_event);
69923 td->mutexes[id] = ret ? 0 : 4;
69924 return ret ? -EINTR : 0;
69925
69926@@ -115,9 +115,9 @@ static int handle_op(struct test_thread_
69927 if (id < 0 || id >= MAX_RT_TEST_MUTEXES || td->mutexes[id] != 4)
69928 return ret;
69929
69930- td->event = atomic_add_return(1, &rttest_event);
69931+ td->event = atomic_add_return_unchecked(1, &rttest_event);
69932 rt_mutex_unlock(&mutexes[id]);
69933- td->event = atomic_add_return(1, &rttest_event);
69934+ td->event = atomic_add_return_unchecked(1, &rttest_event);
69935 td->mutexes[id] = 0;
69936 return 0;
69937
69938@@ -164,7 +164,7 @@ void schedule_rt_mutex_test(struct rt_mu
69939 break;
69940
69941 td->mutexes[dat] = 2;
69942- td->event = atomic_add_return(1, &rttest_event);
69943+ td->event = atomic_add_return_unchecked(1, &rttest_event);
69944 break;
69945
69946 default:
69947@@ -184,7 +184,7 @@ void schedule_rt_mutex_test(struct rt_mu
69948 return;
69949
69950 td->mutexes[dat] = 3;
69951- td->event = atomic_add_return(1, &rttest_event);
69952+ td->event = atomic_add_return_unchecked(1, &rttest_event);
69953 break;
69954
69955 case RTTEST_LOCKNOWAIT:
69956@@ -196,7 +196,7 @@ void schedule_rt_mutex_test(struct rt_mu
69957 return;
69958
69959 td->mutexes[dat] = 1;
69960- td->event = atomic_add_return(1, &rttest_event);
69961+ td->event = atomic_add_return_unchecked(1, &rttest_event);
69962 return;
69963
69964 default:
69965diff -urNp linux-2.6.39/kernel/sched_autogroup.c linux-2.6.39/kernel/sched_autogroup.c
69966--- linux-2.6.39/kernel/sched_autogroup.c 2011-05-19 00:06:34.000000000 -0400
69967+++ linux-2.6.39/kernel/sched_autogroup.c 2011-05-22 19:36:33.000000000 -0400
69968@@ -7,7 +7,7 @@
69969
69970 unsigned int __read_mostly sysctl_sched_autogroup_enabled = 1;
69971 static struct autogroup autogroup_default;
69972-static atomic_t autogroup_seq_nr;
69973+static atomic_unchecked_t autogroup_seq_nr;
69974
69975 static void __init autogroup_init(struct task_struct *init_task)
69976 {
69977@@ -78,7 +78,7 @@ static inline struct autogroup *autogrou
69978
69979 kref_init(&ag->kref);
69980 init_rwsem(&ag->lock);
69981- ag->id = atomic_inc_return(&autogroup_seq_nr);
69982+ ag->id = atomic_inc_return_unchecked(&autogroup_seq_nr);
69983 ag->tg = tg;
69984 #ifdef CONFIG_RT_GROUP_SCHED
69985 /*
69986diff -urNp linux-2.6.39/kernel/sched.c linux-2.6.39/kernel/sched.c
69987--- linux-2.6.39/kernel/sched.c 2011-05-19 00:06:34.000000000 -0400
69988+++ linux-2.6.39/kernel/sched.c 2011-05-23 17:07:00.000000000 -0400
69989@@ -4078,6 +4078,8 @@ asmlinkage void __sched schedule(void)
69990 struct rq *rq;
69991 int cpu;
69992
69993+ pax_track_stack();
69994+
69995 need_resched:
69996 preempt_disable();
69997 cpu = smp_processor_id();
69998@@ -4165,7 +4167,7 @@ EXPORT_SYMBOL(schedule);
69999 * Look out! "owner" is an entirely speculative pointer
70000 * access and not reliable.
70001 */
70002-int mutex_spin_on_owner(struct mutex *lock, struct thread_info *owner)
70003+int mutex_spin_on_owner(struct mutex *lock, struct task_struct *owner)
70004 {
70005 unsigned int cpu;
70006 struct rq *rq;
70007@@ -4179,10 +4181,10 @@ int mutex_spin_on_owner(struct mutex *lo
70008 * DEBUG_PAGEALLOC could have unmapped it if
70009 * the mutex owner just released it and exited.
70010 */
70011- if (probe_kernel_address(&owner->cpu, cpu))
70012+ if (probe_kernel_address(&task_thread_info(owner)->cpu, cpu))
70013 return 0;
70014 #else
70015- cpu = owner->cpu;
70016+ cpu = task_thread_info(owner)->cpu;
70017 #endif
70018
70019 /*
70020@@ -4219,7 +4221,7 @@ int mutex_spin_on_owner(struct mutex *lo
70021 /*
70022 * Is that owner really running on that cpu?
70023 */
70024- if (task_thread_info(rq->curr) != owner || need_resched())
70025+ if (rq->curr != owner || need_resched())
70026 return 0;
70027
70028 arch_mutex_cpu_relax();
70029@@ -4778,6 +4780,8 @@ int can_nice(const struct task_struct *p
70030 /* convert nice value [19,-20] to rlimit style value [1,40] */
70031 int nice_rlim = 20 - nice;
70032
70033+ gr_learn_resource(p, RLIMIT_NICE, nice_rlim, 1);
70034+
70035 return (nice_rlim <= task_rlimit(p, RLIMIT_NICE) ||
70036 capable(CAP_SYS_NICE));
70037 }
70038@@ -4811,7 +4815,8 @@ SYSCALL_DEFINE1(nice, int, increment)
70039 if (nice > 19)
70040 nice = 19;
70041
70042- if (increment < 0 && !can_nice(current, nice))
70043+ if (increment < 0 && (!can_nice(current, nice) ||
70044+ gr_handle_chroot_nice()))
70045 return -EPERM;
70046
70047 retval = security_task_setnice(current, nice);
70048@@ -4957,6 +4962,7 @@ recheck:
70049 unsigned long rlim_rtprio =
70050 task_rlimit(p, RLIMIT_RTPRIO);
70051
70052+ gr_learn_resource(p, RLIMIT_RTPRIO, param->sched_priority, 1);
70053 /* can't set/change the rt policy */
70054 if (policy != p->policy && !rlim_rtprio)
70055 return -EPERM;
70056@@ -7164,7 +7170,7 @@ static void init_sched_groups_power(int
70057 long power;
70058 int weight;
70059
70060- WARN_ON(!sd || !sd->groups);
70061+ BUG_ON(!sd || !sd->groups);
70062
70063 if (cpu != group_first_cpu(sd->groups))
70064 return;
70065diff -urNp linux-2.6.39/kernel/sched_fair.c linux-2.6.39/kernel/sched_fair.c
70066--- linux-2.6.39/kernel/sched_fair.c 2011-05-19 00:06:34.000000000 -0400
70067+++ linux-2.6.39/kernel/sched_fair.c 2011-05-22 19:36:33.000000000 -0400
70068@@ -3999,7 +3999,7 @@ static void nohz_idle_balance(int this_c
70069 * run_rebalance_domains is triggered when needed from the scheduler tick.
70070 * Also triggered for nohz idle balancing (with nohz_balancing_kick set).
70071 */
70072-static void run_rebalance_domains(struct softirq_action *h)
70073+static void run_rebalance_domains(void)
70074 {
70075 int this_cpu = smp_processor_id();
70076 struct rq *this_rq = cpu_rq(this_cpu);
70077diff -urNp linux-2.6.39/kernel/signal.c linux-2.6.39/kernel/signal.c
70078--- linux-2.6.39/kernel/signal.c 2011-05-19 00:06:34.000000000 -0400
70079+++ linux-2.6.39/kernel/signal.c 2011-05-23 17:07:00.000000000 -0400
70080@@ -45,12 +45,12 @@ static struct kmem_cache *sigqueue_cache
70081
70082 int print_fatal_signals __read_mostly;
70083
70084-static void __user *sig_handler(struct task_struct *t, int sig)
70085+static __sighandler_t sig_handler(struct task_struct *t, int sig)
70086 {
70087 return t->sighand->action[sig - 1].sa.sa_handler;
70088 }
70089
70090-static int sig_handler_ignored(void __user *handler, int sig)
70091+static int sig_handler_ignored(__sighandler_t handler, int sig)
70092 {
70093 /* Is it explicitly or implicitly ignored? */
70094 return handler == SIG_IGN ||
70095@@ -60,7 +60,7 @@ static int sig_handler_ignored(void __us
70096 static int sig_task_ignored(struct task_struct *t, int sig,
70097 int from_ancestor_ns)
70098 {
70099- void __user *handler;
70100+ __sighandler_t handler;
70101
70102 handler = sig_handler(t, sig);
70103
70104@@ -243,6 +243,9 @@ __sigqueue_alloc(int sig, struct task_st
70105 atomic_inc(&user->sigpending);
70106 rcu_read_unlock();
70107
70108+ if (!override_rlimit)
70109+ gr_learn_resource(t, RLIMIT_SIGPENDING, atomic_read(&user->sigpending), 1);
70110+
70111 if (override_rlimit ||
70112 atomic_read(&user->sigpending) <=
70113 task_rlimit(t, RLIMIT_SIGPENDING)) {
70114@@ -367,7 +370,7 @@ flush_signal_handlers(struct task_struct
70115
70116 int unhandled_signal(struct task_struct *tsk, int sig)
70117 {
70118- void __user *handler = tsk->sighand->action[sig-1].sa.sa_handler;
70119+ __sighandler_t handler = tsk->sighand->action[sig-1].sa.sa_handler;
70120 if (is_global_init(tsk))
70121 return 1;
70122 if (handler != SIG_IGN && handler != SIG_DFL)
70123@@ -693,6 +696,9 @@ static int check_kill_permission(int sig
70124 }
70125 }
70126
70127+ if (gr_handle_signal(t, sig))
70128+ return -EPERM;
70129+
70130 return security_task_kill(t, info, sig, 0);
70131 }
70132
70133@@ -1041,7 +1047,7 @@ __group_send_sig_info(int sig, struct si
70134 return send_signal(sig, info, p, 1);
70135 }
70136
70137-static int
70138+int
70139 specific_send_sig_info(int sig, struct siginfo *info, struct task_struct *t)
70140 {
70141 return send_signal(sig, info, t, 0);
70142@@ -1078,6 +1084,7 @@ force_sig_info(int sig, struct siginfo *
70143 unsigned long int flags;
70144 int ret, blocked, ignored;
70145 struct k_sigaction *action;
70146+ int is_unhandled = 0;
70147
70148 spin_lock_irqsave(&t->sighand->siglock, flags);
70149 action = &t->sighand->action[sig-1];
70150@@ -1092,9 +1099,18 @@ force_sig_info(int sig, struct siginfo *
70151 }
70152 if (action->sa.sa_handler == SIG_DFL)
70153 t->signal->flags &= ~SIGNAL_UNKILLABLE;
70154+ if (action->sa.sa_handler == SIG_IGN || action->sa.sa_handler == SIG_DFL)
70155+ is_unhandled = 1;
70156 ret = specific_send_sig_info(sig, info, t);
70157 spin_unlock_irqrestore(&t->sighand->siglock, flags);
70158
70159+ /* only deal with unhandled signals, java etc trigger SIGSEGV during
70160+ normal operation */
70161+ if (is_unhandled) {
70162+ gr_log_signal(sig, !is_si_special(info) ? info->si_addr : NULL, t);
70163+ gr_handle_crash(t, sig);
70164+ }
70165+
70166 return ret;
70167 }
70168
70169@@ -1153,8 +1169,11 @@ int group_send_sig_info(int sig, struct
70170 ret = check_kill_permission(sig, info, p);
70171 rcu_read_unlock();
70172
70173- if (!ret && sig)
70174+ if (!ret && sig) {
70175 ret = do_send_sig_info(sig, info, p, true);
70176+ if (!ret)
70177+ gr_log_signal(sig, !is_si_special(info) ? info->si_addr : NULL, p);
70178+ }
70179
70180 return ret;
70181 }
70182@@ -1718,6 +1737,8 @@ void ptrace_notify(int exit_code)
70183 {
70184 siginfo_t info;
70185
70186+ pax_track_stack();
70187+
70188 BUG_ON((exit_code & (0x7f | ~0xffff)) != SIGTRAP);
70189
70190 memset(&info, 0, sizeof info);
70191diff -urNp linux-2.6.39/kernel/smp.c linux-2.6.39/kernel/smp.c
70192--- linux-2.6.39/kernel/smp.c 2011-05-19 00:06:34.000000000 -0400
70193+++ linux-2.6.39/kernel/smp.c 2011-05-22 19:36:33.000000000 -0400
70194@@ -583,22 +583,22 @@ int smp_call_function(smp_call_func_t fu
70195 }
70196 EXPORT_SYMBOL(smp_call_function);
70197
70198-void ipi_call_lock(void)
70199+void ipi_call_lock(void) __acquires(call_function.lock)
70200 {
70201 raw_spin_lock(&call_function.lock);
70202 }
70203
70204-void ipi_call_unlock(void)
70205+void ipi_call_unlock(void) __releases(call_function.lock)
70206 {
70207 raw_spin_unlock(&call_function.lock);
70208 }
70209
70210-void ipi_call_lock_irq(void)
70211+void ipi_call_lock_irq(void) __acquires(call_function.lock)
70212 {
70213 raw_spin_lock_irq(&call_function.lock);
70214 }
70215
70216-void ipi_call_unlock_irq(void)
70217+void ipi_call_unlock_irq(void) __releases(call_function.lock)
70218 {
70219 raw_spin_unlock_irq(&call_function.lock);
70220 }
70221diff -urNp linux-2.6.39/kernel/softirq.c linux-2.6.39/kernel/softirq.c
70222--- linux-2.6.39/kernel/softirq.c 2011-05-19 00:06:34.000000000 -0400
70223+++ linux-2.6.39/kernel/softirq.c 2011-05-22 19:36:33.000000000 -0400
70224@@ -56,7 +56,7 @@ static struct softirq_action softirq_vec
70225
70226 DEFINE_PER_CPU(struct task_struct *, ksoftirqd);
70227
70228-char *softirq_to_name[NR_SOFTIRQS] = {
70229+const char * const softirq_to_name[NR_SOFTIRQS] = {
70230 "HI", "TIMER", "NET_TX", "NET_RX", "BLOCK", "BLOCK_IOPOLL",
70231 "TASKLET", "SCHED", "HRTIMER", "RCU"
70232 };
70233@@ -206,7 +206,7 @@ EXPORT_SYMBOL(local_bh_enable_ip);
70234
70235 asmlinkage void __do_softirq(void)
70236 {
70237- struct softirq_action *h;
70238+ const struct softirq_action *h;
70239 __u32 pending;
70240 int max_restart = MAX_SOFTIRQ_RESTART;
70241 int cpu;
70242@@ -235,7 +235,7 @@ restart:
70243 kstat_incr_softirqs_this_cpu(vec_nr);
70244
70245 trace_softirq_entry(vec_nr);
70246- h->action(h);
70247+ h->action();
70248 trace_softirq_exit(vec_nr);
70249 if (unlikely(prev_count != preempt_count())) {
70250 printk(KERN_ERR "huh, entered softirq %u %s %p"
70251@@ -377,7 +377,7 @@ void raise_softirq(unsigned int nr)
70252 local_irq_restore(flags);
70253 }
70254
70255-void open_softirq(int nr, void (*action)(struct softirq_action *))
70256+void open_softirq(int nr, void (*action)(void))
70257 {
70258 softirq_vec[nr].action = action;
70259 }
70260@@ -433,7 +433,7 @@ void __tasklet_hi_schedule_first(struct
70261
70262 EXPORT_SYMBOL(__tasklet_hi_schedule_first);
70263
70264-static void tasklet_action(struct softirq_action *a)
70265+static void tasklet_action(void)
70266 {
70267 struct tasklet_struct *list;
70268
70269@@ -468,7 +468,7 @@ static void tasklet_action(struct softir
70270 }
70271 }
70272
70273-static void tasklet_hi_action(struct softirq_action *a)
70274+static void tasklet_hi_action(void)
70275 {
70276 struct tasklet_struct *list;
70277
70278diff -urNp linux-2.6.39/kernel/sys.c linux-2.6.39/kernel/sys.c
70279--- linux-2.6.39/kernel/sys.c 2011-05-19 00:06:34.000000000 -0400
70280+++ linux-2.6.39/kernel/sys.c 2011-05-22 21:08:10.000000000 -0400
70281@@ -154,6 +154,12 @@ static int set_one_prio(struct task_stru
70282 error = -EACCES;
70283 goto out;
70284 }
70285+
70286+ if (gr_handle_chroot_setpriority(p, niceval)) {
70287+ error = -EACCES;
70288+ goto out;
70289+ }
70290+
70291 no_nice = security_task_setnice(p, niceval);
70292 if (no_nice) {
70293 error = no_nice;
70294@@ -538,6 +544,9 @@ SYSCALL_DEFINE2(setregid, gid_t, rgid, g
70295 goto error;
70296 }
70297
70298+ if (gr_check_group_change(new->gid, new->egid, -1))
70299+ goto error;
70300+
70301 if (rgid != (gid_t) -1 ||
70302 (egid != (gid_t) -1 && egid != old->gid))
70303 new->sgid = new->egid;
70304@@ -567,6 +576,10 @@ SYSCALL_DEFINE1(setgid, gid_t, gid)
70305 old = current_cred();
70306
70307 retval = -EPERM;
70308+
70309+ if (gr_check_group_change(gid, gid, gid))
70310+ goto error;
70311+
70312 if (nsown_capable(CAP_SETGID))
70313 new->gid = new->egid = new->sgid = new->fsgid = gid;
70314 else if (gid == old->gid || gid == old->sgid)
70315@@ -647,6 +660,9 @@ SYSCALL_DEFINE2(setreuid, uid_t, ruid, u
70316 goto error;
70317 }
70318
70319+ if (gr_check_user_change(new->uid, new->euid, -1))
70320+ goto error;
70321+
70322 if (new->uid != old->uid) {
70323 retval = set_user(new);
70324 if (retval < 0)
70325@@ -691,6 +707,12 @@ SYSCALL_DEFINE1(setuid, uid_t, uid)
70326 old = current_cred();
70327
70328 retval = -EPERM;
70329+
70330+ if (gr_check_crash_uid(uid))
70331+ goto error;
70332+ if (gr_check_user_change(uid, uid, uid))
70333+ goto error;
70334+
70335 if (nsown_capable(CAP_SETUID)) {
70336 new->suid = new->uid = uid;
70337 if (uid != old->uid) {
70338@@ -745,6 +767,9 @@ SYSCALL_DEFINE3(setresuid, uid_t, ruid,
70339 goto error;
70340 }
70341
70342+ if (gr_check_user_change(ruid, euid, -1))
70343+ goto error;
70344+
70345 if (ruid != (uid_t) -1) {
70346 new->uid = ruid;
70347 if (ruid != old->uid) {
70348@@ -809,6 +834,9 @@ SYSCALL_DEFINE3(setresgid, gid_t, rgid,
70349 goto error;
70350 }
70351
70352+ if (gr_check_group_change(rgid, egid, -1))
70353+ goto error;
70354+
70355 if (rgid != (gid_t) -1)
70356 new->gid = rgid;
70357 if (egid != (gid_t) -1)
70358@@ -855,6 +883,9 @@ SYSCALL_DEFINE1(setfsuid, uid_t, uid)
70359 old = current_cred();
70360 old_fsuid = old->fsuid;
70361
70362+ if (gr_check_user_change(-1, -1, uid))
70363+ goto error;
70364+
70365 if (uid == old->uid || uid == old->euid ||
70366 uid == old->suid || uid == old->fsuid ||
70367 nsown_capable(CAP_SETUID)) {
70368@@ -865,6 +896,7 @@ SYSCALL_DEFINE1(setfsuid, uid_t, uid)
70369 }
70370 }
70371
70372+error:
70373 abort_creds(new);
70374 return old_fsuid;
70375
70376@@ -891,12 +923,16 @@ SYSCALL_DEFINE1(setfsgid, gid_t, gid)
70377 if (gid == old->gid || gid == old->egid ||
70378 gid == old->sgid || gid == old->fsgid ||
70379 nsown_capable(CAP_SETGID)) {
70380+ if (gr_check_group_change(-1, -1, gid))
70381+ goto error;
70382+
70383 if (gid != old_fsgid) {
70384 new->fsgid = gid;
70385 goto change_okay;
70386 }
70387 }
70388
70389+error:
70390 abort_creds(new);
70391 return old_fsgid;
70392
70393@@ -1643,7 +1679,7 @@ SYSCALL_DEFINE5(prctl, int, option, unsi
70394 error = get_dumpable(me->mm);
70395 break;
70396 case PR_SET_DUMPABLE:
70397- if (arg2 < 0 || arg2 > 1) {
70398+ if (arg2 > 1) {
70399 error = -EINVAL;
70400 break;
70401 }
70402diff -urNp linux-2.6.39/kernel/sysctl.c linux-2.6.39/kernel/sysctl.c
70403--- linux-2.6.39/kernel/sysctl.c 2011-05-19 00:06:34.000000000 -0400
70404+++ linux-2.6.39/kernel/sysctl.c 2011-05-22 20:23:10.000000000 -0400
70405@@ -84,6 +84,13 @@
70406
70407
70408 #if defined(CONFIG_SYSCTL)
70409+#include <linux/grsecurity.h>
70410+#include <linux/grinternal.h>
70411+
70412+extern __u32 gr_handle_sysctl(const ctl_table *table, const int op);
70413+extern int gr_handle_sysctl_mod(const char *dirname, const char *name,
70414+ const int op);
70415+extern int gr_handle_chroot_sysctl(const int op);
70416
70417 /* External variables not in a header file. */
70418 extern int sysctl_overcommit_memory;
70419@@ -196,6 +203,7 @@ static int sysrq_sysctl_handler(ctl_tabl
70420 }
70421
70422 #endif
70423+extern struct ctl_table grsecurity_table[];
70424
70425 static struct ctl_table root_table[];
70426 static struct ctl_table_root sysctl_table_root;
70427@@ -225,6 +233,20 @@ extern struct ctl_table epoll_table[];
70428 int sysctl_legacy_va_layout;
70429 #endif
70430
70431+#ifdef CONFIG_PAX_SOFTMODE
70432+static ctl_table pax_table[] = {
70433+ {
70434+ .procname = "softmode",
70435+ .data = &pax_softmode,
70436+ .maxlen = sizeof(unsigned int),
70437+ .mode = 0600,
70438+ .proc_handler = &proc_dointvec,
70439+ },
70440+
70441+ { }
70442+};
70443+#endif
70444+
70445 /* The default sysctl tables: */
70446
70447 static struct ctl_table root_table[] = {
70448@@ -271,6 +293,22 @@ static int max_extfrag_threshold = 1000;
70449 #endif
70450
70451 static struct ctl_table kern_table[] = {
70452+#if defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_ROFS)
70453+ {
70454+ .procname = "grsecurity",
70455+ .mode = 0500,
70456+ .child = grsecurity_table,
70457+ },
70458+#endif
70459+
70460+#ifdef CONFIG_PAX_SOFTMODE
70461+ {
70462+ .procname = "pax",
70463+ .mode = 0500,
70464+ .child = pax_table,
70465+ },
70466+#endif
70467+
70468 {
70469 .procname = "sched_child_runs_first",
70470 .data = &sysctl_sched_child_runs_first,
70471@@ -545,7 +583,7 @@ static struct ctl_table kern_table[] = {
70472 .data = &modprobe_path,
70473 .maxlen = KMOD_PATH_LEN,
70474 .mode = 0644,
70475- .proc_handler = proc_dostring,
70476+ .proc_handler = proc_dostring_modpriv,
70477 },
70478 {
70479 .procname = "modules_disabled",
70480@@ -707,16 +745,20 @@ static struct ctl_table kern_table[] = {
70481 .extra1 = &zero,
70482 .extra2 = &one,
70483 },
70484+#endif
70485 {
70486 .procname = "kptr_restrict",
70487 .data = &kptr_restrict,
70488 .maxlen = sizeof(int),
70489 .mode = 0644,
70490 .proc_handler = proc_dmesg_restrict,
70491+#ifdef CONFIG_GRKERNSEC_HIDESYM
70492+ .extra1 = &two,
70493+#else
70494 .extra1 = &zero,
70495+#endif
70496 .extra2 = &two,
70497 },
70498-#endif
70499 {
70500 .procname = "ngroups_max",
70501 .data = &ngroups_max,
70502@@ -1189,6 +1231,13 @@ static struct ctl_table vm_table[] = {
70503 .proc_handler = proc_dointvec_minmax,
70504 .extra1 = &zero,
70505 },
70506+ {
70507+ .procname = "heap_stack_gap",
70508+ .data = &sysctl_heap_stack_gap,
70509+ .maxlen = sizeof(sysctl_heap_stack_gap),
70510+ .mode = 0644,
70511+ .proc_handler = proc_doulongvec_minmax,
70512+ },
70513 #else
70514 {
70515 .procname = "nr_trim_pages",
70516@@ -1698,6 +1747,17 @@ static int test_perm(int mode, int op)
70517 int sysctl_perm(struct ctl_table_root *root, struct ctl_table *table, int op)
70518 {
70519 int mode;
70520+ int error;
70521+
70522+ if (table->parent != NULL && table->parent->procname != NULL &&
70523+ table->procname != NULL &&
70524+ gr_handle_sysctl_mod(table->parent->procname, table->procname, op))
70525+ return -EACCES;
70526+ if (gr_handle_chroot_sysctl(op))
70527+ return -EACCES;
70528+ error = gr_handle_sysctl(table, op);
70529+ if (error)
70530+ return error;
70531
70532 if (root->permissions)
70533 mode = root->permissions(root, current->nsproxy, table);
70534@@ -2102,6 +2162,16 @@ int proc_dostring(struct ctl_table *tabl
70535 buffer, lenp, ppos);
70536 }
70537
70538+int proc_dostring_modpriv(struct ctl_table *table, int write,
70539+ void __user *buffer, size_t *lenp, loff_t *ppos)
70540+{
70541+ if (write && !capable(CAP_SYS_MODULE))
70542+ return -EPERM;
70543+
70544+ return _proc_do_string(table->data, table->maxlen, write,
70545+ buffer, lenp, ppos);
70546+}
70547+
70548 static size_t proc_skip_spaces(char **buf)
70549 {
70550 size_t ret;
70551@@ -2207,6 +2277,8 @@ static int proc_put_long(void __user **b
70552 len = strlen(tmp);
70553 if (len > *size)
70554 len = *size;
70555+ if (len > sizeof(tmp))
70556+ len = sizeof(tmp);
70557 if (copy_to_user(*buf, tmp, len))
70558 return -EFAULT;
70559 *size -= len;
70560@@ -2523,8 +2595,11 @@ static int __do_proc_doulongvec_minmax(v
70561 *i = val;
70562 } else {
70563 val = convdiv * (*i) / convmul;
70564- if (!first)
70565+ if (!first) {
70566 err = proc_put_char(&buffer, &left, '\t');
70567+ if (err)
70568+ break;
70569+ }
70570 err = proc_put_long(&buffer, &left, val, false);
70571 if (err)
70572 break;
70573@@ -2919,6 +2994,12 @@ int proc_dostring(struct ctl_table *tabl
70574 return -ENOSYS;
70575 }
70576
70577+int proc_dostring_modpriv(struct ctl_table *table, int write,
70578+ void __user *buffer, size_t *lenp, loff_t *ppos)
70579+{
70580+ return -ENOSYS;
70581+}
70582+
70583 int proc_dointvec(struct ctl_table *table, int write,
70584 void __user *buffer, size_t *lenp, loff_t *ppos)
70585 {
70586@@ -2975,6 +3056,7 @@ EXPORT_SYMBOL(proc_dointvec_minmax);
70587 EXPORT_SYMBOL(proc_dointvec_userhz_jiffies);
70588 EXPORT_SYMBOL(proc_dointvec_ms_jiffies);
70589 EXPORT_SYMBOL(proc_dostring);
70590+EXPORT_SYMBOL(proc_dostring_modpriv);
70591 EXPORT_SYMBOL(proc_doulongvec_minmax);
70592 EXPORT_SYMBOL(proc_doulongvec_ms_jiffies_minmax);
70593 EXPORT_SYMBOL(register_sysctl_table);
70594diff -urNp linux-2.6.39/kernel/sysctl_check.c linux-2.6.39/kernel/sysctl_check.c
70595--- linux-2.6.39/kernel/sysctl_check.c 2011-05-19 00:06:34.000000000 -0400
70596+++ linux-2.6.39/kernel/sysctl_check.c 2011-05-22 19:41:42.000000000 -0400
70597@@ -129,6 +129,7 @@ int sysctl_check_table(struct nsproxy *n
70598 set_fail(&fail, table, "Directory with extra2");
70599 } else {
70600 if ((table->proc_handler == proc_dostring) ||
70601+ (table->proc_handler == proc_dostring_modpriv) ||
70602 (table->proc_handler == proc_dointvec) ||
70603 (table->proc_handler == proc_dointvec_minmax) ||
70604 (table->proc_handler == proc_dointvec_jiffies) ||
70605diff -urNp linux-2.6.39/kernel/taskstats.c linux-2.6.39/kernel/taskstats.c
70606--- linux-2.6.39/kernel/taskstats.c 2011-05-19 00:06:34.000000000 -0400
70607+++ linux-2.6.39/kernel/taskstats.c 2011-05-22 19:41:42.000000000 -0400
70608@@ -27,9 +27,12 @@
70609 #include <linux/cgroup.h>
70610 #include <linux/fs.h>
70611 #include <linux/file.h>
70612+#include <linux/grsecurity.h>
70613 #include <net/genetlink.h>
70614 #include <asm/atomic.h>
70615
70616+extern int gr_is_taskstats_denied(int pid);
70617+
70618 /*
70619 * Maximum length of a cpumask that can be specified in
70620 * the TASKSTATS_CMD_ATTR_REGISTER/DEREGISTER_CPUMASK attribute
70621@@ -549,6 +552,9 @@ err:
70622
70623 static int taskstats_user_cmd(struct sk_buff *skb, struct genl_info *info)
70624 {
70625+ if (gr_is_taskstats_denied(current->pid))
70626+ return -EACCES;
70627+
70628 if (info->attrs[TASKSTATS_CMD_ATTR_REGISTER_CPUMASK])
70629 return cmd_attr_register_cpumask(info);
70630 else if (info->attrs[TASKSTATS_CMD_ATTR_DEREGISTER_CPUMASK])
70631diff -urNp linux-2.6.39/kernel/time/posix-clock.c linux-2.6.39/kernel/time/posix-clock.c
70632--- linux-2.6.39/kernel/time/posix-clock.c 2011-05-19 00:06:34.000000000 -0400
70633+++ linux-2.6.39/kernel/time/posix-clock.c 2011-05-22 19:36:33.000000000 -0400
70634@@ -433,7 +433,7 @@ static int pc_timer_settime(struct k_iti
70635 return err;
70636 }
70637
70638-struct k_clock clock_posix_dynamic = {
70639+const struct k_clock clock_posix_dynamic = {
70640 .clock_getres = pc_clock_getres,
70641 .clock_set = pc_clock_settime,
70642 .clock_get = pc_clock_gettime,
70643diff -urNp linux-2.6.39/kernel/time/tick-broadcast.c linux-2.6.39/kernel/time/tick-broadcast.c
70644--- linux-2.6.39/kernel/time/tick-broadcast.c 2011-05-19 00:06:34.000000000 -0400
70645+++ linux-2.6.39/kernel/time/tick-broadcast.c 2011-05-22 19:36:33.000000000 -0400
70646@@ -115,7 +115,7 @@ int tick_device_uses_broadcast(struct cl
70647 * then clear the broadcast bit.
70648 */
70649 if (!(dev->features & CLOCK_EVT_FEAT_C3STOP)) {
70650- int cpu = smp_processor_id();
70651+ cpu = smp_processor_id();
70652
70653 cpumask_clear_cpu(cpu, tick_get_broadcast_mask());
70654 tick_broadcast_clear_oneshot(cpu);
70655diff -urNp linux-2.6.39/kernel/time/timekeeping.c linux-2.6.39/kernel/time/timekeeping.c
70656--- linux-2.6.39/kernel/time/timekeeping.c 2011-05-19 00:06:34.000000000 -0400
70657+++ linux-2.6.39/kernel/time/timekeeping.c 2011-05-22 20:40:50.000000000 -0400
70658@@ -14,6 +14,7 @@
70659 #include <linux/init.h>
70660 #include <linux/mm.h>
70661 #include <linux/sched.h>
70662+#include <linux/grsecurity.h>
70663 #include <linux/syscore_ops.h>
70664 #include <linux/clocksource.h>
70665 #include <linux/jiffies.h>
70666@@ -361,6 +362,8 @@ int do_settimeofday(const struct timespe
70667 if ((unsigned long)tv->tv_nsec >= NSEC_PER_SEC)
70668 return -EINVAL;
70669
70670+ gr_log_timechange();
70671+
70672 write_seqlock_irqsave(&xtime_lock, flags);
70673
70674 timekeeping_forward_now();
70675diff -urNp linux-2.6.39/kernel/time/timer_list.c linux-2.6.39/kernel/time/timer_list.c
70676--- linux-2.6.39/kernel/time/timer_list.c 2011-05-19 00:06:34.000000000 -0400
70677+++ linux-2.6.39/kernel/time/timer_list.c 2011-05-22 19:41:42.000000000 -0400
70678@@ -38,12 +38,16 @@ DECLARE_PER_CPU(struct hrtimer_cpu_base,
70679
70680 static void print_name_offset(struct seq_file *m, void *sym)
70681 {
70682+#ifdef CONFIG_GRKERNSEC_HIDESYM
70683+ SEQ_printf(m, "<%p>", NULL);
70684+#else
70685 char symname[KSYM_NAME_LEN];
70686
70687 if (lookup_symbol_name((unsigned long)sym, symname) < 0)
70688 SEQ_printf(m, "<%pK>", sym);
70689 else
70690 SEQ_printf(m, "%s", symname);
70691+#endif
70692 }
70693
70694 static void
70695@@ -112,7 +116,11 @@ next_one:
70696 static void
70697 print_base(struct seq_file *m, struct hrtimer_clock_base *base, u64 now)
70698 {
70699+#ifdef CONFIG_GRKERNSEC_HIDESYM
70700+ SEQ_printf(m, " .base: %p\n", NULL);
70701+#else
70702 SEQ_printf(m, " .base: %pK\n", base);
70703+#endif
70704 SEQ_printf(m, " .index: %d\n",
70705 base->index);
70706 SEQ_printf(m, " .resolution: %Lu nsecs\n",
70707@@ -293,7 +301,11 @@ static int __init init_timer_list_procfs
70708 {
70709 struct proc_dir_entry *pe;
70710
70711+#ifdef CONFIG_GRKERNSEC_PROC_ADD
70712+ pe = proc_create("timer_list", 0400, NULL, &timer_list_fops);
70713+#else
70714 pe = proc_create("timer_list", 0444, NULL, &timer_list_fops);
70715+#endif
70716 if (!pe)
70717 return -ENOMEM;
70718 return 0;
70719diff -urNp linux-2.6.39/kernel/time/timer_stats.c linux-2.6.39/kernel/time/timer_stats.c
70720--- linux-2.6.39/kernel/time/timer_stats.c 2011-05-19 00:06:34.000000000 -0400
70721+++ linux-2.6.39/kernel/time/timer_stats.c 2011-05-22 19:41:42.000000000 -0400
70722@@ -116,7 +116,7 @@ static ktime_t time_start, time_stop;
70723 static unsigned long nr_entries;
70724 static struct entry entries[MAX_ENTRIES];
70725
70726-static atomic_t overflow_count;
70727+static atomic_unchecked_t overflow_count;
70728
70729 /*
70730 * The entries are in a hash-table, for fast lookup:
70731@@ -140,7 +140,7 @@ static void reset_entries(void)
70732 nr_entries = 0;
70733 memset(entries, 0, sizeof(entries));
70734 memset(tstat_hash_table, 0, sizeof(tstat_hash_table));
70735- atomic_set(&overflow_count, 0);
70736+ atomic_set_unchecked(&overflow_count, 0);
70737 }
70738
70739 static struct entry *alloc_entry(void)
70740@@ -261,7 +261,7 @@ void timer_stats_update_stats(void *time
70741 if (likely(entry))
70742 entry->count++;
70743 else
70744- atomic_inc(&overflow_count);
70745+ atomic_inc_unchecked(&overflow_count);
70746
70747 out_unlock:
70748 raw_spin_unlock_irqrestore(lock, flags);
70749@@ -269,12 +269,16 @@ void timer_stats_update_stats(void *time
70750
70751 static void print_name_offset(struct seq_file *m, unsigned long addr)
70752 {
70753+#ifdef CONFIG_GRKERNSEC_HIDESYM
70754+ seq_printf(m, "<%p>", NULL);
70755+#else
70756 char symname[KSYM_NAME_LEN];
70757
70758 if (lookup_symbol_name(addr, symname) < 0)
70759 seq_printf(m, "<%p>", (void *)addr);
70760 else
70761 seq_printf(m, "%s", symname);
70762+#endif
70763 }
70764
70765 static int tstats_show(struct seq_file *m, void *v)
70766@@ -300,9 +304,9 @@ static int tstats_show(struct seq_file *
70767
70768 seq_puts(m, "Timer Stats Version: v0.2\n");
70769 seq_printf(m, "Sample period: %ld.%03ld s\n", period.tv_sec, ms);
70770- if (atomic_read(&overflow_count))
70771+ if (atomic_read_unchecked(&overflow_count))
70772 seq_printf(m, "Overflow: %d entries\n",
70773- atomic_read(&overflow_count));
70774+ atomic_read_unchecked(&overflow_count));
70775
70776 for (i = 0; i < nr_entries; i++) {
70777 entry = entries + i;
70778@@ -417,7 +421,11 @@ static int __init init_tstats_procfs(voi
70779 {
70780 struct proc_dir_entry *pe;
70781
70782+#ifdef CONFIG_GRKERNSEC_PROC_ADD
70783+ pe = proc_create("timer_stats", 0600, NULL, &tstats_fops);
70784+#else
70785 pe = proc_create("timer_stats", 0644, NULL, &tstats_fops);
70786+#endif
70787 if (!pe)
70788 return -ENOMEM;
70789 return 0;
70790diff -urNp linux-2.6.39/kernel/time.c linux-2.6.39/kernel/time.c
70791--- linux-2.6.39/kernel/time.c 2011-05-19 00:06:34.000000000 -0400
70792+++ linux-2.6.39/kernel/time.c 2011-05-22 19:41:42.000000000 -0400
70793@@ -163,6 +163,11 @@ int do_sys_settimeofday(const struct tim
70794 return error;
70795
70796 if (tz) {
70797+ /* we log in do_settimeofday called below, so don't log twice
70798+ */
70799+ if (!tv)
70800+ gr_log_timechange();
70801+
70802 /* SMP safe, global irq locking makes it work. */
70803 sys_tz = *tz;
70804 update_vsyscall_tz();
70805diff -urNp linux-2.6.39/kernel/timer.c linux-2.6.39/kernel/timer.c
70806--- linux-2.6.39/kernel/timer.c 2011-05-19 00:06:34.000000000 -0400
70807+++ linux-2.6.39/kernel/timer.c 2011-05-22 19:36:33.000000000 -0400
70808@@ -1305,7 +1305,7 @@ void update_process_times(int user_tick)
70809 /*
70810 * This function runs timers and the timer-tq in bottom half context.
70811 */
70812-static void run_timer_softirq(struct softirq_action *h)
70813+static void run_timer_softirq(void)
70814 {
70815 struct tvec_base *base = __this_cpu_read(tvec_bases);
70816
70817diff -urNp linux-2.6.39/kernel/trace/blktrace.c linux-2.6.39/kernel/trace/blktrace.c
70818--- linux-2.6.39/kernel/trace/blktrace.c 2011-05-19 00:06:34.000000000 -0400
70819+++ linux-2.6.39/kernel/trace/blktrace.c 2011-05-22 19:36:33.000000000 -0400
70820@@ -321,7 +321,7 @@ static ssize_t blk_dropped_read(struct f
70821 struct blk_trace *bt = filp->private_data;
70822 char buf[16];
70823
70824- snprintf(buf, sizeof(buf), "%u\n", atomic_read(&bt->dropped));
70825+ snprintf(buf, sizeof(buf), "%u\n", atomic_read_unchecked(&bt->dropped));
70826
70827 return simple_read_from_buffer(buffer, count, ppos, buf, strlen(buf));
70828 }
70829@@ -386,7 +386,7 @@ static int blk_subbuf_start_callback(str
70830 return 1;
70831
70832 bt = buf->chan->private_data;
70833- atomic_inc(&bt->dropped);
70834+ atomic_inc_unchecked(&bt->dropped);
70835 return 0;
70836 }
70837
70838@@ -487,7 +487,7 @@ int do_blk_trace_setup(struct request_qu
70839
70840 bt->dir = dir;
70841 bt->dev = dev;
70842- atomic_set(&bt->dropped, 0);
70843+ atomic_set_unchecked(&bt->dropped, 0);
70844
70845 ret = -EIO;
70846 bt->dropped_file = debugfs_create_file("dropped", 0444, dir, bt,
70847diff -urNp linux-2.6.39/kernel/trace/ftrace.c linux-2.6.39/kernel/trace/ftrace.c
70848--- linux-2.6.39/kernel/trace/ftrace.c 2011-05-19 00:06:34.000000000 -0400
70849+++ linux-2.6.39/kernel/trace/ftrace.c 2011-05-22 19:36:33.000000000 -0400
70850@@ -1107,13 +1107,18 @@ ftrace_code_disable(struct module *mod,
70851
70852 ip = rec->ip;
70853
70854+ ret = ftrace_arch_code_modify_prepare();
70855+ FTRACE_WARN_ON(ret);
70856+ if (ret)
70857+ return 0;
70858+
70859 ret = ftrace_make_nop(mod, rec, MCOUNT_ADDR);
70860+ FTRACE_WARN_ON(ftrace_arch_code_modify_post_process());
70861 if (ret) {
70862 ftrace_bug(ret, ip);
70863 rec->flags |= FTRACE_FL_FAILED;
70864- return 0;
70865 }
70866- return 1;
70867+ return ret ? 0 : 1;
70868 }
70869
70870 /*
70871@@ -2011,7 +2016,7 @@ static void ftrace_free_entry_rcu(struct
70872
70873 int
70874 register_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops,
70875- void *data)
70876+ void *data)
70877 {
70878 struct ftrace_func_probe *entry;
70879 struct ftrace_page *pg;
70880@@ -2083,7 +2088,7 @@ enum {
70881 };
70882
70883 static void
70884-__unregister_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops,
70885+__unregister_ftrace_function_probe(char *glob, const struct ftrace_probe_ops *ops,
70886 void *data, int flags)
70887 {
70888 struct ftrace_func_probe *entry;
70889@@ -2144,7 +2149,7 @@ unregister_ftrace_function_probe(char *g
70890 }
70891
70892 void
70893-unregister_ftrace_function_probe_func(char *glob, struct ftrace_probe_ops *ops)
70894+unregister_ftrace_function_probe_func(char *glob, const struct ftrace_probe_ops *ops)
70895 {
70896 __unregister_ftrace_function_probe(glob, ops, NULL, PROBE_TEST_FUNC);
70897 }
70898diff -urNp linux-2.6.39/kernel/trace/trace.c linux-2.6.39/kernel/trace/trace.c
70899--- linux-2.6.39/kernel/trace/trace.c 2011-05-19 00:06:34.000000000 -0400
70900+++ linux-2.6.39/kernel/trace/trace.c 2011-05-22 19:36:33.000000000 -0400
70901@@ -3330,6 +3330,8 @@ static ssize_t tracing_splice_read_pipe(
70902 size_t rem;
70903 unsigned int i;
70904
70905+ pax_track_stack();
70906+
70907 if (splice_grow_spd(pipe, &spd))
70908 return -ENOMEM;
70909
70910@@ -3813,6 +3815,8 @@ tracing_buffers_splice_read(struct file
70911 int entries, size, i;
70912 size_t ret;
70913
70914+ pax_track_stack();
70915+
70916 if (splice_grow_spd(pipe, &spd))
70917 return -ENOMEM;
70918
70919@@ -3981,10 +3985,9 @@ static const struct file_operations trac
70920 };
70921 #endif
70922
70923-static struct dentry *d_tracer;
70924-
70925 struct dentry *tracing_init_dentry(void)
70926 {
70927+ static struct dentry *d_tracer;
70928 static int once;
70929
70930 if (d_tracer)
70931@@ -4004,10 +4007,9 @@ struct dentry *tracing_init_dentry(void)
70932 return d_tracer;
70933 }
70934
70935-static struct dentry *d_percpu;
70936-
70937 struct dentry *tracing_dentry_percpu(void)
70938 {
70939+ static struct dentry *d_percpu;
70940 static int once;
70941 struct dentry *d_tracer;
70942
70943diff -urNp linux-2.6.39/kernel/trace/trace_events.c linux-2.6.39/kernel/trace/trace_events.c
70944--- linux-2.6.39/kernel/trace/trace_events.c 2011-05-19 00:06:34.000000000 -0400
70945+++ linux-2.6.39/kernel/trace/trace_events.c 2011-05-22 19:36:33.000000000 -0400
70946@@ -1241,10 +1241,10 @@ static LIST_HEAD(ftrace_module_file_list
70947 struct ftrace_module_file_ops {
70948 struct list_head list;
70949 struct module *mod;
70950- struct file_operations id;
70951- struct file_operations enable;
70952- struct file_operations format;
70953- struct file_operations filter;
70954+ struct file_operations id; /* cannot be const, see trace_create_file_ops() */
70955+ struct file_operations enable; /* cannot be const, see trace_create_file_ops() */
70956+ struct file_operations format; /* cannot be const, see trace_create_file_ops() */
70957+ struct file_operations filter; /* cannot be const, see trace_create_file_ops() */
70958 };
70959
70960 static struct ftrace_module_file_ops *
70961diff -urNp linux-2.6.39/kernel/trace/trace_functions.c linux-2.6.39/kernel/trace/trace_functions.c
70962--- linux-2.6.39/kernel/trace/trace_functions.c 2011-05-19 00:06:34.000000000 -0400
70963+++ linux-2.6.39/kernel/trace/trace_functions.c 2011-05-22 19:36:33.000000000 -0400
70964@@ -308,7 +308,7 @@ ftrace_trace_onoff_print(struct seq_file
70965 static int
70966 ftrace_trace_onoff_unreg(char *glob, char *cmd, char *param)
70967 {
70968- struct ftrace_probe_ops *ops;
70969+ const struct ftrace_probe_ops *ops;
70970
70971 /* we register both traceon and traceoff to this callback */
70972 if (strcmp(cmd, "traceon") == 0)
70973diff -urNp linux-2.6.39/kernel/trace/trace_mmiotrace.c linux-2.6.39/kernel/trace/trace_mmiotrace.c
70974--- linux-2.6.39/kernel/trace/trace_mmiotrace.c 2011-05-19 00:06:34.000000000 -0400
70975+++ linux-2.6.39/kernel/trace/trace_mmiotrace.c 2011-05-22 19:36:33.000000000 -0400
70976@@ -24,7 +24,7 @@ struct header_iter {
70977 static struct trace_array *mmio_trace_array;
70978 static bool overrun_detected;
70979 static unsigned long prev_overruns;
70980-static atomic_t dropped_count;
70981+static atomic_unchecked_t dropped_count;
70982
70983 static void mmio_reset_data(struct trace_array *tr)
70984 {
70985@@ -127,7 +127,7 @@ static void mmio_close(struct trace_iter
70986
70987 static unsigned long count_overruns(struct trace_iterator *iter)
70988 {
70989- unsigned long cnt = atomic_xchg(&dropped_count, 0);
70990+ unsigned long cnt = atomic_xchg_unchecked(&dropped_count, 0);
70991 unsigned long over = ring_buffer_overruns(iter->tr->buffer);
70992
70993 if (over > prev_overruns)
70994@@ -317,7 +317,7 @@ static void __trace_mmiotrace_rw(struct
70995 event = trace_buffer_lock_reserve(buffer, TRACE_MMIO_RW,
70996 sizeof(*entry), 0, pc);
70997 if (!event) {
70998- atomic_inc(&dropped_count);
70999+ atomic_inc_unchecked(&dropped_count);
71000 return;
71001 }
71002 entry = ring_buffer_event_data(event);
71003@@ -347,7 +347,7 @@ static void __trace_mmiotrace_map(struct
71004 event = trace_buffer_lock_reserve(buffer, TRACE_MMIO_MAP,
71005 sizeof(*entry), 0, pc);
71006 if (!event) {
71007- atomic_inc(&dropped_count);
71008+ atomic_inc_unchecked(&dropped_count);
71009 return;
71010 }
71011 entry = ring_buffer_event_data(event);
71012diff -urNp linux-2.6.39/kernel/trace/trace_output.c linux-2.6.39/kernel/trace/trace_output.c
71013--- linux-2.6.39/kernel/trace/trace_output.c 2011-05-19 00:06:34.000000000 -0400
71014+++ linux-2.6.39/kernel/trace/trace_output.c 2011-05-22 19:36:33.000000000 -0400
71015@@ -278,7 +278,7 @@ int trace_seq_path(struct trace_seq *s,
71016
71017 p = d_path(path, s->buffer + s->len, PAGE_SIZE - s->len);
71018 if (!IS_ERR(p)) {
71019- p = mangle_path(s->buffer + s->len, p, "\n");
71020+ p = mangle_path(s->buffer + s->len, p, "\n\\");
71021 if (p) {
71022 s->len = p - s->buffer;
71023 return 1;
71024diff -urNp linux-2.6.39/kernel/trace/trace_stack.c linux-2.6.39/kernel/trace/trace_stack.c
71025--- linux-2.6.39/kernel/trace/trace_stack.c 2011-05-19 00:06:34.000000000 -0400
71026+++ linux-2.6.39/kernel/trace/trace_stack.c 2011-05-22 19:36:33.000000000 -0400
71027@@ -50,7 +50,7 @@ static inline void check_stack(void)
71028 return;
71029
71030 /* we do not handle interrupt stacks yet */
71031- if (!object_is_on_stack(&this_size))
71032+ if (!object_starts_on_stack(&this_size))
71033 return;
71034
71035 local_irq_save(flags);
71036diff -urNp linux-2.6.39/kernel/trace/trace_workqueue.c linux-2.6.39/kernel/trace/trace_workqueue.c
71037--- linux-2.6.39/kernel/trace/trace_workqueue.c 2011-05-19 00:06:34.000000000 -0400
71038+++ linux-2.6.39/kernel/trace/trace_workqueue.c 2011-05-22 19:36:33.000000000 -0400
71039@@ -22,7 +22,7 @@ struct cpu_workqueue_stats {
71040 int cpu;
71041 pid_t pid;
71042 /* Can be inserted from interrupt or user context, need to be atomic */
71043- atomic_t inserted;
71044+ atomic_unchecked_t inserted;
71045 /*
71046 * Don't need to be atomic, works are serialized in a single workqueue thread
71047 * on a single CPU.
71048@@ -60,7 +60,7 @@ probe_workqueue_insertion(void *ignore,
71049 spin_lock_irqsave(&workqueue_cpu_stat(cpu)->lock, flags);
71050 list_for_each_entry(node, &workqueue_cpu_stat(cpu)->list, list) {
71051 if (node->pid == wq_thread->pid) {
71052- atomic_inc(&node->inserted);
71053+ atomic_inc_unchecked(&node->inserted);
71054 goto found;
71055 }
71056 }
71057@@ -210,7 +210,7 @@ static int workqueue_stat_show(struct se
71058 tsk = get_pid_task(pid, PIDTYPE_PID);
71059 if (tsk) {
71060 seq_printf(s, "%3d %6d %6u %s\n", cws->cpu,
71061- atomic_read(&cws->inserted), cws->executed,
71062+ atomic_read_unchecked(&cws->inserted), cws->executed,
71063 tsk->comm);
71064 put_task_struct(tsk);
71065 }
71066diff -urNp linux-2.6.39/lib/bug.c linux-2.6.39/lib/bug.c
71067--- linux-2.6.39/lib/bug.c 2011-05-19 00:06:34.000000000 -0400
71068+++ linux-2.6.39/lib/bug.c 2011-05-22 19:36:33.000000000 -0400
71069@@ -133,6 +133,8 @@ enum bug_trap_type report_bug(unsigned l
71070 return BUG_TRAP_TYPE_NONE;
71071
71072 bug = find_bug(bugaddr);
71073+ if (!bug)
71074+ return BUG_TRAP_TYPE_NONE;
71075
71076 file = NULL;
71077 line = 0;
71078diff -urNp linux-2.6.39/lib/debugobjects.c linux-2.6.39/lib/debugobjects.c
71079--- linux-2.6.39/lib/debugobjects.c 2011-05-19 00:06:34.000000000 -0400
71080+++ linux-2.6.39/lib/debugobjects.c 2011-05-22 19:36:33.000000000 -0400
71081@@ -284,7 +284,7 @@ static void debug_object_is_on_stack(voi
71082 if (limit > 4)
71083 return;
71084
71085- is_on_stack = object_is_on_stack(addr);
71086+ is_on_stack = object_starts_on_stack(addr);
71087 if (is_on_stack == onstack)
71088 return;
71089
71090diff -urNp linux-2.6.39/lib/dma-debug.c linux-2.6.39/lib/dma-debug.c
71091--- linux-2.6.39/lib/dma-debug.c 2011-05-19 00:06:34.000000000 -0400
71092+++ linux-2.6.39/lib/dma-debug.c 2011-05-22 19:36:33.000000000 -0400
71093@@ -862,7 +862,7 @@ out:
71094
71095 static void check_for_stack(struct device *dev, void *addr)
71096 {
71097- if (object_is_on_stack(addr))
71098+ if (object_starts_on_stack(addr))
71099 err_printk(dev, NULL, "DMA-API: device driver maps memory from"
71100 "stack [addr=%p]\n", addr);
71101 }
71102diff -urNp linux-2.6.39/lib/inflate.c linux-2.6.39/lib/inflate.c
71103--- linux-2.6.39/lib/inflate.c 2011-05-19 00:06:34.000000000 -0400
71104+++ linux-2.6.39/lib/inflate.c 2011-05-22 19:36:33.000000000 -0400
71105@@ -269,7 +269,7 @@ static void free(void *where)
71106 malloc_ptr = free_mem_ptr;
71107 }
71108 #else
71109-#define malloc(a) kmalloc(a, GFP_KERNEL)
71110+#define malloc(a) kmalloc((a), GFP_KERNEL)
71111 #define free(a) kfree(a)
71112 #endif
71113
71114diff -urNp linux-2.6.39/lib/Kconfig.debug linux-2.6.39/lib/Kconfig.debug
71115--- linux-2.6.39/lib/Kconfig.debug 2011-05-19 00:06:34.000000000 -0400
71116+++ linux-2.6.39/lib/Kconfig.debug 2011-05-22 19:41:42.000000000 -0400
71117@@ -1078,6 +1078,7 @@ config LATENCYTOP
71118 depends on DEBUG_KERNEL
71119 depends on STACKTRACE_SUPPORT
71120 depends on PROC_FS
71121+ depends on !GRKERNSEC_HIDESYM
71122 select FRAME_POINTER if !MIPS && !PPC && !S390 && !MICROBLAZE
71123 select KALLSYMS
71124 select KALLSYMS_ALL
71125diff -urNp linux-2.6.39/lib/kref.c linux-2.6.39/lib/kref.c
71126--- linux-2.6.39/lib/kref.c 2011-05-19 00:06:34.000000000 -0400
71127+++ linux-2.6.39/lib/kref.c 2011-05-22 19:36:33.000000000 -0400
71128@@ -52,7 +52,7 @@ void kref_get(struct kref *kref)
71129 */
71130 int kref_put(struct kref *kref, void (*release)(struct kref *kref))
71131 {
71132- WARN_ON(release == NULL);
71133+ BUG_ON(release == NULL);
71134 WARN_ON(release == (void (*)(struct kref *))kfree);
71135
71136 if (atomic_dec_and_test(&kref->refcount)) {
71137diff -urNp linux-2.6.39/lib/radix-tree.c linux-2.6.39/lib/radix-tree.c
71138--- linux-2.6.39/lib/radix-tree.c 2011-05-19 00:06:34.000000000 -0400
71139+++ linux-2.6.39/lib/radix-tree.c 2011-05-22 19:36:33.000000000 -0400
71140@@ -80,7 +80,7 @@ struct radix_tree_preload {
71141 int nr;
71142 struct radix_tree_node *nodes[RADIX_TREE_MAX_PATH];
71143 };
71144-static DEFINE_PER_CPU(struct radix_tree_preload, radix_tree_preloads) = { 0, };
71145+static DEFINE_PER_CPU(struct radix_tree_preload, radix_tree_preloads);
71146
71147 static inline void *ptr_to_indirect(void *ptr)
71148 {
71149diff -urNp linux-2.6.39/lib/vsprintf.c linux-2.6.39/lib/vsprintf.c
71150--- linux-2.6.39/lib/vsprintf.c 2011-05-19 00:06:34.000000000 -0400
71151+++ linux-2.6.39/lib/vsprintf.c 2011-05-22 20:54:59.000000000 -0400
71152@@ -16,6 +16,9 @@
71153 * - scnprintf and vscnprintf
71154 */
71155
71156+#ifdef CONFIG_GRKERNSEC_HIDESYM
71157+#define __INCLUDED_BY_HIDESYM 1
71158+#endif
71159 #include <stdarg.h>
71160 #include <linux/module.h>
71161 #include <linux/types.h>
71162@@ -435,7 +438,7 @@ char *symbol_string(char *buf, char *end
71163 char sym[KSYM_SYMBOL_LEN];
71164 if (ext == 'B')
71165 sprint_backtrace(sym, value);
71166- else if (ext != 'f' && ext != 's')
71167+ else if (ext != 'f' && ext != 's' && ext != 'a')
71168 sprint_symbol(sym, value);
71169 else
71170 kallsyms_lookup(value, NULL, NULL, NULL, sym);
71171@@ -797,7 +800,11 @@ char *uuid_string(char *buf, char *end,
71172 return string(buf, end, uuid, spec);
71173 }
71174
71175+#ifdef CONFIG_GRKERNSEC_HIDESYM
71176+int kptr_restrict __read_mostly = 2;
71177+#else
71178 int kptr_restrict __read_mostly;
71179+#endif
71180
71181 /*
71182 * Show a '%p' thing. A kernel extension is that the '%p' is followed
71183@@ -811,6 +818,8 @@ int kptr_restrict __read_mostly;
71184 * - 'S' For symbolic direct pointers with offset
71185 * - 's' For symbolic direct pointers without offset
71186 * - 'B' For backtraced symbolic direct pointers with offset
71187+ * - 'A' For symbolic direct pointers with offset approved for use with GRKERNSEC_HIDESYM
71188+ * - 'a' For symbolic direct pointers without offset approved for use with GRKERNSEC_HIDESYM
71189 * - 'R' For decoded struct resource, e.g., [mem 0x0-0x1f 64bit pref]
71190 * - 'r' For raw struct resource, e.g., [mem 0x0-0x1f flags 0x201]
71191 * - 'M' For a 6-byte MAC address, it prints the address in the
71192@@ -855,12 +864,12 @@ char *pointer(const char *fmt, char *buf
71193 {
71194 if (!ptr && *fmt != 'K') {
71195 /*
71196- * Print (null) with the same width as a pointer so it makes
71197+ * Print (nil) with the same width as a pointer so it makes
71198 * tabular output look nice.
71199 */
71200 if (spec.field_width == -1)
71201 spec.field_width = 2 * sizeof(void *);
71202- return string(buf, end, "(null)", spec);
71203+ return string(buf, end, "(nil)", spec);
71204 }
71205
71206 switch (*fmt) {
71207@@ -870,6 +879,13 @@ char *pointer(const char *fmt, char *buf
71208 /* Fallthrough */
71209 case 'S':
71210 case 's':
71211+#ifdef CONFIG_GRKERNSEC_HIDESYM
71212+ break;
71213+#else
71214+ return symbol_string(buf, end, ptr, spec, *fmt);
71215+#endif
71216+ case 'A':
71217+ case 'a':
71218 case 'B':
71219 return symbol_string(buf, end, ptr, spec, *fmt);
71220 case 'R':
71221@@ -1632,11 +1648,11 @@ int bstr_printf(char *buf, size_t size,
71222 typeof(type) value; \
71223 if (sizeof(type) == 8) { \
71224 args = PTR_ALIGN(args, sizeof(u32)); \
71225- *(u32 *)&value = *(u32 *)args; \
71226- *((u32 *)&value + 1) = *(u32 *)(args + 4); \
71227+ *(u32 *)&value = *(const u32 *)args; \
71228+ *((u32 *)&value + 1) = *(const u32 *)(args + 4); \
71229 } else { \
71230 args = PTR_ALIGN(args, sizeof(type)); \
71231- value = *(typeof(type) *)args; \
71232+ value = *(const typeof(type) *)args; \
71233 } \
71234 args += sizeof(type); \
71235 value; \
71236@@ -1699,7 +1715,7 @@ int bstr_printf(char *buf, size_t size,
71237 case FORMAT_TYPE_STR: {
71238 const char *str_arg = args;
71239 args += strlen(str_arg) + 1;
71240- str = string(str, end, (char *)str_arg, spec);
71241+ str = string(str, end, str_arg, spec);
71242 break;
71243 }
71244
71245diff -urNp linux-2.6.39/localversion-grsec linux-2.6.39/localversion-grsec
71246--- linux-2.6.39/localversion-grsec 1969-12-31 19:00:00.000000000 -0500
71247+++ linux-2.6.39/localversion-grsec 2011-05-22 19:41:42.000000000 -0400
71248@@ -0,0 +1 @@
71249+-grsec
71250diff -urNp linux-2.6.39/Makefile linux-2.6.39/Makefile
71251--- linux-2.6.39/Makefile 2011-05-19 00:06:34.000000000 -0400
71252+++ linux-2.6.39/Makefile 2011-05-22 19:41:42.000000000 -0400
71253@@ -237,8 +237,8 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH"
71254
71255 HOSTCC = gcc
71256 HOSTCXX = g++
71257-HOSTCFLAGS = -Wall -Wmissing-prototypes -Wstrict-prototypes -O2 -fomit-frame-pointer
71258-HOSTCXXFLAGS = -O2
71259+HOSTCFLAGS = -Wall -W -Wmissing-prototypes -Wstrict-prototypes -Wno-empty-body -Wno-unused-parameter -Wno-missing-field-initializers -O2 -fomit-frame-pointer -fno-delete-null-pointer-checks
71260+HOSTCXXFLAGS = -O2 -fno-delete-null-pointer-checks
71261
71262 # Decide whether to build built-in, modular, or both.
71263 # Normally, just do built-in.
71264@@ -356,6 +356,7 @@ LINUXINCLUDE := -I$(srctree)/arch/$(h
71265 KBUILD_CPPFLAGS := -D__KERNEL__
71266
71267 KBUILD_CFLAGS := -Wall -Wundef -Wstrict-prototypes -Wno-trigraphs \
71268+ -W -Wno-empty-body -Wno-unused-parameter -Wno-missing-field-initializers \
71269 -fno-strict-aliasing -fno-common \
71270 -Werror-implicit-function-declaration \
71271 -Wno-format-security \
71272@@ -685,7 +686,7 @@ export mod_strip_cmd
71273
71274
71275 ifeq ($(KBUILD_EXTMOD),)
71276-core-y += kernel/ mm/ fs/ ipc/ security/ crypto/ block/
71277+core-y += kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
71278
71279 vmlinux-dirs := $(patsubst %/,%,$(filter %/, $(init-y) $(init-m) \
71280 $(core-y) $(core-m) $(drivers-y) $(drivers-m) \
71281diff -urNp linux-2.6.39/mm/filemap.c linux-2.6.39/mm/filemap.c
71282--- linux-2.6.39/mm/filemap.c 2011-05-19 00:06:34.000000000 -0400
71283+++ linux-2.6.39/mm/filemap.c 2011-05-22 19:41:42.000000000 -0400
71284@@ -1724,7 +1724,7 @@ int generic_file_mmap(struct file * file
71285 struct address_space *mapping = file->f_mapping;
71286
71287 if (!mapping->a_ops->readpage)
71288- return -ENOEXEC;
71289+ return -ENODEV;
71290 file_accessed(file);
71291 vma->vm_ops = &generic_file_vm_ops;
71292 vma->vm_flags |= VM_CAN_NONLINEAR;
71293@@ -2120,6 +2120,7 @@ inline int generic_write_checks(struct f
71294 *pos = i_size_read(inode);
71295
71296 if (limit != RLIM_INFINITY) {
71297+ gr_learn_resource(current, RLIMIT_FSIZE,*pos, 0);
71298 if (*pos >= limit) {
71299 send_sig(SIGXFSZ, current, 0);
71300 return -EFBIG;
71301diff -urNp linux-2.6.39/mm/fremap.c linux-2.6.39/mm/fremap.c
71302--- linux-2.6.39/mm/fremap.c 2011-05-19 00:06:34.000000000 -0400
71303+++ linux-2.6.39/mm/fremap.c 2011-05-22 19:36:33.000000000 -0400
71304@@ -156,6 +156,11 @@ SYSCALL_DEFINE5(remap_file_pages, unsign
71305 retry:
71306 vma = find_vma(mm, start);
71307
71308+#ifdef CONFIG_PAX_SEGMEXEC
71309+ if (vma && (mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_flags & VM_MAYEXEC))
71310+ goto out;
71311+#endif
71312+
71313 /*
71314 * Make sure the vma is shared, that it supports prefaulting,
71315 * and that the remapped range is valid and fully within
71316@@ -224,7 +229,7 @@ SYSCALL_DEFINE5(remap_file_pages, unsign
71317 /*
71318 * drop PG_Mlocked flag for over-mapped range
71319 */
71320- unsigned int saved_flags = vma->vm_flags;
71321+ unsigned long saved_flags = vma->vm_flags;
71322 munlock_vma_pages_range(vma, start, start + size);
71323 vma->vm_flags = saved_flags;
71324 }
71325diff -urNp linux-2.6.39/mm/highmem.c linux-2.6.39/mm/highmem.c
71326--- linux-2.6.39/mm/highmem.c 2011-05-19 00:06:34.000000000 -0400
71327+++ linux-2.6.39/mm/highmem.c 2011-05-22 19:36:33.000000000 -0400
71328@@ -125,9 +125,10 @@ static void flush_all_zero_pkmaps(void)
71329 * So no dangers, even with speculative execution.
71330 */
71331 page = pte_page(pkmap_page_table[i]);
71332+ pax_open_kernel();
71333 pte_clear(&init_mm, (unsigned long)page_address(page),
71334 &pkmap_page_table[i]);
71335-
71336+ pax_close_kernel();
71337 set_page_address(page, NULL);
71338 need_flush = 1;
71339 }
71340@@ -186,9 +187,11 @@ start:
71341 }
71342 }
71343 vaddr = PKMAP_ADDR(last_pkmap_nr);
71344+
71345+ pax_open_kernel();
71346 set_pte_at(&init_mm, vaddr,
71347 &(pkmap_page_table[last_pkmap_nr]), mk_pte(page, kmap_prot));
71348-
71349+ pax_close_kernel();
71350 pkmap_count[last_pkmap_nr] = 1;
71351 set_page_address(page, (void *)vaddr);
71352
71353diff -urNp linux-2.6.39/mm/huge_memory.c linux-2.6.39/mm/huge_memory.c
71354--- linux-2.6.39/mm/huge_memory.c 2011-05-19 00:06:34.000000000 -0400
71355+++ linux-2.6.39/mm/huge_memory.c 2011-05-22 19:36:33.000000000 -0400
71356@@ -702,7 +702,7 @@ out:
71357 * run pte_offset_map on the pmd, if an huge pmd could
71358 * materialize from under us from a different thread.
71359 */
71360- if (unlikely(__pte_alloc(mm, vma, pmd, address)))
71361+ if (unlikely(pmd_none(*pmd) && __pte_alloc(mm, vma, pmd, address)))
71362 return VM_FAULT_OOM;
71363 /* if an huge pmd materialized from under us just retry later */
71364 if (unlikely(pmd_trans_huge(*pmd)))
71365diff -urNp linux-2.6.39/mm/hugetlb.c linux-2.6.39/mm/hugetlb.c
71366--- linux-2.6.39/mm/hugetlb.c 2011-05-19 00:06:34.000000000 -0400
71367+++ linux-2.6.39/mm/hugetlb.c 2011-05-22 19:36:33.000000000 -0400
71368@@ -2331,6 +2331,27 @@ static int unmap_ref_private(struct mm_s
71369 return 1;
71370 }
71371
71372+#ifdef CONFIG_PAX_SEGMEXEC
71373+static void pax_mirror_huge_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m)
71374+{
71375+ struct mm_struct *mm = vma->vm_mm;
71376+ struct vm_area_struct *vma_m;
71377+ unsigned long address_m;
71378+ pte_t *ptep_m;
71379+
71380+ vma_m = pax_find_mirror_vma(vma);
71381+ if (!vma_m)
71382+ return;
71383+
71384+ BUG_ON(address >= SEGMEXEC_TASK_SIZE);
71385+ address_m = address + SEGMEXEC_TASK_SIZE;
71386+ ptep_m = huge_pte_offset(mm, address_m & HPAGE_MASK);
71387+ get_page(page_m);
71388+ hugepage_add_anon_rmap(page_m, vma_m, address_m);
71389+ set_huge_pte_at(mm, address_m, ptep_m, make_huge_pte(vma_m, page_m, 0));
71390+}
71391+#endif
71392+
71393 /*
71394 * Hugetlb_cow() should be called with page lock of the original hugepage held.
71395 */
71396@@ -2432,6 +2453,11 @@ retry_avoidcopy:
71397 make_huge_pte(vma, new_page, 1));
71398 page_remove_rmap(old_page);
71399 hugepage_add_new_anon_rmap(new_page, vma, address);
71400+
71401+#ifdef CONFIG_PAX_SEGMEXEC
71402+ pax_mirror_huge_pte(vma, address, new_page);
71403+#endif
71404+
71405 /* Make the old page be freed below */
71406 new_page = old_page;
71407 mmu_notifier_invalidate_range_end(mm,
71408@@ -2583,6 +2609,10 @@ retry:
71409 && (vma->vm_flags & VM_SHARED)));
71410 set_huge_pte_at(mm, address, ptep, new_pte);
71411
71412+#ifdef CONFIG_PAX_SEGMEXEC
71413+ pax_mirror_huge_pte(vma, address, page);
71414+#endif
71415+
71416 if ((flags & FAULT_FLAG_WRITE) && !(vma->vm_flags & VM_SHARED)) {
71417 /* Optimization, do the COW without a second fault */
71418 ret = hugetlb_cow(mm, vma, address, ptep, new_pte, page);
71419@@ -2612,6 +2642,10 @@ int hugetlb_fault(struct mm_struct *mm,
71420 static DEFINE_MUTEX(hugetlb_instantiation_mutex);
71421 struct hstate *h = hstate_vma(vma);
71422
71423+#ifdef CONFIG_PAX_SEGMEXEC
71424+ struct vm_area_struct *vma_m;
71425+#endif
71426+
71427 ptep = huge_pte_offset(mm, address);
71428 if (ptep) {
71429 entry = huge_ptep_get(ptep);
71430@@ -2623,6 +2657,26 @@ int hugetlb_fault(struct mm_struct *mm,
71431 VM_FAULT_SET_HINDEX(h - hstates);
71432 }
71433
71434+#ifdef CONFIG_PAX_SEGMEXEC
71435+ vma_m = pax_find_mirror_vma(vma);
71436+ if (vma_m) {
71437+ unsigned long address_m;
71438+
71439+ if (vma->vm_start > vma_m->vm_start) {
71440+ address_m = address;
71441+ address -= SEGMEXEC_TASK_SIZE;
71442+ vma = vma_m;
71443+ h = hstate_vma(vma);
71444+ } else
71445+ address_m = address + SEGMEXEC_TASK_SIZE;
71446+
71447+ if (!huge_pte_alloc(mm, address_m, huge_page_size(h)))
71448+ return VM_FAULT_OOM;
71449+ address_m &= HPAGE_MASK;
71450+ unmap_hugepage_range(vma, address_m, address_m + HPAGE_SIZE, NULL);
71451+ }
71452+#endif
71453+
71454 ptep = huge_pte_alloc(mm, address, huge_page_size(h));
71455 if (!ptep)
71456 return VM_FAULT_OOM;
71457diff -urNp linux-2.6.39/mm/Kconfig linux-2.6.39/mm/Kconfig
71458--- linux-2.6.39/mm/Kconfig 2011-05-19 00:06:34.000000000 -0400
71459+++ linux-2.6.39/mm/Kconfig 2011-05-22 19:41:42.000000000 -0400
71460@@ -240,7 +240,7 @@ config KSM
71461 config DEFAULT_MMAP_MIN_ADDR
71462 int "Low address space to protect from user allocation"
71463 depends on MMU
71464- default 4096
71465+ default 65536
71466 help
71467 This is the portion of low virtual memory which should be protected
71468 from userspace allocation. Keeping a user from writing to low pages
71469diff -urNp linux-2.6.39/mm/kmemleak.c linux-2.6.39/mm/kmemleak.c
71470--- linux-2.6.39/mm/kmemleak.c 2011-05-19 00:06:34.000000000 -0400
71471+++ linux-2.6.39/mm/kmemleak.c 2011-05-22 19:41:42.000000000 -0400
71472@@ -357,7 +357,7 @@ static void print_unreferenced(struct se
71473
71474 for (i = 0; i < object->trace_len; i++) {
71475 void *ptr = (void *)object->trace[i];
71476- seq_printf(seq, " [<%p>] %pS\n", ptr, ptr);
71477+ seq_printf(seq, " [<%p>] %pA\n", ptr, ptr);
71478 }
71479 }
71480
71481diff -urNp linux-2.6.39/mm/maccess.c linux-2.6.39/mm/maccess.c
71482--- linux-2.6.39/mm/maccess.c 2011-05-19 00:06:34.000000000 -0400
71483+++ linux-2.6.39/mm/maccess.c 2011-05-22 19:36:33.000000000 -0400
71484@@ -15,10 +15,10 @@
71485 * happens, handle that and return -EFAULT.
71486 */
71487
71488-long __weak probe_kernel_read(void *dst, void *src, size_t size)
71489+long __weak probe_kernel_read(void *dst, const void *src, size_t size)
71490 __attribute__((alias("__probe_kernel_read")));
71491
71492-long __probe_kernel_read(void *dst, void *src, size_t size)
71493+long __probe_kernel_read(void *dst, const void *src, size_t size)
71494 {
71495 long ret;
71496 mm_segment_t old_fs = get_fs();
71497@@ -43,10 +43,10 @@ EXPORT_SYMBOL_GPL(probe_kernel_read);
71498 * Safely write to address @dst from the buffer at @src. If a kernel fault
71499 * happens, handle that and return -EFAULT.
71500 */
71501-long __weak probe_kernel_write(void *dst, void *src, size_t size)
71502+long __weak probe_kernel_write(void *dst, const void *src, size_t size)
71503 __attribute__((alias("__probe_kernel_write")));
71504
71505-long __probe_kernel_write(void *dst, void *src, size_t size)
71506+long __probe_kernel_write(void *dst, const void *src, size_t size)
71507 {
71508 long ret;
71509 mm_segment_t old_fs = get_fs();
71510diff -urNp linux-2.6.39/mm/madvise.c linux-2.6.39/mm/madvise.c
71511--- linux-2.6.39/mm/madvise.c 2011-05-19 00:06:34.000000000 -0400
71512+++ linux-2.6.39/mm/madvise.c 2011-05-22 19:36:33.000000000 -0400
71513@@ -45,6 +45,10 @@ static long madvise_behavior(struct vm_a
71514 pgoff_t pgoff;
71515 unsigned long new_flags = vma->vm_flags;
71516
71517+#ifdef CONFIG_PAX_SEGMEXEC
71518+ struct vm_area_struct *vma_m;
71519+#endif
71520+
71521 switch (behavior) {
71522 case MADV_NORMAL:
71523 new_flags = new_flags & ~VM_RAND_READ & ~VM_SEQ_READ;
71524@@ -110,6 +114,13 @@ success:
71525 /*
71526 * vm_flags is protected by the mmap_sem held in write mode.
71527 */
71528+
71529+#ifdef CONFIG_PAX_SEGMEXEC
71530+ vma_m = pax_find_mirror_vma(vma);
71531+ if (vma_m)
71532+ vma_m->vm_flags = new_flags & ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT);
71533+#endif
71534+
71535 vma->vm_flags = new_flags;
71536
71537 out:
71538@@ -168,6 +179,11 @@ static long madvise_dontneed(struct vm_a
71539 struct vm_area_struct ** prev,
71540 unsigned long start, unsigned long end)
71541 {
71542+
71543+#ifdef CONFIG_PAX_SEGMEXEC
71544+ struct vm_area_struct *vma_m;
71545+#endif
71546+
71547 *prev = vma;
71548 if (vma->vm_flags & (VM_LOCKED|VM_HUGETLB|VM_PFNMAP))
71549 return -EINVAL;
71550@@ -180,6 +196,21 @@ static long madvise_dontneed(struct vm_a
71551 zap_page_range(vma, start, end - start, &details);
71552 } else
71553 zap_page_range(vma, start, end - start, NULL);
71554+
71555+#ifdef CONFIG_PAX_SEGMEXEC
71556+ vma_m = pax_find_mirror_vma(vma);
71557+ if (vma_m) {
71558+ if (unlikely(vma->vm_flags & VM_NONLINEAR)) {
71559+ struct zap_details details = {
71560+ .nonlinear_vma = vma_m,
71561+ .last_index = ULONG_MAX,
71562+ };
71563+ zap_page_range(vma, start + SEGMEXEC_TASK_SIZE, end - start, &details);
71564+ } else
71565+ zap_page_range(vma, start + SEGMEXEC_TASK_SIZE, end - start, NULL);
71566+ }
71567+#endif
71568+
71569 return 0;
71570 }
71571
71572@@ -376,6 +407,16 @@ SYSCALL_DEFINE3(madvise, unsigned long,
71573 if (end < start)
71574 goto out;
71575
71576+#ifdef CONFIG_PAX_SEGMEXEC
71577+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
71578+ if (end > SEGMEXEC_TASK_SIZE)
71579+ goto out;
71580+ } else
71581+#endif
71582+
71583+ if (end > TASK_SIZE)
71584+ goto out;
71585+
71586 error = 0;
71587 if (end == start)
71588 goto out;
71589diff -urNp linux-2.6.39/mm/memory.c linux-2.6.39/mm/memory.c
71590--- linux-2.6.39/mm/memory.c 2011-05-19 00:06:34.000000000 -0400
71591+++ linux-2.6.39/mm/memory.c 2011-05-22 19:36:33.000000000 -0400
71592@@ -259,8 +259,12 @@ static inline void free_pmd_range(struct
71593 return;
71594
71595 pmd = pmd_offset(pud, start);
71596+
71597+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_PER_CPU_PGD)
71598 pud_clear(pud);
71599 pmd_free_tlb(tlb, pmd, start);
71600+#endif
71601+
71602 }
71603
71604 static inline void free_pud_range(struct mmu_gather *tlb, pgd_t *pgd,
71605@@ -291,9 +295,12 @@ static inline void free_pud_range(struct
71606 if (end - 1 > ceiling - 1)
71607 return;
71608
71609+#if !defined(CONFIG_X86_64) || !defined(CONFIG_PAX_PER_CPU_PGD)
71610 pud = pud_offset(pgd, start);
71611 pgd_clear(pgd);
71612 pud_free_tlb(tlb, pud, start);
71613+#endif
71614+
71615 }
71616
71617 /*
71618@@ -1410,12 +1417,6 @@ no_page_table:
71619 return page;
71620 }
71621
71622-static inline int stack_guard_page(struct vm_area_struct *vma, unsigned long addr)
71623-{
71624- return stack_guard_page_start(vma, addr) ||
71625- stack_guard_page_end(vma, addr+PAGE_SIZE);
71626-}
71627-
71628 /**
71629 * __get_user_pages() - pin user pages in memory
71630 * @tsk: task_struct of target task
71631@@ -1488,10 +1489,10 @@ int __get_user_pages(struct task_struct
71632 (VM_MAYREAD | VM_MAYWRITE) : (VM_READ | VM_WRITE);
71633 i = 0;
71634
71635- do {
71636+ while (nr_pages) {
71637 struct vm_area_struct *vma;
71638
71639- vma = find_extend_vma(mm, start);
71640+ vma = find_vma(mm, start);
71641 if (!vma && in_gate_area(mm, start)) {
71642 unsigned long pg = start & PAGE_MASK;
71643 pgd_t *pgd;
71644@@ -1539,7 +1540,7 @@ int __get_user_pages(struct task_struct
71645 goto next_page;
71646 }
71647
71648- if (!vma ||
71649+ if (!vma || start < vma->vm_start ||
71650 (vma->vm_flags & (VM_IO | VM_PFNMAP)) ||
71651 !(vm_flags & vma->vm_flags))
71652 return i ? : -EFAULT;
71653@@ -1566,11 +1567,6 @@ int __get_user_pages(struct task_struct
71654 int ret;
71655 unsigned int fault_flags = 0;
71656
71657- /* For mlock, just skip the stack guard page. */
71658- if (foll_flags & FOLL_MLOCK) {
71659- if (stack_guard_page(vma, start))
71660- goto next_page;
71661- }
71662 if (foll_flags & FOLL_WRITE)
71663 fault_flags |= FAULT_FLAG_WRITE;
71664 if (nonblocking)
71665@@ -1644,7 +1640,7 @@ next_page:
71666 start += PAGE_SIZE;
71667 nr_pages--;
71668 } while (nr_pages && start < vma->vm_end);
71669- } while (nr_pages);
71670+ }
71671 return i;
71672 }
71673 EXPORT_SYMBOL(__get_user_pages);
71674@@ -1795,6 +1791,10 @@ static int insert_page(struct vm_area_st
71675 page_add_file_rmap(page);
71676 set_pte_at(mm, addr, pte, mk_pte(page, prot));
71677
71678+#ifdef CONFIG_PAX_SEGMEXEC
71679+ pax_mirror_file_pte(vma, addr, page, ptl);
71680+#endif
71681+
71682 retval = 0;
71683 pte_unmap_unlock(pte, ptl);
71684 return retval;
71685@@ -1829,10 +1829,22 @@ out:
71686 int vm_insert_page(struct vm_area_struct *vma, unsigned long addr,
71687 struct page *page)
71688 {
71689+
71690+#ifdef CONFIG_PAX_SEGMEXEC
71691+ struct vm_area_struct *vma_m;
71692+#endif
71693+
71694 if (addr < vma->vm_start || addr >= vma->vm_end)
71695 return -EFAULT;
71696 if (!page_count(page))
71697 return -EINVAL;
71698+
71699+#ifdef CONFIG_PAX_SEGMEXEC
71700+ vma_m = pax_find_mirror_vma(vma);
71701+ if (vma_m)
71702+ vma_m->vm_flags |= VM_INSERTPAGE;
71703+#endif
71704+
71705 vma->vm_flags |= VM_INSERTPAGE;
71706 return insert_page(vma, addr, page, vma->vm_page_prot);
71707 }
71708@@ -1918,6 +1930,7 @@ int vm_insert_mixed(struct vm_area_struc
71709 unsigned long pfn)
71710 {
71711 BUG_ON(!(vma->vm_flags & VM_MIXEDMAP));
71712+ BUG_ON(vma->vm_mirror);
71713
71714 if (addr < vma->vm_start || addr >= vma->vm_end)
71715 return -EFAULT;
71716@@ -2233,6 +2246,186 @@ static inline void cow_user_page(struct
71717 copy_user_highpage(dst, src, va, vma);
71718 }
71719
71720+#ifdef CONFIG_PAX_SEGMEXEC
71721+static void pax_unmap_mirror_pte(struct vm_area_struct *vma, unsigned long address, pmd_t *pmd)
71722+{
71723+ struct mm_struct *mm = vma->vm_mm;
71724+ spinlock_t *ptl;
71725+ pte_t *pte, entry;
71726+
71727+ pte = pte_offset_map_lock(mm, pmd, address, &ptl);
71728+ entry = *pte;
71729+ if (!pte_present(entry)) {
71730+ if (!pte_none(entry)) {
71731+ BUG_ON(pte_file(entry));
71732+ free_swap_and_cache(pte_to_swp_entry(entry));
71733+ pte_clear_not_present_full(mm, address, pte, 0);
71734+ }
71735+ } else {
71736+ struct page *page;
71737+
71738+ flush_cache_page(vma, address, pte_pfn(entry));
71739+ entry = ptep_clear_flush(vma, address, pte);
71740+ BUG_ON(pte_dirty(entry));
71741+ page = vm_normal_page(vma, address, entry);
71742+ if (page) {
71743+ update_hiwater_rss(mm);
71744+ if (PageAnon(page))
71745+ dec_mm_counter_fast(mm, MM_ANONPAGES);
71746+ else
71747+ dec_mm_counter_fast(mm, MM_FILEPAGES);
71748+ page_remove_rmap(page);
71749+ page_cache_release(page);
71750+ }
71751+ }
71752+ pte_unmap_unlock(pte, ptl);
71753+}
71754+
71755+/* PaX: if vma is mirrored, synchronize the mirror's PTE
71756+ *
71757+ * the ptl of the lower mapped page is held on entry and is not released on exit
71758+ * or inside to ensure atomic changes to the PTE states (swapout, mremap, munmap, etc)
71759+ */
71760+static void pax_mirror_anon_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl)
71761+{
71762+ struct mm_struct *mm = vma->vm_mm;
71763+ unsigned long address_m;
71764+ spinlock_t *ptl_m;
71765+ struct vm_area_struct *vma_m;
71766+ pmd_t *pmd_m;
71767+ pte_t *pte_m, entry_m;
71768+
71769+ BUG_ON(!page_m || !PageAnon(page_m));
71770+
71771+ vma_m = pax_find_mirror_vma(vma);
71772+ if (!vma_m)
71773+ return;
71774+
71775+ BUG_ON(!PageLocked(page_m));
71776+ BUG_ON(address >= SEGMEXEC_TASK_SIZE);
71777+ address_m = address + SEGMEXEC_TASK_SIZE;
71778+ pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
71779+ pte_m = pte_offset_map(pmd_m, address_m);
71780+ ptl_m = pte_lockptr(mm, pmd_m);
71781+ if (ptl != ptl_m) {
71782+ spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
71783+ if (!pte_none(*pte_m))
71784+ goto out;
71785+ }
71786+
71787+ entry_m = pfn_pte(page_to_pfn(page_m), vma_m->vm_page_prot);
71788+ page_cache_get(page_m);
71789+ page_add_anon_rmap(page_m, vma_m, address_m);
71790+ inc_mm_counter_fast(mm, MM_ANONPAGES);
71791+ set_pte_at(mm, address_m, pte_m, entry_m);
71792+ update_mmu_cache(vma_m, address_m, entry_m);
71793+out:
71794+ if (ptl != ptl_m)
71795+ spin_unlock(ptl_m);
71796+ pte_unmap(pte_m);
71797+ unlock_page(page_m);
71798+}
71799+
71800+void pax_mirror_file_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl)
71801+{
71802+ struct mm_struct *mm = vma->vm_mm;
71803+ unsigned long address_m;
71804+ spinlock_t *ptl_m;
71805+ struct vm_area_struct *vma_m;
71806+ pmd_t *pmd_m;
71807+ pte_t *pte_m, entry_m;
71808+
71809+ BUG_ON(!page_m || PageAnon(page_m));
71810+
71811+ vma_m = pax_find_mirror_vma(vma);
71812+ if (!vma_m)
71813+ return;
71814+
71815+ BUG_ON(address >= SEGMEXEC_TASK_SIZE);
71816+ address_m = address + SEGMEXEC_TASK_SIZE;
71817+ pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
71818+ pte_m = pte_offset_map(pmd_m, address_m);
71819+ ptl_m = pte_lockptr(mm, pmd_m);
71820+ if (ptl != ptl_m) {
71821+ spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
71822+ if (!pte_none(*pte_m))
71823+ goto out;
71824+ }
71825+
71826+ entry_m = pfn_pte(page_to_pfn(page_m), vma_m->vm_page_prot);
71827+ page_cache_get(page_m);
71828+ page_add_file_rmap(page_m);
71829+ inc_mm_counter_fast(mm, MM_FILEPAGES);
71830+ set_pte_at(mm, address_m, pte_m, entry_m);
71831+ update_mmu_cache(vma_m, address_m, entry_m);
71832+out:
71833+ if (ptl != ptl_m)
71834+ spin_unlock(ptl_m);
71835+ pte_unmap(pte_m);
71836+}
71837+
71838+static void pax_mirror_pfn_pte(struct vm_area_struct *vma, unsigned long address, unsigned long pfn_m, spinlock_t *ptl)
71839+{
71840+ struct mm_struct *mm = vma->vm_mm;
71841+ unsigned long address_m;
71842+ spinlock_t *ptl_m;
71843+ struct vm_area_struct *vma_m;
71844+ pmd_t *pmd_m;
71845+ pte_t *pte_m, entry_m;
71846+
71847+ vma_m = pax_find_mirror_vma(vma);
71848+ if (!vma_m)
71849+ return;
71850+
71851+ BUG_ON(address >= SEGMEXEC_TASK_SIZE);
71852+ address_m = address + SEGMEXEC_TASK_SIZE;
71853+ pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
71854+ pte_m = pte_offset_map(pmd_m, address_m);
71855+ ptl_m = pte_lockptr(mm, pmd_m);
71856+ if (ptl != ptl_m) {
71857+ spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
71858+ if (!pte_none(*pte_m))
71859+ goto out;
71860+ }
71861+
71862+ entry_m = pfn_pte(pfn_m, vma_m->vm_page_prot);
71863+ set_pte_at(mm, address_m, pte_m, entry_m);
71864+out:
71865+ if (ptl != ptl_m)
71866+ spin_unlock(ptl_m);
71867+ pte_unmap(pte_m);
71868+}
71869+
71870+static void pax_mirror_pte(struct vm_area_struct *vma, unsigned long address, pte_t *pte, pmd_t *pmd, spinlock_t *ptl)
71871+{
71872+ struct page *page_m;
71873+ pte_t entry;
71874+
71875+ if (!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC))
71876+ goto out;
71877+
71878+ entry = *pte;
71879+ page_m = vm_normal_page(vma, address, entry);
71880+ if (!page_m)
71881+ pax_mirror_pfn_pte(vma, address, pte_pfn(entry), ptl);
71882+ else if (PageAnon(page_m)) {
71883+ if (pax_find_mirror_vma(vma)) {
71884+ pte_unmap_unlock(pte, ptl);
71885+ lock_page(page_m);
71886+ pte = pte_offset_map_lock(vma->vm_mm, pmd, address, &ptl);
71887+ if (pte_same(entry, *pte))
71888+ pax_mirror_anon_pte(vma, address, page_m, ptl);
71889+ else
71890+ unlock_page(page_m);
71891+ }
71892+ } else
71893+ pax_mirror_file_pte(vma, address, page_m, ptl);
71894+
71895+out:
71896+ pte_unmap_unlock(pte, ptl);
71897+}
71898+#endif
71899+
71900 /*
71901 * This routine handles present pages, when users try to write
71902 * to a shared page. It is done by copying the page to a new address
71903@@ -2444,6 +2637,12 @@ gotten:
71904 */
71905 page_table = pte_offset_map_lock(mm, pmd, address, &ptl);
71906 if (likely(pte_same(*page_table, orig_pte))) {
71907+
71908+#ifdef CONFIG_PAX_SEGMEXEC
71909+ if (pax_find_mirror_vma(vma))
71910+ BUG_ON(!trylock_page(new_page));
71911+#endif
71912+
71913 if (old_page) {
71914 if (!PageAnon(old_page)) {
71915 dec_mm_counter_fast(mm, MM_FILEPAGES);
71916@@ -2495,6 +2694,10 @@ gotten:
71917 page_remove_rmap(old_page);
71918 }
71919
71920+#ifdef CONFIG_PAX_SEGMEXEC
71921+ pax_mirror_anon_pte(vma, address, new_page, ptl);
71922+#endif
71923+
71924 /* Free the old page.. */
71925 new_page = old_page;
71926 ret |= VM_FAULT_WRITE;
71927@@ -2905,6 +3108,11 @@ static int do_swap_page(struct mm_struct
71928 swap_free(entry);
71929 if (vm_swap_full() || (vma->vm_flags & VM_LOCKED) || PageMlocked(page))
71930 try_to_free_swap(page);
71931+
71932+#ifdef CONFIG_PAX_SEGMEXEC
71933+ if ((flags & FAULT_FLAG_WRITE) || !pax_find_mirror_vma(vma))
71934+#endif
71935+
71936 unlock_page(page);
71937 if (swapcache) {
71938 /*
71939@@ -2928,6 +3136,11 @@ static int do_swap_page(struct mm_struct
71940
71941 /* No need to invalidate - it was non-present before */
71942 update_mmu_cache(vma, address, page_table);
71943+
71944+#ifdef CONFIG_PAX_SEGMEXEC
71945+ pax_mirror_anon_pte(vma, address, page, ptl);
71946+#endif
71947+
71948 unlock:
71949 pte_unmap_unlock(page_table, ptl);
71950 out:
71951@@ -2947,40 +3160,6 @@ out_release:
71952 }
71953
71954 /*
71955- * This is like a special single-page "expand_{down|up}wards()",
71956- * except we must first make sure that 'address{-|+}PAGE_SIZE'
71957- * doesn't hit another vma.
71958- */
71959-static inline int check_stack_guard_page(struct vm_area_struct *vma, unsigned long address)
71960-{
71961- address &= PAGE_MASK;
71962- if ((vma->vm_flags & VM_GROWSDOWN) && address == vma->vm_start) {
71963- struct vm_area_struct *prev = vma->vm_prev;
71964-
71965- /*
71966- * Is there a mapping abutting this one below?
71967- *
71968- * That's only ok if it's the same stack mapping
71969- * that has gotten split..
71970- */
71971- if (prev && prev->vm_end == address)
71972- return prev->vm_flags & VM_GROWSDOWN ? 0 : -ENOMEM;
71973-
71974- expand_stack(vma, address - PAGE_SIZE);
71975- }
71976- if ((vma->vm_flags & VM_GROWSUP) && address + PAGE_SIZE == vma->vm_end) {
71977- struct vm_area_struct *next = vma->vm_next;
71978-
71979- /* As VM_GROWSDOWN but s/below/above/ */
71980- if (next && next->vm_start == address + PAGE_SIZE)
71981- return next->vm_flags & VM_GROWSUP ? 0 : -ENOMEM;
71982-
71983- expand_upwards(vma, address + PAGE_SIZE);
71984- }
71985- return 0;
71986-}
71987-
71988-/*
71989 * We enter with non-exclusive mmap_sem (to exclude vma changes,
71990 * but allow concurrent faults), and pte mapped but not yet locked.
71991 * We return with mmap_sem still held, but pte unmapped and unlocked.
71992@@ -2989,27 +3168,23 @@ static int do_anonymous_page(struct mm_s
71993 unsigned long address, pte_t *page_table, pmd_t *pmd,
71994 unsigned int flags)
71995 {
71996- struct page *page;
71997+ struct page *page = NULL;
71998 spinlock_t *ptl;
71999 pte_t entry;
72000
72001- pte_unmap(page_table);
72002-
72003- /* Check if we need to add a guard page to the stack */
72004- if (check_stack_guard_page(vma, address) < 0)
72005- return VM_FAULT_SIGBUS;
72006-
72007- /* Use the zero-page for reads */
72008 if (!(flags & FAULT_FLAG_WRITE)) {
72009 entry = pte_mkspecial(pfn_pte(my_zero_pfn(address),
72010 vma->vm_page_prot));
72011- page_table = pte_offset_map_lock(mm, pmd, address, &ptl);
72012+ ptl = pte_lockptr(mm, pmd);
72013+ spin_lock(ptl);
72014 if (!pte_none(*page_table))
72015 goto unlock;
72016 goto setpte;
72017 }
72018
72019 /* Allocate our own private page. */
72020+ pte_unmap(page_table);
72021+
72022 if (unlikely(anon_vma_prepare(vma)))
72023 goto oom;
72024 page = alloc_zeroed_user_highpage_movable(vma, address);
72025@@ -3028,6 +3203,11 @@ static int do_anonymous_page(struct mm_s
72026 if (!pte_none(*page_table))
72027 goto release;
72028
72029+#ifdef CONFIG_PAX_SEGMEXEC
72030+ if (pax_find_mirror_vma(vma))
72031+ BUG_ON(!trylock_page(page));
72032+#endif
72033+
72034 inc_mm_counter_fast(mm, MM_ANONPAGES);
72035 page_add_new_anon_rmap(page, vma, address);
72036 setpte:
72037@@ -3035,6 +3215,12 @@ setpte:
72038
72039 /* No need to invalidate - it was non-present before */
72040 update_mmu_cache(vma, address, page_table);
72041+
72042+#ifdef CONFIG_PAX_SEGMEXEC
72043+ if (page)
72044+ pax_mirror_anon_pte(vma, address, page, ptl);
72045+#endif
72046+
72047 unlock:
72048 pte_unmap_unlock(page_table, ptl);
72049 return 0;
72050@@ -3172,6 +3358,12 @@ static int __do_fault(struct mm_struct *
72051 */
72052 /* Only go through if we didn't race with anybody else... */
72053 if (likely(pte_same(*page_table, orig_pte))) {
72054+
72055+#ifdef CONFIG_PAX_SEGMEXEC
72056+ if (anon && pax_find_mirror_vma(vma))
72057+ BUG_ON(!trylock_page(page));
72058+#endif
72059+
72060 flush_icache_page(vma, page);
72061 entry = mk_pte(page, vma->vm_page_prot);
72062 if (flags & FAULT_FLAG_WRITE)
72063@@ -3191,6 +3383,14 @@ static int __do_fault(struct mm_struct *
72064
72065 /* no need to invalidate: a not-present page won't be cached */
72066 update_mmu_cache(vma, address, page_table);
72067+
72068+#ifdef CONFIG_PAX_SEGMEXEC
72069+ if (anon)
72070+ pax_mirror_anon_pte(vma, address, page, ptl);
72071+ else
72072+ pax_mirror_file_pte(vma, address, page, ptl);
72073+#endif
72074+
72075 } else {
72076 if (charged)
72077 mem_cgroup_uncharge_page(page);
72078@@ -3338,6 +3538,12 @@ int handle_pte_fault(struct mm_struct *m
72079 if (flags & FAULT_FLAG_WRITE)
72080 flush_tlb_fix_spurious_fault(vma, address);
72081 }
72082+
72083+#ifdef CONFIG_PAX_SEGMEXEC
72084+ pax_mirror_pte(vma, address, pte, pmd, ptl);
72085+ return 0;
72086+#endif
72087+
72088 unlock:
72089 pte_unmap_unlock(pte, ptl);
72090 return 0;
72091@@ -3354,6 +3560,10 @@ int handle_mm_fault(struct mm_struct *mm
72092 pmd_t *pmd;
72093 pte_t *pte;
72094
72095+#ifdef CONFIG_PAX_SEGMEXEC
72096+ struct vm_area_struct *vma_m;
72097+#endif
72098+
72099 __set_current_state(TASK_RUNNING);
72100
72101 count_vm_event(PGFAULT);
72102@@ -3364,6 +3574,34 @@ int handle_mm_fault(struct mm_struct *mm
72103 if (unlikely(is_vm_hugetlb_page(vma)))
72104 return hugetlb_fault(mm, vma, address, flags);
72105
72106+#ifdef CONFIG_PAX_SEGMEXEC
72107+ vma_m = pax_find_mirror_vma(vma);
72108+ if (vma_m) {
72109+ unsigned long address_m;
72110+ pgd_t *pgd_m;
72111+ pud_t *pud_m;
72112+ pmd_t *pmd_m;
72113+
72114+ if (vma->vm_start > vma_m->vm_start) {
72115+ address_m = address;
72116+ address -= SEGMEXEC_TASK_SIZE;
72117+ vma = vma_m;
72118+ } else
72119+ address_m = address + SEGMEXEC_TASK_SIZE;
72120+
72121+ pgd_m = pgd_offset(mm, address_m);
72122+ pud_m = pud_alloc(mm, pgd_m, address_m);
72123+ if (!pud_m)
72124+ return VM_FAULT_OOM;
72125+ pmd_m = pmd_alloc(mm, pud_m, address_m);
72126+ if (!pmd_m)
72127+ return VM_FAULT_OOM;
72128+ if (!pmd_present(*pmd_m) && __pte_alloc(mm, vma_m, pmd_m, address_m))
72129+ return VM_FAULT_OOM;
72130+ pax_unmap_mirror_pte(vma_m, address_m, pmd_m);
72131+ }
72132+#endif
72133+
72134 pgd = pgd_offset(mm, address);
72135 pud = pud_alloc(mm, pgd, address);
72136 if (!pud)
72137@@ -3393,7 +3631,7 @@ int handle_mm_fault(struct mm_struct *mm
72138 * run pte_offset_map on the pmd, if an huge pmd could
72139 * materialize from under us from a different thread.
72140 */
72141- if (unlikely(pmd_none(*pmd)) && __pte_alloc(mm, vma, pmd, address))
72142+ if (unlikely(pmd_none(*pmd) && __pte_alloc(mm, vma, pmd, address)))
72143 return VM_FAULT_OOM;
72144 /* if an huge pmd materialized from under us just retry later */
72145 if (unlikely(pmd_trans_huge(*pmd)))
72146@@ -3497,7 +3735,7 @@ static int __init gate_vma_init(void)
72147 gate_vma.vm_start = FIXADDR_USER_START;
72148 gate_vma.vm_end = FIXADDR_USER_END;
72149 gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
72150- gate_vma.vm_page_prot = __P101;
72151+ gate_vma.vm_page_prot = vm_get_page_prot(gate_vma.vm_flags);
72152 /*
72153 * Make sure the vDSO gets into every core dump.
72154 * Dumping its contents makes post-mortem fully interpretable later
72155diff -urNp linux-2.6.39/mm/memory-failure.c linux-2.6.39/mm/memory-failure.c
72156--- linux-2.6.39/mm/memory-failure.c 2011-05-19 00:06:34.000000000 -0400
72157+++ linux-2.6.39/mm/memory-failure.c 2011-05-22 19:36:33.000000000 -0400
72158@@ -58,7 +58,7 @@ int sysctl_memory_failure_early_kill __r
72159
72160 int sysctl_memory_failure_recovery __read_mostly = 1;
72161
72162-atomic_long_t mce_bad_pages __read_mostly = ATOMIC_LONG_INIT(0);
72163+atomic_long_unchecked_t mce_bad_pages __read_mostly = ATOMIC_LONG_INIT(0);
72164
72165 #if defined(CONFIG_HWPOISON_INJECT) || defined(CONFIG_HWPOISON_INJECT_MODULE)
72166
72167@@ -1012,7 +1012,7 @@ int __memory_failure(unsigned long pfn,
72168 }
72169
72170 nr_pages = 1 << compound_trans_order(hpage);
72171- atomic_long_add(nr_pages, &mce_bad_pages);
72172+ atomic_long_add_unchecked(nr_pages, &mce_bad_pages);
72173
72174 /*
72175 * We need/can do nothing about count=0 pages.
72176@@ -1042,7 +1042,7 @@ int __memory_failure(unsigned long pfn,
72177 if (!PageHWPoison(hpage)
72178 || (hwpoison_filter(p) && TestClearPageHWPoison(p))
72179 || (p != hpage && TestSetPageHWPoison(hpage))) {
72180- atomic_long_sub(nr_pages, &mce_bad_pages);
72181+ atomic_long_sub_unchecked(nr_pages, &mce_bad_pages);
72182 return 0;
72183 }
72184 set_page_hwpoison_huge_page(hpage);
72185@@ -1100,7 +1100,7 @@ int __memory_failure(unsigned long pfn,
72186 }
72187 if (hwpoison_filter(p)) {
72188 if (TestClearPageHWPoison(p))
72189- atomic_long_sub(nr_pages, &mce_bad_pages);
72190+ atomic_long_sub_unchecked(nr_pages, &mce_bad_pages);
72191 unlock_page(hpage);
72192 put_page(hpage);
72193 return 0;
72194@@ -1226,7 +1226,7 @@ int unpoison_memory(unsigned long pfn)
72195 return 0;
72196 }
72197 if (TestClearPageHWPoison(p))
72198- atomic_long_sub(nr_pages, &mce_bad_pages);
72199+ atomic_long_sub_unchecked(nr_pages, &mce_bad_pages);
72200 pr_info("MCE: Software-unpoisoned free page %#lx\n", pfn);
72201 return 0;
72202 }
72203@@ -1240,7 +1240,7 @@ int unpoison_memory(unsigned long pfn)
72204 */
72205 if (TestClearPageHWPoison(page)) {
72206 pr_info("MCE: Software-unpoisoned page %#lx\n", pfn);
72207- atomic_long_sub(nr_pages, &mce_bad_pages);
72208+ atomic_long_sub_unchecked(nr_pages, &mce_bad_pages);
72209 freeit = 1;
72210 if (PageHuge(page))
72211 clear_page_hwpoison_huge_page(page);
72212@@ -1353,7 +1353,7 @@ static int soft_offline_huge_page(struct
72213 }
72214 done:
72215 if (!PageHWPoison(hpage))
72216- atomic_long_add(1 << compound_trans_order(hpage), &mce_bad_pages);
72217+ atomic_long_add_unchecked(1 << compound_trans_order(hpage), &mce_bad_pages);
72218 set_page_hwpoison_huge_page(hpage);
72219 dequeue_hwpoisoned_huge_page(hpage);
72220 /* keep elevated page count for bad page */
72221@@ -1482,7 +1482,7 @@ int soft_offline_page(struct page *page,
72222 return ret;
72223
72224 done:
72225- atomic_long_add(1, &mce_bad_pages);
72226+ atomic_long_add_unchecked(1, &mce_bad_pages);
72227 SetPageHWPoison(page);
72228 /* keep elevated page count for bad page */
72229 return ret;
72230diff -urNp linux-2.6.39/mm/mempolicy.c linux-2.6.39/mm/mempolicy.c
72231--- linux-2.6.39/mm/mempolicy.c 2011-05-19 00:06:34.000000000 -0400
72232+++ linux-2.6.39/mm/mempolicy.c 2011-05-22 19:41:42.000000000 -0400
72233@@ -643,6 +643,10 @@ static int mbind_range(struct mm_struct
72234 unsigned long vmstart;
72235 unsigned long vmend;
72236
72237+#ifdef CONFIG_PAX_SEGMEXEC
72238+ struct vm_area_struct *vma_m;
72239+#endif
72240+
72241 vma = find_vma_prev(mm, start, &prev);
72242 if (!vma || vma->vm_start > start)
72243 return -EFAULT;
72244@@ -673,6 +677,16 @@ static int mbind_range(struct mm_struct
72245 err = policy_vma(vma, new_pol);
72246 if (err)
72247 goto out;
72248+
72249+#ifdef CONFIG_PAX_SEGMEXEC
72250+ vma_m = pax_find_mirror_vma(vma);
72251+ if (vma_m) {
72252+ err = policy_vma(vma_m, new_pol);
72253+ if (err)
72254+ goto out;
72255+ }
72256+#endif
72257+
72258 }
72259
72260 out:
72261@@ -1106,6 +1120,17 @@ static long do_mbind(unsigned long start
72262
72263 if (end < start)
72264 return -EINVAL;
72265+
72266+#ifdef CONFIG_PAX_SEGMEXEC
72267+ if (mm->pax_flags & MF_PAX_SEGMEXEC) {
72268+ if (end > SEGMEXEC_TASK_SIZE)
72269+ return -EINVAL;
72270+ } else
72271+#endif
72272+
72273+ if (end > TASK_SIZE)
72274+ return -EINVAL;
72275+
72276 if (end == start)
72277 return 0;
72278
72279@@ -1324,6 +1349,14 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pi
72280 if (!mm)
72281 goto out;
72282
72283+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
72284+ if (mm != current->mm &&
72285+ (mm->pax_flags & MF_PAX_RANDMMAP || mm->pax_flags & MF_PAX_SEGMEXEC)) {
72286+ err = -EPERM;
72287+ goto out;
72288+ }
72289+#endif
72290+
72291 /*
72292 * Check if this process has the right to modify the specified
72293 * process. The right exists if the process has administrative
72294@@ -1333,8 +1366,7 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pi
72295 rcu_read_lock();
72296 tcred = __task_cred(task);
72297 if (cred->euid != tcred->suid && cred->euid != tcred->uid &&
72298- cred->uid != tcred->suid && cred->uid != tcred->uid &&
72299- !capable(CAP_SYS_NICE)) {
72300+ cred->uid != tcred->suid && !capable(CAP_SYS_NICE)) {
72301 rcu_read_unlock();
72302 err = -EPERM;
72303 goto out;
72304@@ -2634,7 +2666,7 @@ int show_numa_map(struct seq_file *m, vo
72305
72306 if (file) {
72307 seq_printf(m, " file=");
72308- seq_path(m, &file->f_path, "\n\t= ");
72309+ seq_path(m, &file->f_path, "\n\t\\= ");
72310 } else if (vma->vm_start <= mm->brk && vma->vm_end >= mm->start_brk) {
72311 seq_printf(m, " heap");
72312 } else if (vma->vm_start <= mm->start_stack &&
72313diff -urNp linux-2.6.39/mm/migrate.c linux-2.6.39/mm/migrate.c
72314--- linux-2.6.39/mm/migrate.c 2011-05-19 00:06:34.000000000 -0400
72315+++ linux-2.6.39/mm/migrate.c 2011-05-22 19:41:42.000000000 -0400
72316@@ -1133,6 +1133,8 @@ static int do_pages_move(struct mm_struc
72317 unsigned long chunk_start;
72318 int err;
72319
72320+ pax_track_stack();
72321+
72322 task_nodes = cpuset_mems_allowed(task);
72323
72324 err = -ENOMEM;
72325@@ -1317,6 +1319,14 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid,
72326 if (!mm)
72327 return -EINVAL;
72328
72329+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
72330+ if (mm != current->mm &&
72331+ (mm->pax_flags & MF_PAX_RANDMMAP || mm->pax_flags & MF_PAX_SEGMEXEC)) {
72332+ err = -EPERM;
72333+ goto out;
72334+ }
72335+#endif
72336+
72337 /*
72338 * Check if this process has the right to modify the specified
72339 * process. The right exists if the process has administrative
72340@@ -1326,8 +1336,7 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid,
72341 rcu_read_lock();
72342 tcred = __task_cred(task);
72343 if (cred->euid != tcred->suid && cred->euid != tcred->uid &&
72344- cred->uid != tcred->suid && cred->uid != tcred->uid &&
72345- !capable(CAP_SYS_NICE)) {
72346+ cred->uid != tcred->suid && !capable(CAP_SYS_NICE)) {
72347 rcu_read_unlock();
72348 err = -EPERM;
72349 goto out;
72350diff -urNp linux-2.6.39/mm/mlock.c linux-2.6.39/mm/mlock.c
72351--- linux-2.6.39/mm/mlock.c 2011-05-19 00:06:34.000000000 -0400
72352+++ linux-2.6.39/mm/mlock.c 2011-05-22 19:41:42.000000000 -0400
72353@@ -13,6 +13,7 @@
72354 #include <linux/pagemap.h>
72355 #include <linux/mempolicy.h>
72356 #include <linux/syscalls.h>
72357+#include <linux/security.h>
72358 #include <linux/sched.h>
72359 #include <linux/module.h>
72360 #include <linux/rmap.h>
72361@@ -377,6 +378,9 @@ static int do_mlock(unsigned long start,
72362 return -EINVAL;
72363 if (end == start)
72364 return 0;
72365+ if (end > TASK_SIZE)
72366+ return -EINVAL;
72367+
72368 vma = find_vma_prev(current->mm, start, &prev);
72369 if (!vma || vma->vm_start > start)
72370 return -ENOMEM;
72371@@ -387,6 +391,11 @@ static int do_mlock(unsigned long start,
72372 for (nstart = start ; ; ) {
72373 unsigned int newflags;
72374
72375+#ifdef CONFIG_PAX_SEGMEXEC
72376+ if ((current->mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE))
72377+ break;
72378+#endif
72379+
72380 /* Here we know that vma->vm_start <= nstart < vma->vm_end. */
72381
72382 newflags = vma->vm_flags | VM_LOCKED;
72383@@ -492,6 +501,7 @@ SYSCALL_DEFINE2(mlock, unsigned long, st
72384 lock_limit >>= PAGE_SHIFT;
72385
72386 /* check against resource limits */
72387+ gr_learn_resource(current, RLIMIT_MEMLOCK, (current->mm->locked_vm << PAGE_SHIFT) + len, 1);
72388 if ((locked <= lock_limit) || capable(CAP_IPC_LOCK))
72389 error = do_mlock(start, len, 1);
72390 up_write(&current->mm->mmap_sem);
72391@@ -515,17 +525,23 @@ SYSCALL_DEFINE2(munlock, unsigned long,
72392 static int do_mlockall(int flags)
72393 {
72394 struct vm_area_struct * vma, * prev = NULL;
72395- unsigned int def_flags = 0;
72396
72397 if (flags & MCL_FUTURE)
72398- def_flags = VM_LOCKED;
72399- current->mm->def_flags = def_flags;
72400+ current->mm->def_flags |= VM_LOCKED;
72401+ else
72402+ current->mm->def_flags &= ~VM_LOCKED;
72403 if (flags == MCL_FUTURE)
72404 goto out;
72405
72406 for (vma = current->mm->mmap; vma ; vma = prev->vm_next) {
72407- unsigned int newflags;
72408+ unsigned long newflags;
72409+
72410+#ifdef CONFIG_PAX_SEGMEXEC
72411+ if ((current->mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE))
72412+ break;
72413+#endif
72414
72415+ BUG_ON(vma->vm_end > TASK_SIZE);
72416 newflags = vma->vm_flags | VM_LOCKED;
72417 if (!(flags & MCL_CURRENT))
72418 newflags &= ~VM_LOCKED;
72419@@ -557,6 +573,7 @@ SYSCALL_DEFINE1(mlockall, int, flags)
72420 lock_limit >>= PAGE_SHIFT;
72421
72422 ret = -ENOMEM;
72423+ gr_learn_resource(current, RLIMIT_MEMLOCK, current->mm->total_vm << PAGE_SHIFT, 1);
72424 if (!(flags & MCL_CURRENT) || (current->mm->total_vm <= lock_limit) ||
72425 capable(CAP_IPC_LOCK))
72426 ret = do_mlockall(flags);
72427diff -urNp linux-2.6.39/mm/mmap.c linux-2.6.39/mm/mmap.c
72428--- linux-2.6.39/mm/mmap.c 2011-05-19 00:06:34.000000000 -0400
72429+++ linux-2.6.39/mm/mmap.c 2011-05-22 19:41:42.000000000 -0400
72430@@ -46,6 +46,16 @@
72431 #define arch_rebalance_pgtables(addr, len) (addr)
72432 #endif
72433
72434+static inline void verify_mm_writelocked(struct mm_struct *mm)
72435+{
72436+#if defined(CONFIG_DEBUG_VM) || defined(CONFIG_PAX)
72437+ if (unlikely(down_read_trylock(&mm->mmap_sem))) {
72438+ up_read(&mm->mmap_sem);
72439+ BUG();
72440+ }
72441+#endif
72442+}
72443+
72444 static void unmap_region(struct mm_struct *mm,
72445 struct vm_area_struct *vma, struct vm_area_struct *prev,
72446 unsigned long start, unsigned long end);
72447@@ -71,22 +81,32 @@ static void unmap_region(struct mm_struc
72448 * x: (no) no x: (no) yes x: (no) yes x: (yes) yes
72449 *
72450 */
72451-pgprot_t protection_map[16] = {
72452+pgprot_t protection_map[16] __read_only = {
72453 __P000, __P001, __P010, __P011, __P100, __P101, __P110, __P111,
72454 __S000, __S001, __S010, __S011, __S100, __S101, __S110, __S111
72455 };
72456
72457 pgprot_t vm_get_page_prot(unsigned long vm_flags)
72458 {
72459- return __pgprot(pgprot_val(protection_map[vm_flags &
72460+ pgprot_t prot = __pgprot(pgprot_val(protection_map[vm_flags &
72461 (VM_READ|VM_WRITE|VM_EXEC|VM_SHARED)]) |
72462 pgprot_val(arch_vm_get_page_prot(vm_flags)));
72463+
72464+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
72465+ if (!(__supported_pte_mask & _PAGE_NX) &&
72466+ (vm_flags & (VM_PAGEEXEC | VM_EXEC)) == VM_PAGEEXEC &&
72467+ (vm_flags & (VM_READ | VM_WRITE)))
72468+ prot = __pgprot(pte_val(pte_exprotect(__pte(pgprot_val(prot)))));
72469+#endif
72470+
72471+ return prot;
72472 }
72473 EXPORT_SYMBOL(vm_get_page_prot);
72474
72475 int sysctl_overcommit_memory = OVERCOMMIT_GUESS; /* heuristic overcommit */
72476 int sysctl_overcommit_ratio = 50; /* default is 50% */
72477 int sysctl_max_map_count __read_mostly = DEFAULT_MAX_MAP_COUNT;
72478+unsigned long sysctl_heap_stack_gap __read_mostly = 64*1024;
72479 struct percpu_counter vm_committed_as;
72480
72481 /*
72482@@ -232,6 +252,7 @@ static struct vm_area_struct *remove_vma
72483 struct vm_area_struct *next = vma->vm_next;
72484
72485 might_sleep();
72486+ BUG_ON(vma->vm_mirror);
72487 if (vma->vm_ops && vma->vm_ops->close)
72488 vma->vm_ops->close(vma);
72489 if (vma->vm_file) {
72490@@ -276,6 +297,7 @@ SYSCALL_DEFINE1(brk, unsigned long, brk)
72491 * not page aligned -Ram Gupta
72492 */
72493 rlim = rlimit(RLIMIT_DATA);
72494+ gr_learn_resource(current, RLIMIT_DATA, (brk - mm->start_brk) + (mm->end_data - mm->start_data), 1);
72495 if (rlim < RLIM_INFINITY && (brk - mm->start_brk) +
72496 (mm->end_data - mm->start_data) > rlim)
72497 goto out;
72498@@ -719,6 +741,12 @@ static int
72499 can_vma_merge_before(struct vm_area_struct *vma, unsigned long vm_flags,
72500 struct anon_vma *anon_vma, struct file *file, pgoff_t vm_pgoff)
72501 {
72502+
72503+#ifdef CONFIG_PAX_SEGMEXEC
72504+ if ((vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_start == SEGMEXEC_TASK_SIZE)
72505+ return 0;
72506+#endif
72507+
72508 if (is_mergeable_vma(vma, file, vm_flags) &&
72509 is_mergeable_anon_vma(anon_vma, vma->anon_vma)) {
72510 if (vma->vm_pgoff == vm_pgoff)
72511@@ -738,6 +766,12 @@ static int
72512 can_vma_merge_after(struct vm_area_struct *vma, unsigned long vm_flags,
72513 struct anon_vma *anon_vma, struct file *file, pgoff_t vm_pgoff)
72514 {
72515+
72516+#ifdef CONFIG_PAX_SEGMEXEC
72517+ if ((vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_end == SEGMEXEC_TASK_SIZE)
72518+ return 0;
72519+#endif
72520+
72521 if (is_mergeable_vma(vma, file, vm_flags) &&
72522 is_mergeable_anon_vma(anon_vma, vma->anon_vma)) {
72523 pgoff_t vm_pglen;
72524@@ -780,13 +814,20 @@ can_vma_merge_after(struct vm_area_struc
72525 struct vm_area_struct *vma_merge(struct mm_struct *mm,
72526 struct vm_area_struct *prev, unsigned long addr,
72527 unsigned long end, unsigned long vm_flags,
72528- struct anon_vma *anon_vma, struct file *file,
72529+ struct anon_vma *anon_vma, struct file *file,
72530 pgoff_t pgoff, struct mempolicy *policy)
72531 {
72532 pgoff_t pglen = (end - addr) >> PAGE_SHIFT;
72533 struct vm_area_struct *area, *next;
72534 int err;
72535
72536+#ifdef CONFIG_PAX_SEGMEXEC
72537+ unsigned long addr_m = addr + SEGMEXEC_TASK_SIZE, end_m = end + SEGMEXEC_TASK_SIZE;
72538+ struct vm_area_struct *area_m = NULL, *next_m = NULL, *prev_m = NULL;
72539+
72540+ BUG_ON((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE < end);
72541+#endif
72542+
72543 /*
72544 * We later require that vma->vm_flags == vm_flags,
72545 * so this tests vma->vm_flags & VM_SPECIAL, too.
72546@@ -802,6 +843,15 @@ struct vm_area_struct *vma_merge(struct
72547 if (next && next->vm_end == end) /* cases 6, 7, 8 */
72548 next = next->vm_next;
72549
72550+#ifdef CONFIG_PAX_SEGMEXEC
72551+ if (prev)
72552+ prev_m = pax_find_mirror_vma(prev);
72553+ if (area)
72554+ area_m = pax_find_mirror_vma(area);
72555+ if (next)
72556+ next_m = pax_find_mirror_vma(next);
72557+#endif
72558+
72559 /*
72560 * Can it merge with the predecessor?
72561 */
72562@@ -821,9 +871,24 @@ struct vm_area_struct *vma_merge(struct
72563 /* cases 1, 6 */
72564 err = vma_adjust(prev, prev->vm_start,
72565 next->vm_end, prev->vm_pgoff, NULL);
72566- } else /* cases 2, 5, 7 */
72567+
72568+#ifdef CONFIG_PAX_SEGMEXEC
72569+ if (!err && prev_m)
72570+ err = vma_adjust(prev_m, prev_m->vm_start,
72571+ next_m->vm_end, prev_m->vm_pgoff, NULL);
72572+#endif
72573+
72574+ } else { /* cases 2, 5, 7 */
72575 err = vma_adjust(prev, prev->vm_start,
72576 end, prev->vm_pgoff, NULL);
72577+
72578+#ifdef CONFIG_PAX_SEGMEXEC
72579+ if (!err && prev_m)
72580+ err = vma_adjust(prev_m, prev_m->vm_start,
72581+ end_m, prev_m->vm_pgoff, NULL);
72582+#endif
72583+
72584+ }
72585 if (err)
72586 return NULL;
72587 khugepaged_enter_vma_merge(prev);
72588@@ -837,12 +902,27 @@ struct vm_area_struct *vma_merge(struct
72589 mpol_equal(policy, vma_policy(next)) &&
72590 can_vma_merge_before(next, vm_flags,
72591 anon_vma, file, pgoff+pglen)) {
72592- if (prev && addr < prev->vm_end) /* case 4 */
72593+ if (prev && addr < prev->vm_end) { /* case 4 */
72594 err = vma_adjust(prev, prev->vm_start,
72595 addr, prev->vm_pgoff, NULL);
72596- else /* cases 3, 8 */
72597+
72598+#ifdef CONFIG_PAX_SEGMEXEC
72599+ if (!err && prev_m)
72600+ err = vma_adjust(prev_m, prev_m->vm_start,
72601+ addr_m, prev_m->vm_pgoff, NULL);
72602+#endif
72603+
72604+ } else { /* cases 3, 8 */
72605 err = vma_adjust(area, addr, next->vm_end,
72606 next->vm_pgoff - pglen, NULL);
72607+
72608+#ifdef CONFIG_PAX_SEGMEXEC
72609+ if (!err && area_m)
72610+ err = vma_adjust(area_m, addr_m, next_m->vm_end,
72611+ next_m->vm_pgoff - pglen, NULL);
72612+#endif
72613+
72614+ }
72615 if (err)
72616 return NULL;
72617 khugepaged_enter_vma_merge(area);
72618@@ -958,14 +1038,11 @@ none:
72619 void vm_stat_account(struct mm_struct *mm, unsigned long flags,
72620 struct file *file, long pages)
72621 {
72622- const unsigned long stack_flags
72623- = VM_STACK_FLAGS & (VM_GROWSUP|VM_GROWSDOWN);
72624-
72625 if (file) {
72626 mm->shared_vm += pages;
72627 if ((flags & (VM_EXEC|VM_WRITE)) == VM_EXEC)
72628 mm->exec_vm += pages;
72629- } else if (flags & stack_flags)
72630+ } else if (flags & (VM_GROWSUP|VM_GROWSDOWN))
72631 mm->stack_vm += pages;
72632 if (flags & (VM_RESERVED|VM_IO))
72633 mm->reserved_vm += pages;
72634@@ -992,7 +1069,7 @@ unsigned long do_mmap_pgoff(struct file
72635 * (the exception is when the underlying filesystem is noexec
72636 * mounted, in which case we dont add PROT_EXEC.)
72637 */
72638- if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
72639+ if ((prot & (PROT_READ | PROT_WRITE)) && (current->personality & READ_IMPLIES_EXEC))
72640 if (!(file && (file->f_path.mnt->mnt_flags & MNT_NOEXEC)))
72641 prot |= PROT_EXEC;
72642
72643@@ -1018,7 +1095,7 @@ unsigned long do_mmap_pgoff(struct file
72644 /* Obtain the address to map to. we verify (or select) it and ensure
72645 * that it represents a valid section of the address space.
72646 */
72647- addr = get_unmapped_area(file, addr, len, pgoff, flags);
72648+ addr = get_unmapped_area(file, addr, len, pgoff, flags | ((prot & PROT_EXEC) ? MAP_EXECUTABLE : 0));
72649 if (addr & ~PAGE_MASK)
72650 return addr;
72651
72652@@ -1029,6 +1106,36 @@ unsigned long do_mmap_pgoff(struct file
72653 vm_flags = calc_vm_prot_bits(prot) | calc_vm_flag_bits(flags) |
72654 mm->def_flags | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC;
72655
72656+#ifdef CONFIG_PAX_MPROTECT
72657+ if (mm->pax_flags & MF_PAX_MPROTECT) {
72658+#ifndef CONFIG_PAX_MPROTECT_COMPAT
72659+ if ((vm_flags & (VM_WRITE | VM_EXEC)) == (VM_WRITE | VM_EXEC)) {
72660+ gr_log_rwxmmap(file);
72661+
72662+#ifdef CONFIG_PAX_EMUPLT
72663+ vm_flags &= ~VM_EXEC;
72664+#else
72665+ return -EPERM;
72666+#endif
72667+
72668+ }
72669+
72670+ if (!(vm_flags & VM_EXEC))
72671+ vm_flags &= ~VM_MAYEXEC;
72672+#else
72673+ if ((vm_flags & (VM_WRITE | VM_EXEC)) != VM_EXEC)
72674+ vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
72675+#endif
72676+ else
72677+ vm_flags &= ~VM_MAYWRITE;
72678+ }
72679+#endif
72680+
72681+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
72682+ if ((mm->pax_flags & MF_PAX_PAGEEXEC) && file)
72683+ vm_flags &= ~VM_PAGEEXEC;
72684+#endif
72685+
72686 if (flags & MAP_LOCKED)
72687 if (!can_do_mlock())
72688 return -EPERM;
72689@@ -1040,6 +1147,7 @@ unsigned long do_mmap_pgoff(struct file
72690 locked += mm->locked_vm;
72691 lock_limit = rlimit(RLIMIT_MEMLOCK);
72692 lock_limit >>= PAGE_SHIFT;
72693+ gr_learn_resource(current, RLIMIT_MEMLOCK, locked << PAGE_SHIFT, 1);
72694 if (locked > lock_limit && !capable(CAP_IPC_LOCK))
72695 return -EAGAIN;
72696 }
72697@@ -1110,6 +1218,9 @@ unsigned long do_mmap_pgoff(struct file
72698 if (error)
72699 return error;
72700
72701+ if (!gr_acl_handle_mmap(file, prot))
72702+ return -EACCES;
72703+
72704 return mmap_region(file, addr, len, flags, vm_flags, pgoff);
72705 }
72706 EXPORT_SYMBOL(do_mmap_pgoff);
72707@@ -1187,10 +1298,10 @@ SYSCALL_DEFINE1(old_mmap, struct mmap_ar
72708 */
72709 int vma_wants_writenotify(struct vm_area_struct *vma)
72710 {
72711- unsigned int vm_flags = vma->vm_flags;
72712+ unsigned long vm_flags = vma->vm_flags;
72713
72714 /* If it was private or non-writable, the write bit is already clear */
72715- if ((vm_flags & (VM_WRITE|VM_SHARED)) != ((VM_WRITE|VM_SHARED)))
72716+ if ((vm_flags & (VM_WRITE|VM_SHARED)) != (VM_WRITE|VM_SHARED))
72717 return 0;
72718
72719 /* The backer wishes to know when pages are first written to? */
72720@@ -1239,14 +1350,24 @@ unsigned long mmap_region(struct file *f
72721 unsigned long charged = 0;
72722 struct inode *inode = file ? file->f_path.dentry->d_inode : NULL;
72723
72724+#ifdef CONFIG_PAX_SEGMEXEC
72725+ struct vm_area_struct *vma_m = NULL;
72726+#endif
72727+
72728+ /*
72729+ * mm->mmap_sem is required to protect against another thread
72730+ * changing the mappings in case we sleep.
72731+ */
72732+ verify_mm_writelocked(mm);
72733+
72734 /* Clear old maps */
72735 error = -ENOMEM;
72736-munmap_back:
72737 vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
72738 if (vma && vma->vm_start < addr + len) {
72739 if (do_munmap(mm, addr, len))
72740 return -ENOMEM;
72741- goto munmap_back;
72742+ vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
72743+ BUG_ON(vma && vma->vm_start < addr + len);
72744 }
72745
72746 /* Check against address space limit. */
72747@@ -1295,6 +1416,16 @@ munmap_back:
72748 goto unacct_error;
72749 }
72750
72751+#ifdef CONFIG_PAX_SEGMEXEC
72752+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vm_flags & VM_EXEC)) {
72753+ vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
72754+ if (!vma_m) {
72755+ error = -ENOMEM;
72756+ goto free_vma;
72757+ }
72758+ }
72759+#endif
72760+
72761 vma->vm_mm = mm;
72762 vma->vm_start = addr;
72763 vma->vm_end = addr + len;
72764@@ -1318,6 +1449,19 @@ munmap_back:
72765 error = file->f_op->mmap(file, vma);
72766 if (error)
72767 goto unmap_and_free_vma;
72768+
72769+#ifdef CONFIG_PAX_SEGMEXEC
72770+ if (vma_m && (vm_flags & VM_EXECUTABLE))
72771+ added_exe_file_vma(mm);
72772+#endif
72773+
72774+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
72775+ if ((mm->pax_flags & MF_PAX_PAGEEXEC) && !(vma->vm_flags & VM_SPECIAL)) {
72776+ vma->vm_flags |= VM_PAGEEXEC;
72777+ vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
72778+ }
72779+#endif
72780+
72781 if (vm_flags & VM_EXECUTABLE)
72782 added_exe_file_vma(mm);
72783
72784@@ -1353,6 +1497,11 @@ munmap_back:
72785 vma_link(mm, vma, prev, rb_link, rb_parent);
72786 file = vma->vm_file;
72787
72788+#ifdef CONFIG_PAX_SEGMEXEC
72789+ if (vma_m)
72790+ BUG_ON(pax_mirror_vma(vma_m, vma));
72791+#endif
72792+
72793 /* Once vma denies write, undo our temporary denial count */
72794 if (correct_wcount)
72795 atomic_inc(&inode->i_writecount);
72796@@ -1361,6 +1510,7 @@ out:
72797
72798 mm->total_vm += len >> PAGE_SHIFT;
72799 vm_stat_account(mm, vm_flags, file, len >> PAGE_SHIFT);
72800+ track_exec_limit(mm, addr, addr + len, vm_flags);
72801 if (vm_flags & VM_LOCKED) {
72802 if (!mlock_vma_pages_range(vma, addr, addr + len))
72803 mm->locked_vm += (len >> PAGE_SHIFT);
72804@@ -1378,6 +1528,12 @@ unmap_and_free_vma:
72805 unmap_region(mm, vma, prev, vma->vm_start, vma->vm_end);
72806 charged = 0;
72807 free_vma:
72808+
72809+#ifdef CONFIG_PAX_SEGMEXEC
72810+ if (vma_m)
72811+ kmem_cache_free(vm_area_cachep, vma_m);
72812+#endif
72813+
72814 kmem_cache_free(vm_area_cachep, vma);
72815 unacct_error:
72816 if (charged)
72817@@ -1385,6 +1541,44 @@ unacct_error:
72818 return error;
72819 }
72820
72821+bool check_heap_stack_gap(const struct vm_area_struct *vma, unsigned long addr, unsigned long len)
72822+{
72823+ if (!vma) {
72824+#ifdef CONFIG_STACK_GROWSUP
72825+ if (addr > sysctl_heap_stack_gap)
72826+ vma = find_vma(current->mm, addr - sysctl_heap_stack_gap);
72827+ else
72828+ vma = find_vma(current->mm, 0);
72829+ if (vma && (vma->vm_flags & VM_GROWSUP))
72830+ return false;
72831+#endif
72832+ return true;
72833+ }
72834+
72835+ if (addr + len > vma->vm_start)
72836+ return false;
72837+
72838+ if (vma->vm_flags & VM_GROWSDOWN)
72839+ return sysctl_heap_stack_gap <= vma->vm_start - addr - len;
72840+#ifdef CONFIG_STACK_GROWSUP
72841+ else if (vma->vm_prev && (vma->vm_prev->vm_flags & VM_GROWSUP))
72842+ return addr - vma->vm_prev->vm_end <= sysctl_heap_stack_gap;
72843+#endif
72844+
72845+ return true;
72846+}
72847+
72848+unsigned long skip_heap_stack_gap(const struct vm_area_struct *vma, unsigned long len)
72849+{
72850+ if (vma->vm_start < len)
72851+ return -ENOMEM;
72852+ if (!(vma->vm_flags & VM_GROWSDOWN))
72853+ return vma->vm_start - len;
72854+ if (sysctl_heap_stack_gap <= vma->vm_start - len)
72855+ return vma->vm_start - len - sysctl_heap_stack_gap;
72856+ return -ENOMEM;
72857+}
72858+
72859 /* Get an address range which is currently unmapped.
72860 * For shmat() with addr=0.
72861 *
72862@@ -1411,18 +1605,23 @@ arch_get_unmapped_area(struct file *filp
72863 if (flags & MAP_FIXED)
72864 return addr;
72865
72866+#ifdef CONFIG_PAX_RANDMMAP
72867+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
72868+#endif
72869+
72870 if (addr) {
72871 addr = PAGE_ALIGN(addr);
72872- vma = find_vma(mm, addr);
72873- if (TASK_SIZE - len >= addr &&
72874- (!vma || addr + len <= vma->vm_start))
72875- return addr;
72876+ if (TASK_SIZE - len >= addr) {
72877+ vma = find_vma(mm, addr);
72878+ if (check_heap_stack_gap(vma, addr, len))
72879+ return addr;
72880+ }
72881 }
72882 if (len > mm->cached_hole_size) {
72883- start_addr = addr = mm->free_area_cache;
72884+ start_addr = addr = mm->free_area_cache;
72885 } else {
72886- start_addr = addr = TASK_UNMAPPED_BASE;
72887- mm->cached_hole_size = 0;
72888+ start_addr = addr = mm->mmap_base;
72889+ mm->cached_hole_size = 0;
72890 }
72891
72892 full_search:
72893@@ -1433,34 +1632,40 @@ full_search:
72894 * Start a new search - just in case we missed
72895 * some holes.
72896 */
72897- if (start_addr != TASK_UNMAPPED_BASE) {
72898- addr = TASK_UNMAPPED_BASE;
72899- start_addr = addr;
72900+ if (start_addr != mm->mmap_base) {
72901+ start_addr = addr = mm->mmap_base;
72902 mm->cached_hole_size = 0;
72903 goto full_search;
72904 }
72905 return -ENOMEM;
72906 }
72907- if (!vma || addr + len <= vma->vm_start) {
72908- /*
72909- * Remember the place where we stopped the search:
72910- */
72911- mm->free_area_cache = addr + len;
72912- return addr;
72913- }
72914+ if (check_heap_stack_gap(vma, addr, len))
72915+ break;
72916 if (addr + mm->cached_hole_size < vma->vm_start)
72917 mm->cached_hole_size = vma->vm_start - addr;
72918 addr = vma->vm_end;
72919 }
72920+
72921+ /*
72922+ * Remember the place where we stopped the search:
72923+ */
72924+ mm->free_area_cache = addr + len;
72925+ return addr;
72926 }
72927 #endif
72928
72929 void arch_unmap_area(struct mm_struct *mm, unsigned long addr)
72930 {
72931+
72932+#ifdef CONFIG_PAX_SEGMEXEC
72933+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE <= addr)
72934+ return;
72935+#endif
72936+
72937 /*
72938 * Is this a new hole at the lowest possible address?
72939 */
72940- if (addr >= TASK_UNMAPPED_BASE && addr < mm->free_area_cache) {
72941+ if (addr >= mm->mmap_base && addr < mm->free_area_cache) {
72942 mm->free_area_cache = addr;
72943 mm->cached_hole_size = ~0UL;
72944 }
72945@@ -1478,7 +1683,7 @@ arch_get_unmapped_area_topdown(struct fi
72946 {
72947 struct vm_area_struct *vma;
72948 struct mm_struct *mm = current->mm;
72949- unsigned long addr = addr0;
72950+ unsigned long base = mm->mmap_base, addr = addr0;
72951
72952 /* requested length too big for entire address space */
72953 if (len > TASK_SIZE)
72954@@ -1487,13 +1692,18 @@ arch_get_unmapped_area_topdown(struct fi
72955 if (flags & MAP_FIXED)
72956 return addr;
72957
72958+#ifdef CONFIG_PAX_RANDMMAP
72959+ if (!(mm->pax_flags & MF_PAX_RANDMMAP))
72960+#endif
72961+
72962 /* requesting a specific address */
72963 if (addr) {
72964 addr = PAGE_ALIGN(addr);
72965- vma = find_vma(mm, addr);
72966- if (TASK_SIZE - len >= addr &&
72967- (!vma || addr + len <= vma->vm_start))
72968- return addr;
72969+ if (TASK_SIZE - len >= addr) {
72970+ vma = find_vma(mm, addr);
72971+ if (check_heap_stack_gap(vma, addr, len))
72972+ return addr;
72973+ }
72974 }
72975
72976 /* check if free_area_cache is useful for us */
72977@@ -1508,7 +1718,7 @@ arch_get_unmapped_area_topdown(struct fi
72978 /* make sure it can fit in the remaining address space */
72979 if (addr > len) {
72980 vma = find_vma(mm, addr-len);
72981- if (!vma || addr <= vma->vm_start)
72982+ if (check_heap_stack_gap(vma, addr - len, len))
72983 /* remember the address as a hint for next time */
72984 return (mm->free_area_cache = addr-len);
72985 }
72986@@ -1525,7 +1735,7 @@ arch_get_unmapped_area_topdown(struct fi
72987 * return with success:
72988 */
72989 vma = find_vma(mm, addr);
72990- if (!vma || addr+len <= vma->vm_start)
72991+ if (check_heap_stack_gap(vma, addr, len))
72992 /* remember the address as a hint for next time */
72993 return (mm->free_area_cache = addr);
72994
72995@@ -1534,8 +1744,8 @@ arch_get_unmapped_area_topdown(struct fi
72996 mm->cached_hole_size = vma->vm_start - addr;
72997
72998 /* try just below the current vma->vm_start */
72999- addr = vma->vm_start-len;
73000- } while (len < vma->vm_start);
73001+ addr = skip_heap_stack_gap(vma, len);
73002+ } while (!IS_ERR_VALUE(addr));
73003
73004 bottomup:
73005 /*
73006@@ -1544,13 +1754,21 @@ bottomup:
73007 * can happen with large stack limits and large mmap()
73008 * allocations.
73009 */
73010+ mm->mmap_base = TASK_UNMAPPED_BASE;
73011+
73012+#ifdef CONFIG_PAX_RANDMMAP
73013+ if (mm->pax_flags & MF_PAX_RANDMMAP)
73014+ mm->mmap_base += mm->delta_mmap;
73015+#endif
73016+
73017+ mm->free_area_cache = mm->mmap_base;
73018 mm->cached_hole_size = ~0UL;
73019- mm->free_area_cache = TASK_UNMAPPED_BASE;
73020 addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
73021 /*
73022 * Restore the topdown base:
73023 */
73024- mm->free_area_cache = mm->mmap_base;
73025+ mm->mmap_base = base;
73026+ mm->free_area_cache = base;
73027 mm->cached_hole_size = ~0UL;
73028
73029 return addr;
73030@@ -1559,6 +1777,12 @@ bottomup:
73031
73032 void arch_unmap_area_topdown(struct mm_struct *mm, unsigned long addr)
73033 {
73034+
73035+#ifdef CONFIG_PAX_SEGMEXEC
73036+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE <= addr)
73037+ return;
73038+#endif
73039+
73040 /*
73041 * Is this a new hole at the highest possible address?
73042 */
73043@@ -1566,8 +1790,10 @@ void arch_unmap_area_topdown(struct mm_s
73044 mm->free_area_cache = addr;
73045
73046 /* dont allow allocations above current base */
73047- if (mm->free_area_cache > mm->mmap_base)
73048+ if (mm->free_area_cache > mm->mmap_base) {
73049 mm->free_area_cache = mm->mmap_base;
73050+ mm->cached_hole_size = ~0UL;
73051+ }
73052 }
73053
73054 unsigned long
73055@@ -1675,6 +1901,28 @@ out:
73056 return prev ? prev->vm_next : vma;
73057 }
73058
73059+#ifdef CONFIG_PAX_SEGMEXEC
73060+struct vm_area_struct *pax_find_mirror_vma(struct vm_area_struct *vma)
73061+{
73062+ struct vm_area_struct *vma_m;
73063+
73064+ BUG_ON(!vma || vma->vm_start >= vma->vm_end);
73065+ if (!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) || !(vma->vm_flags & VM_EXEC)) {
73066+ BUG_ON(vma->vm_mirror);
73067+ return NULL;
73068+ }
73069+ BUG_ON(vma->vm_start < SEGMEXEC_TASK_SIZE && SEGMEXEC_TASK_SIZE < vma->vm_end);
73070+ vma_m = vma->vm_mirror;
73071+ BUG_ON(!vma_m || vma_m->vm_mirror != vma);
73072+ BUG_ON(vma->vm_file != vma_m->vm_file);
73073+ BUG_ON(vma->vm_end - vma->vm_start != vma_m->vm_end - vma_m->vm_start);
73074+ BUG_ON(vma->vm_pgoff != vma_m->vm_pgoff);
73075+ BUG_ON(vma->anon_vma != vma_m->anon_vma && vma->anon_vma->root != vma_m->anon_vma->root);
73076+ BUG_ON((vma->vm_flags ^ vma_m->vm_flags) & ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT | VM_LOCKED | VM_RESERVED));
73077+ return vma_m;
73078+}
73079+#endif
73080+
73081 /*
73082 * Verify that the stack growth is acceptable and
73083 * update accounting. This is shared with both the
73084@@ -1691,6 +1939,7 @@ static int acct_stack_growth(struct vm_a
73085 return -ENOMEM;
73086
73087 /* Stack limit test */
73088+ gr_learn_resource(current, RLIMIT_STACK, size, 1);
73089 if (size > ACCESS_ONCE(rlim[RLIMIT_STACK].rlim_cur))
73090 return -ENOMEM;
73091
73092@@ -1701,6 +1950,7 @@ static int acct_stack_growth(struct vm_a
73093 locked = mm->locked_vm + grow;
73094 limit = ACCESS_ONCE(rlim[RLIMIT_MEMLOCK].rlim_cur);
73095 limit >>= PAGE_SHIFT;
73096+ gr_learn_resource(current, RLIMIT_MEMLOCK, locked << PAGE_SHIFT, 1);
73097 if (locked > limit && !capable(CAP_IPC_LOCK))
73098 return -ENOMEM;
73099 }
73100@@ -1731,37 +1981,48 @@ static int acct_stack_growth(struct vm_a
73101 * PA-RISC uses this for its stack; IA64 for its Register Backing Store.
73102 * vma is the last one with address > vma->vm_end. Have to extend vma.
73103 */
73104+#ifndef CONFIG_IA64
73105+static
73106+#endif
73107 int expand_upwards(struct vm_area_struct *vma, unsigned long address)
73108 {
73109 int error;
73110+ bool locknext;
73111
73112 if (!(vma->vm_flags & VM_GROWSUP))
73113 return -EFAULT;
73114
73115+ /* Also guard against wrapping around to address 0. */
73116+ if (address < PAGE_ALIGN(address+1))
73117+ address = PAGE_ALIGN(address+1);
73118+ else
73119+ return -ENOMEM;
73120+
73121 /*
73122 * We must make sure the anon_vma is allocated
73123 * so that the anon_vma locking is not a noop.
73124 */
73125 if (unlikely(anon_vma_prepare(vma)))
73126 return -ENOMEM;
73127+ locknext = vma->vm_next && (vma->vm_next->vm_flags & VM_GROWSDOWN);
73128+ if (locknext && anon_vma_prepare(vma->vm_next))
73129+ return -ENOMEM;
73130 vma_lock_anon_vma(vma);
73131+ if (locknext)
73132+ vma_lock_anon_vma(vma->vm_next);
73133
73134 /*
73135 * vma->vm_start/vm_end cannot change under us because the caller
73136 * is required to hold the mmap_sem in read mode. We need the
73137- * anon_vma lock to serialize against concurrent expand_stacks.
73138- * Also guard against wrapping around to address 0.
73139+ * anon_vma locks to serialize against concurrent expand_stacks
73140+ * and expand_upwards.
73141 */
73142- if (address < PAGE_ALIGN(address+4))
73143- address = PAGE_ALIGN(address+4);
73144- else {
73145- vma_unlock_anon_vma(vma);
73146- return -ENOMEM;
73147- }
73148 error = 0;
73149
73150 /* Somebody else might have raced and expanded it already */
73151- if (address > vma->vm_end) {
73152+ if (vma->vm_next && (vma->vm_next->vm_flags & (VM_READ | VM_WRITE | VM_EXEC)) && vma->vm_next->vm_start - address < sysctl_heap_stack_gap)
73153+ error = -ENOMEM;
73154+ else if (address > vma->vm_end && (!locknext || vma->vm_next->vm_start >= address)) {
73155 unsigned long size, grow;
73156
73157 size = address - vma->vm_start;
73158@@ -1776,6 +2037,8 @@ int expand_upwards(struct vm_area_struct
73159 }
73160 }
73161 }
73162+ if (locknext)
73163+ vma_unlock_anon_vma(vma->vm_next);
73164 vma_unlock_anon_vma(vma);
73165 khugepaged_enter_vma_merge(vma);
73166 return error;
73167@@ -1789,6 +2052,8 @@ static int expand_downwards(struct vm_ar
73168 unsigned long address)
73169 {
73170 int error;
73171+ bool lockprev = false;
73172+ struct vm_area_struct *prev;
73173
73174 /*
73175 * We must make sure the anon_vma is allocated
73176@@ -1802,6 +2067,15 @@ static int expand_downwards(struct vm_ar
73177 if (error)
73178 return error;
73179
73180+ prev = vma->vm_prev;
73181+#if defined(CONFIG_STACK_GROWSUP) || defined(CONFIG_IA64)
73182+ lockprev = prev && (prev->vm_flags & VM_GROWSUP);
73183+#endif
73184+ if (lockprev && anon_vma_prepare(prev))
73185+ return -ENOMEM;
73186+ if (lockprev)
73187+ vma_lock_anon_vma(prev);
73188+
73189 vma_lock_anon_vma(vma);
73190
73191 /*
73192@@ -1811,9 +2085,17 @@ static int expand_downwards(struct vm_ar
73193 */
73194
73195 /* Somebody else might have raced and expanded it already */
73196- if (address < vma->vm_start) {
73197+ if (prev && (prev->vm_flags & (VM_READ | VM_WRITE | VM_EXEC)) && address - prev->vm_end < sysctl_heap_stack_gap)
73198+ error = -ENOMEM;
73199+ else if (address < vma->vm_start && (!lockprev || prev->vm_end <= address)) {
73200 unsigned long size, grow;
73201
73202+#ifdef CONFIG_PAX_SEGMEXEC
73203+ struct vm_area_struct *vma_m;
73204+
73205+ vma_m = pax_find_mirror_vma(vma);
73206+#endif
73207+
73208 size = vma->vm_end - address;
73209 grow = (vma->vm_start - address) >> PAGE_SHIFT;
73210
73211@@ -1823,11 +2105,22 @@ static int expand_downwards(struct vm_ar
73212 if (!error) {
73213 vma->vm_start = address;
73214 vma->vm_pgoff -= grow;
73215+ track_exec_limit(vma->vm_mm, vma->vm_start, vma->vm_end, vma->vm_flags);
73216+
73217+#ifdef CONFIG_PAX_SEGMEXEC
73218+ if (vma_m) {
73219+ vma_m->vm_start -= grow << PAGE_SHIFT;
73220+ vma_m->vm_pgoff -= grow;
73221+ }
73222+#endif
73223+
73224 perf_event_mmap(vma);
73225 }
73226 }
73227 }
73228 vma_unlock_anon_vma(vma);
73229+ if (lockprev)
73230+ vma_unlock_anon_vma(prev);
73231 khugepaged_enter_vma_merge(vma);
73232 return error;
73233 }
73234@@ -1902,6 +2195,13 @@ static void remove_vma_list(struct mm_st
73235 do {
73236 long nrpages = vma_pages(vma);
73237
73238+#ifdef CONFIG_PAX_SEGMEXEC
73239+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE)) {
73240+ vma = remove_vma(vma);
73241+ continue;
73242+ }
73243+#endif
73244+
73245 mm->total_vm -= nrpages;
73246 vm_stat_account(mm, vma->vm_flags, vma->vm_file, -nrpages);
73247 vma = remove_vma(vma);
73248@@ -1947,6 +2247,16 @@ detach_vmas_to_be_unmapped(struct mm_str
73249 insertion_point = (prev ? &prev->vm_next : &mm->mmap);
73250 vma->vm_prev = NULL;
73251 do {
73252+
73253+#ifdef CONFIG_PAX_SEGMEXEC
73254+ if (vma->vm_mirror) {
73255+ BUG_ON(!vma->vm_mirror->vm_mirror || vma->vm_mirror->vm_mirror != vma);
73256+ vma->vm_mirror->vm_mirror = NULL;
73257+ vma->vm_mirror->vm_flags &= ~VM_EXEC;
73258+ vma->vm_mirror = NULL;
73259+ }
73260+#endif
73261+
73262 rb_erase(&vma->vm_rb, &mm->mm_rb);
73263 mm->map_count--;
73264 tail_vma = vma;
73265@@ -1975,14 +2285,33 @@ static int __split_vma(struct mm_struct
73266 struct vm_area_struct *new;
73267 int err = -ENOMEM;
73268
73269+#ifdef CONFIG_PAX_SEGMEXEC
73270+ struct vm_area_struct *vma_m, *new_m = NULL;
73271+ unsigned long addr_m = addr + SEGMEXEC_TASK_SIZE;
73272+#endif
73273+
73274 if (is_vm_hugetlb_page(vma) && (addr &
73275 ~(huge_page_mask(hstate_vma(vma)))))
73276 return -EINVAL;
73277
73278+#ifdef CONFIG_PAX_SEGMEXEC
73279+ vma_m = pax_find_mirror_vma(vma);
73280+#endif
73281+
73282 new = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
73283 if (!new)
73284 goto out_err;
73285
73286+#ifdef CONFIG_PAX_SEGMEXEC
73287+ if (vma_m) {
73288+ new_m = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
73289+ if (!new_m) {
73290+ kmem_cache_free(vm_area_cachep, new);
73291+ goto out_err;
73292+ }
73293+ }
73294+#endif
73295+
73296 /* most fields are the same, copy all, and then fixup */
73297 *new = *vma;
73298
73299@@ -1995,6 +2324,22 @@ static int __split_vma(struct mm_struct
73300 new->vm_pgoff += ((addr - vma->vm_start) >> PAGE_SHIFT);
73301 }
73302
73303+#ifdef CONFIG_PAX_SEGMEXEC
73304+ if (vma_m) {
73305+ *new_m = *vma_m;
73306+ INIT_LIST_HEAD(&new_m->anon_vma_chain);
73307+ new_m->vm_mirror = new;
73308+ new->vm_mirror = new_m;
73309+
73310+ if (new_below)
73311+ new_m->vm_end = addr_m;
73312+ else {
73313+ new_m->vm_start = addr_m;
73314+ new_m->vm_pgoff += ((addr_m - vma_m->vm_start) >> PAGE_SHIFT);
73315+ }
73316+ }
73317+#endif
73318+
73319 pol = mpol_dup(vma_policy(vma));
73320 if (IS_ERR(pol)) {
73321 err = PTR_ERR(pol);
73322@@ -2020,6 +2365,42 @@ static int __split_vma(struct mm_struct
73323 else
73324 err = vma_adjust(vma, vma->vm_start, addr, vma->vm_pgoff, new);
73325
73326+#ifdef CONFIG_PAX_SEGMEXEC
73327+ if (!err && vma_m) {
73328+ if (anon_vma_clone(new_m, vma_m))
73329+ goto out_free_mpol;
73330+
73331+ mpol_get(pol);
73332+ vma_set_policy(new_m, pol);
73333+
73334+ if (new_m->vm_file) {
73335+ get_file(new_m->vm_file);
73336+ if (vma_m->vm_flags & VM_EXECUTABLE)
73337+ added_exe_file_vma(mm);
73338+ }
73339+
73340+ if (new_m->vm_ops && new_m->vm_ops->open)
73341+ new_m->vm_ops->open(new_m);
73342+
73343+ if (new_below)
73344+ err = vma_adjust(vma_m, addr_m, vma_m->vm_end, vma_m->vm_pgoff +
73345+ ((addr_m - new_m->vm_start) >> PAGE_SHIFT), new_m);
73346+ else
73347+ err = vma_adjust(vma_m, vma_m->vm_start, addr_m, vma_m->vm_pgoff, new_m);
73348+
73349+ if (err) {
73350+ if (new_m->vm_ops && new_m->vm_ops->close)
73351+ new_m->vm_ops->close(new_m);
73352+ if (new_m->vm_file) {
73353+ if (vma_m->vm_flags & VM_EXECUTABLE)
73354+ removed_exe_file_vma(mm);
73355+ fput(new_m->vm_file);
73356+ }
73357+ mpol_put(pol);
73358+ }
73359+ }
73360+#endif
73361+
73362 /* Success. */
73363 if (!err)
73364 return 0;
73365@@ -2032,10 +2413,18 @@ static int __split_vma(struct mm_struct
73366 removed_exe_file_vma(mm);
73367 fput(new->vm_file);
73368 }
73369- unlink_anon_vmas(new);
73370 out_free_mpol:
73371 mpol_put(pol);
73372 out_free_vma:
73373+
73374+#ifdef CONFIG_PAX_SEGMEXEC
73375+ if (new_m) {
73376+ unlink_anon_vmas(new_m);
73377+ kmem_cache_free(vm_area_cachep, new_m);
73378+ }
73379+#endif
73380+
73381+ unlink_anon_vmas(new);
73382 kmem_cache_free(vm_area_cachep, new);
73383 out_err:
73384 return err;
73385@@ -2048,6 +2437,15 @@ static int __split_vma(struct mm_struct
73386 int split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
73387 unsigned long addr, int new_below)
73388 {
73389+
73390+#ifdef CONFIG_PAX_SEGMEXEC
73391+ if (mm->pax_flags & MF_PAX_SEGMEXEC) {
73392+ BUG_ON(vma->vm_end > SEGMEXEC_TASK_SIZE);
73393+ if (mm->map_count >= sysctl_max_map_count-1)
73394+ return -ENOMEM;
73395+ } else
73396+#endif
73397+
73398 if (mm->map_count >= sysctl_max_map_count)
73399 return -ENOMEM;
73400
73401@@ -2059,11 +2457,30 @@ int split_vma(struct mm_struct *mm, stru
73402 * work. This now handles partial unmappings.
73403 * Jeremy Fitzhardinge <jeremy@goop.org>
73404 */
73405+#ifdef CONFIG_PAX_SEGMEXEC
73406+int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
73407+{
73408+ int ret = __do_munmap(mm, start, len);
73409+ if (ret || !(mm->pax_flags & MF_PAX_SEGMEXEC))
73410+ return ret;
73411+
73412+ return __do_munmap(mm, start + SEGMEXEC_TASK_SIZE, len);
73413+}
73414+
73415+int __do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
73416+#else
73417 int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
73418+#endif
73419 {
73420 unsigned long end;
73421 struct vm_area_struct *vma, *prev, *last;
73422
73423+ /*
73424+ * mm->mmap_sem is required to protect against another thread
73425+ * changing the mappings in case we sleep.
73426+ */
73427+ verify_mm_writelocked(mm);
73428+
73429 if ((start & ~PAGE_MASK) || start > TASK_SIZE || len > TASK_SIZE-start)
73430 return -EINVAL;
73431
73432@@ -2137,6 +2554,8 @@ int do_munmap(struct mm_struct *mm, unsi
73433 /* Fix up all other VM information */
73434 remove_vma_list(mm, vma);
73435
73436+ track_exec_limit(mm, start, end, 0UL);
73437+
73438 return 0;
73439 }
73440
73441@@ -2149,22 +2568,18 @@ SYSCALL_DEFINE2(munmap, unsigned long, a
73442
73443 profile_munmap(addr);
73444
73445+#ifdef CONFIG_PAX_SEGMEXEC
73446+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) &&
73447+ (len > SEGMEXEC_TASK_SIZE || addr > SEGMEXEC_TASK_SIZE-len))
73448+ return -EINVAL;
73449+#endif
73450+
73451 down_write(&mm->mmap_sem);
73452 ret = do_munmap(mm, addr, len);
73453 up_write(&mm->mmap_sem);
73454 return ret;
73455 }
73456
73457-static inline void verify_mm_writelocked(struct mm_struct *mm)
73458-{
73459-#ifdef CONFIG_DEBUG_VM
73460- if (unlikely(down_read_trylock(&mm->mmap_sem))) {
73461- WARN_ON(1);
73462- up_read(&mm->mmap_sem);
73463- }
73464-#endif
73465-}
73466-
73467 /*
73468 * this is really a simplified "do_mmap". it only handles
73469 * anonymous maps. eventually we may be able to do some
73470@@ -2178,6 +2593,7 @@ unsigned long do_brk(unsigned long addr,
73471 struct rb_node ** rb_link, * rb_parent;
73472 pgoff_t pgoff = addr >> PAGE_SHIFT;
73473 int error;
73474+ unsigned long charged;
73475
73476 len = PAGE_ALIGN(len);
73477 if (!len)
73478@@ -2189,16 +2605,30 @@ unsigned long do_brk(unsigned long addr,
73479
73480 flags = VM_DATA_DEFAULT_FLAGS | VM_ACCOUNT | mm->def_flags;
73481
73482+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
73483+ if (mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
73484+ flags &= ~VM_EXEC;
73485+
73486+#ifdef CONFIG_PAX_MPROTECT
73487+ if (mm->pax_flags & MF_PAX_MPROTECT)
73488+ flags &= ~VM_MAYEXEC;
73489+#endif
73490+
73491+ }
73492+#endif
73493+
73494 error = get_unmapped_area(NULL, addr, len, 0, MAP_FIXED);
73495 if (error & ~PAGE_MASK)
73496 return error;
73497
73498+ charged = len >> PAGE_SHIFT;
73499+
73500 /*
73501 * mlock MCL_FUTURE?
73502 */
73503 if (mm->def_flags & VM_LOCKED) {
73504 unsigned long locked, lock_limit;
73505- locked = len >> PAGE_SHIFT;
73506+ locked = charged;
73507 locked += mm->locked_vm;
73508 lock_limit = rlimit(RLIMIT_MEMLOCK);
73509 lock_limit >>= PAGE_SHIFT;
73510@@ -2215,22 +2645,22 @@ unsigned long do_brk(unsigned long addr,
73511 /*
73512 * Clear old maps. this also does some error checking for us
73513 */
73514- munmap_back:
73515 vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
73516 if (vma && vma->vm_start < addr + len) {
73517 if (do_munmap(mm, addr, len))
73518 return -ENOMEM;
73519- goto munmap_back;
73520+ vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
73521+ BUG_ON(vma && vma->vm_start < addr + len);
73522 }
73523
73524 /* Check against address space limits *after* clearing old maps... */
73525- if (!may_expand_vm(mm, len >> PAGE_SHIFT))
73526+ if (!may_expand_vm(mm, charged))
73527 return -ENOMEM;
73528
73529 if (mm->map_count > sysctl_max_map_count)
73530 return -ENOMEM;
73531
73532- if (security_vm_enough_memory(len >> PAGE_SHIFT))
73533+ if (security_vm_enough_memory(charged))
73534 return -ENOMEM;
73535
73536 /* Can we just expand an old private anonymous mapping? */
73537@@ -2244,7 +2674,7 @@ unsigned long do_brk(unsigned long addr,
73538 */
73539 vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
73540 if (!vma) {
73541- vm_unacct_memory(len >> PAGE_SHIFT);
73542+ vm_unacct_memory(charged);
73543 return -ENOMEM;
73544 }
73545
73546@@ -2258,11 +2688,12 @@ unsigned long do_brk(unsigned long addr,
73547 vma_link(mm, vma, prev, rb_link, rb_parent);
73548 out:
73549 perf_event_mmap(vma);
73550- mm->total_vm += len >> PAGE_SHIFT;
73551+ mm->total_vm += charged;
73552 if (flags & VM_LOCKED) {
73553 if (!mlock_vma_pages_range(vma, addr, addr + len))
73554- mm->locked_vm += (len >> PAGE_SHIFT);
73555+ mm->locked_vm += charged;
73556 }
73557+ track_exec_limit(mm, addr, addr + len, flags);
73558 return addr;
73559 }
73560
73561@@ -2309,8 +2740,10 @@ void exit_mmap(struct mm_struct *mm)
73562 * Walk the list again, actually closing and freeing it,
73563 * with preemption enabled, without holding any MM locks.
73564 */
73565- while (vma)
73566+ while (vma) {
73567+ vma->vm_mirror = NULL;
73568 vma = remove_vma(vma);
73569+ }
73570
73571 BUG_ON(mm->nr_ptes > (FIRST_USER_ADDRESS+PMD_SIZE-1)>>PMD_SHIFT);
73572 }
73573@@ -2324,6 +2757,13 @@ int insert_vm_struct(struct mm_struct *
73574 struct vm_area_struct * __vma, * prev;
73575 struct rb_node ** rb_link, * rb_parent;
73576
73577+#ifdef CONFIG_PAX_SEGMEXEC
73578+ struct vm_area_struct *vma_m = NULL;
73579+#endif
73580+
73581+ if (security_file_mmap(NULL, 0, 0, 0, vma->vm_start, 1))
73582+ return -EPERM;
73583+
73584 /*
73585 * The vm_pgoff of a purely anonymous vma should be irrelevant
73586 * until its first write fault, when page's anon_vma and index
73587@@ -2346,7 +2786,22 @@ int insert_vm_struct(struct mm_struct *
73588 if ((vma->vm_flags & VM_ACCOUNT) &&
73589 security_vm_enough_memory_mm(mm, vma_pages(vma)))
73590 return -ENOMEM;
73591+
73592+#ifdef CONFIG_PAX_SEGMEXEC
73593+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_flags & VM_EXEC)) {
73594+ vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
73595+ if (!vma_m)
73596+ return -ENOMEM;
73597+ }
73598+#endif
73599+
73600 vma_link(mm, vma, prev, rb_link, rb_parent);
73601+
73602+#ifdef CONFIG_PAX_SEGMEXEC
73603+ if (vma_m)
73604+ BUG_ON(pax_mirror_vma(vma_m, vma));
73605+#endif
73606+
73607 return 0;
73608 }
73609
73610@@ -2364,6 +2819,8 @@ struct vm_area_struct *copy_vma(struct v
73611 struct rb_node **rb_link, *rb_parent;
73612 struct mempolicy *pol;
73613
73614+ BUG_ON(vma->vm_mirror);
73615+
73616 /*
73617 * If anonymous vma has not yet been faulted, update new pgoff
73618 * to match new location, to increase its chance of merging.
73619@@ -2413,6 +2870,39 @@ struct vm_area_struct *copy_vma(struct v
73620 kmem_cache_free(vm_area_cachep, new_vma);
73621 return NULL;
73622 }
73623+
73624+#ifdef CONFIG_PAX_SEGMEXEC
73625+long pax_mirror_vma(struct vm_area_struct *vma_m, struct vm_area_struct *vma)
73626+{
73627+ struct vm_area_struct *prev_m;
73628+ struct rb_node **rb_link_m, *rb_parent_m;
73629+ struct mempolicy *pol_m;
73630+
73631+ BUG_ON(!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) || !(vma->vm_flags & VM_EXEC));
73632+ BUG_ON(vma->vm_mirror || vma_m->vm_mirror);
73633+ BUG_ON(!mpol_equal(vma_policy(vma), vma_policy(vma_m)));
73634+ *vma_m = *vma;
73635+ INIT_LIST_HEAD(&vma_m->anon_vma_chain);
73636+ if (anon_vma_clone(vma_m, vma))
73637+ return -ENOMEM;
73638+ pol_m = vma_policy(vma_m);
73639+ mpol_get(pol_m);
73640+ vma_set_policy(vma_m, pol_m);
73641+ vma_m->vm_start += SEGMEXEC_TASK_SIZE;
73642+ vma_m->vm_end += SEGMEXEC_TASK_SIZE;
73643+ vma_m->vm_flags &= ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT | VM_LOCKED);
73644+ vma_m->vm_page_prot = vm_get_page_prot(vma_m->vm_flags);
73645+ if (vma_m->vm_file)
73646+ get_file(vma_m->vm_file);
73647+ if (vma_m->vm_ops && vma_m->vm_ops->open)
73648+ vma_m->vm_ops->open(vma_m);
73649+ find_vma_prepare(vma->vm_mm, vma_m->vm_start, &prev_m, &rb_link_m, &rb_parent_m);
73650+ vma_link(vma->vm_mm, vma_m, prev_m, rb_link_m, rb_parent_m);
73651+ vma_m->vm_mirror = vma;
73652+ vma->vm_mirror = vma_m;
73653+ return 0;
73654+}
73655+#endif
73656
73657 /*
73658 * Return true if the calling process may expand its vm space by the passed
73659@@ -2424,7 +2914,7 @@ int may_expand_vm(struct mm_struct *mm,
73660 unsigned long lim;
73661
73662 lim = rlimit(RLIMIT_AS) >> PAGE_SHIFT;
73663-
73664+ gr_learn_resource(current, RLIMIT_AS, (cur + npages) << PAGE_SHIFT, 1);
73665 if (cur + npages > lim)
73666 return 0;
73667 return 1;
73668@@ -2495,6 +2985,22 @@ int install_special_mapping(struct mm_st
73669 vma->vm_start = addr;
73670 vma->vm_end = addr + len;
73671
73672+#ifdef CONFIG_PAX_MPROTECT
73673+ if (mm->pax_flags & MF_PAX_MPROTECT) {
73674+#ifndef CONFIG_PAX_MPROTECT_COMPAT
73675+ if ((vm_flags & (VM_WRITE | VM_EXEC)) == (VM_WRITE | VM_EXEC))
73676+ return -EPERM;
73677+ if (!(vm_flags & VM_EXEC))
73678+ vm_flags &= ~VM_MAYEXEC;
73679+#else
73680+ if ((vm_flags & (VM_WRITE | VM_EXEC)) != VM_EXEC)
73681+ vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
73682+#endif
73683+ else
73684+ vm_flags &= ~VM_MAYWRITE;
73685+ }
73686+#endif
73687+
73688 vma->vm_flags = vm_flags | mm->def_flags | VM_DONTEXPAND;
73689 vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
73690
73691diff -urNp linux-2.6.39/mm/mprotect.c linux-2.6.39/mm/mprotect.c
73692--- linux-2.6.39/mm/mprotect.c 2011-05-19 00:06:34.000000000 -0400
73693+++ linux-2.6.39/mm/mprotect.c 2011-05-22 19:41:42.000000000 -0400
73694@@ -23,10 +23,16 @@
73695 #include <linux/mmu_notifier.h>
73696 #include <linux/migrate.h>
73697 #include <linux/perf_event.h>
73698+
73699+#ifdef CONFIG_PAX_MPROTECT
73700+#include <linux/elf.h>
73701+#endif
73702+
73703 #include <asm/uaccess.h>
73704 #include <asm/pgtable.h>
73705 #include <asm/cacheflush.h>
73706 #include <asm/tlbflush.h>
73707+#include <asm/mmu_context.h>
73708
73709 #ifndef pgprot_modify
73710 static inline pgprot_t pgprot_modify(pgprot_t oldprot, pgprot_t newprot)
73711@@ -141,6 +147,48 @@ static void change_protection(struct vm_
73712 flush_tlb_range(vma, start, end);
73713 }
73714
73715+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
73716+/* called while holding the mmap semaphor for writing except stack expansion */
73717+void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot)
73718+{
73719+ unsigned long oldlimit, newlimit = 0UL;
73720+
73721+ if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || (__supported_pte_mask & _PAGE_NX))
73722+ return;
73723+
73724+ spin_lock(&mm->page_table_lock);
73725+ oldlimit = mm->context.user_cs_limit;
73726+ if ((prot & VM_EXEC) && oldlimit < end)
73727+ /* USER_CS limit moved up */
73728+ newlimit = end;
73729+ else if (!(prot & VM_EXEC) && start < oldlimit && oldlimit <= end)
73730+ /* USER_CS limit moved down */
73731+ newlimit = start;
73732+
73733+ if (newlimit) {
73734+ mm->context.user_cs_limit = newlimit;
73735+
73736+#ifdef CONFIG_SMP
73737+ wmb();
73738+ cpus_clear(mm->context.cpu_user_cs_mask);
73739+ cpu_set(smp_processor_id(), mm->context.cpu_user_cs_mask);
73740+#endif
73741+
73742+ set_user_cs(mm->context.user_cs_base, mm->context.user_cs_limit, smp_processor_id());
73743+ }
73744+ spin_unlock(&mm->page_table_lock);
73745+ if (newlimit == end) {
73746+ struct vm_area_struct *vma = find_vma(mm, oldlimit);
73747+
73748+ for (; vma && vma->vm_start < end; vma = vma->vm_next)
73749+ if (is_vm_hugetlb_page(vma))
73750+ hugetlb_change_protection(vma, vma->vm_start, vma->vm_end, vma->vm_page_prot);
73751+ else
73752+ change_protection(vma, vma->vm_start, vma->vm_end, vma->vm_page_prot, vma_wants_writenotify(vma));
73753+ }
73754+}
73755+#endif
73756+
73757 int
73758 mprotect_fixup(struct vm_area_struct *vma, struct vm_area_struct **pprev,
73759 unsigned long start, unsigned long end, unsigned long newflags)
73760@@ -153,11 +201,29 @@ mprotect_fixup(struct vm_area_struct *vm
73761 int error;
73762 int dirty_accountable = 0;
73763
73764+#ifdef CONFIG_PAX_SEGMEXEC
73765+ struct vm_area_struct *vma_m = NULL;
73766+ unsigned long start_m, end_m;
73767+
73768+ start_m = start + SEGMEXEC_TASK_SIZE;
73769+ end_m = end + SEGMEXEC_TASK_SIZE;
73770+#endif
73771+
73772 if (newflags == oldflags) {
73773 *pprev = vma;
73774 return 0;
73775 }
73776
73777+ if (newflags & (VM_READ | VM_WRITE | VM_EXEC)) {
73778+ struct vm_area_struct *prev = vma->vm_prev, *next = vma->vm_next;
73779+
73780+ if (next && (next->vm_flags & VM_GROWSDOWN) && sysctl_heap_stack_gap > next->vm_start - end)
73781+ return -ENOMEM;
73782+
73783+ if (prev && (prev->vm_flags & VM_GROWSUP) && sysctl_heap_stack_gap > start - prev->vm_end)
73784+ return -ENOMEM;
73785+ }
73786+
73787 /*
73788 * If we make a private mapping writable we increase our commit;
73789 * but (without finer accounting) cannot reduce our commit if we
73790@@ -174,6 +240,42 @@ mprotect_fixup(struct vm_area_struct *vm
73791 }
73792 }
73793
73794+#ifdef CONFIG_PAX_SEGMEXEC
73795+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && ((oldflags ^ newflags) & VM_EXEC)) {
73796+ if (start != vma->vm_start) {
73797+ error = split_vma(mm, vma, start, 1);
73798+ if (error)
73799+ goto fail;
73800+ BUG_ON(!*pprev || (*pprev)->vm_next == vma);
73801+ *pprev = (*pprev)->vm_next;
73802+ }
73803+
73804+ if (end != vma->vm_end) {
73805+ error = split_vma(mm, vma, end, 0);
73806+ if (error)
73807+ goto fail;
73808+ }
73809+
73810+ if (pax_find_mirror_vma(vma)) {
73811+ error = __do_munmap(mm, start_m, end_m - start_m);
73812+ if (error)
73813+ goto fail;
73814+ } else {
73815+ vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
73816+ if (!vma_m) {
73817+ error = -ENOMEM;
73818+ goto fail;
73819+ }
73820+ vma->vm_flags = newflags;
73821+ error = pax_mirror_vma(vma_m, vma);
73822+ if (error) {
73823+ vma->vm_flags = oldflags;
73824+ goto fail;
73825+ }
73826+ }
73827+ }
73828+#endif
73829+
73830 /*
73831 * First try to merge with previous and/or next vma.
73832 */
73833@@ -204,9 +306,21 @@ success:
73834 * vm_flags and vm_page_prot are protected by the mmap_sem
73835 * held in write mode.
73836 */
73837+
73838+#ifdef CONFIG_PAX_SEGMEXEC
73839+ if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (newflags & VM_EXEC) && ((vma->vm_flags ^ newflags) & VM_READ))
73840+ pax_find_mirror_vma(vma)->vm_flags ^= VM_READ;
73841+#endif
73842+
73843 vma->vm_flags = newflags;
73844+
73845+#ifdef CONFIG_PAX_MPROTECT
73846+ if (mm->binfmt && mm->binfmt->handle_mprotect)
73847+ mm->binfmt->handle_mprotect(vma, newflags);
73848+#endif
73849+
73850 vma->vm_page_prot = pgprot_modify(vma->vm_page_prot,
73851- vm_get_page_prot(newflags));
73852+ vm_get_page_prot(vma->vm_flags));
73853
73854 if (vma_wants_writenotify(vma)) {
73855 vma->vm_page_prot = vm_get_page_prot(newflags & ~VM_SHARED);
73856@@ -248,6 +362,17 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
73857 end = start + len;
73858 if (end <= start)
73859 return -ENOMEM;
73860+
73861+#ifdef CONFIG_PAX_SEGMEXEC
73862+ if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
73863+ if (end > SEGMEXEC_TASK_SIZE)
73864+ return -EINVAL;
73865+ } else
73866+#endif
73867+
73868+ if (end > TASK_SIZE)
73869+ return -EINVAL;
73870+
73871 if (!arch_validate_prot(prot))
73872 return -EINVAL;
73873
73874@@ -255,7 +380,7 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
73875 /*
73876 * Does the application expect PROT_READ to imply PROT_EXEC:
73877 */
73878- if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
73879+ if ((prot & (PROT_READ | PROT_WRITE)) && (current->personality & READ_IMPLIES_EXEC))
73880 prot |= PROT_EXEC;
73881
73882 vm_flags = calc_vm_prot_bits(prot);
73883@@ -287,6 +412,11 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
73884 if (start > vma->vm_start)
73885 prev = vma;
73886
73887+#ifdef CONFIG_PAX_MPROTECT
73888+ if (current->mm->binfmt && current->mm->binfmt->handle_mprotect)
73889+ current->mm->binfmt->handle_mprotect(vma, vm_flags);
73890+#endif
73891+
73892 for (nstart = start ; ; ) {
73893 unsigned long newflags;
73894
73895@@ -296,6 +426,14 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
73896
73897 /* newflags >> 4 shift VM_MAY% in place of VM_% */
73898 if ((newflags & ~(newflags >> 4)) & (VM_READ | VM_WRITE | VM_EXEC)) {
73899+ if (prot & (PROT_WRITE | PROT_EXEC))
73900+ gr_log_rwxmprotect(vma->vm_file);
73901+
73902+ error = -EACCES;
73903+ goto out;
73904+ }
73905+
73906+ if (!gr_acl_handle_mprotect(vma->vm_file, prot)) {
73907 error = -EACCES;
73908 goto out;
73909 }
73910@@ -310,6 +448,9 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
73911 error = mprotect_fixup(vma, &prev, nstart, tmp, newflags);
73912 if (error)
73913 goto out;
73914+
73915+ track_exec_limit(current->mm, nstart, tmp, vm_flags);
73916+
73917 nstart = tmp;
73918
73919 if (nstart < prev->vm_end)
73920diff -urNp linux-2.6.39/mm/mremap.c linux-2.6.39/mm/mremap.c
73921--- linux-2.6.39/mm/mremap.c 2011-05-19 00:06:34.000000000 -0400
73922+++ linux-2.6.39/mm/mremap.c 2011-05-22 19:36:33.000000000 -0400
73923@@ -114,6 +114,12 @@ static void move_ptes(struct vm_area_str
73924 continue;
73925 pte = ptep_clear_flush(vma, old_addr, old_pte);
73926 pte = move_pte(pte, new_vma->vm_page_prot, old_addr, new_addr);
73927+
73928+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
73929+ if (!(__supported_pte_mask & _PAGE_NX) && (new_vma->vm_flags & (VM_PAGEEXEC | VM_EXEC)) == VM_PAGEEXEC)
73930+ pte = pte_exprotect(pte);
73931+#endif
73932+
73933 set_pte_at(mm, new_addr, new_pte, pte);
73934 }
73935
73936@@ -273,6 +279,11 @@ static struct vm_area_struct *vma_to_res
73937 if (is_vm_hugetlb_page(vma))
73938 goto Einval;
73939
73940+#ifdef CONFIG_PAX_SEGMEXEC
73941+ if (pax_find_mirror_vma(vma))
73942+ goto Einval;
73943+#endif
73944+
73945 /* We can't remap across vm area boundaries */
73946 if (old_len > vma->vm_end - addr)
73947 goto Efault;
73948@@ -329,20 +340,25 @@ static unsigned long mremap_to(unsigned
73949 unsigned long ret = -EINVAL;
73950 unsigned long charged = 0;
73951 unsigned long map_flags;
73952+ unsigned long pax_task_size = TASK_SIZE;
73953
73954 if (new_addr & ~PAGE_MASK)
73955 goto out;
73956
73957- if (new_len > TASK_SIZE || new_addr > TASK_SIZE - new_len)
73958+#ifdef CONFIG_PAX_SEGMEXEC
73959+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
73960+ pax_task_size = SEGMEXEC_TASK_SIZE;
73961+#endif
73962+
73963+ pax_task_size -= PAGE_SIZE;
73964+
73965+ if (new_len > TASK_SIZE || new_addr > pax_task_size - new_len)
73966 goto out;
73967
73968 /* Check if the location we're moving into overlaps the
73969 * old location at all, and fail if it does.
73970 */
73971- if ((new_addr <= addr) && (new_addr+new_len) > addr)
73972- goto out;
73973-
73974- if ((addr <= new_addr) && (addr+old_len) > new_addr)
73975+ if (addr + old_len > new_addr && new_addr + new_len > addr)
73976 goto out;
73977
73978 ret = security_file_mmap(NULL, 0, 0, 0, new_addr, 1);
73979@@ -414,6 +430,7 @@ unsigned long do_mremap(unsigned long ad
73980 struct vm_area_struct *vma;
73981 unsigned long ret = -EINVAL;
73982 unsigned long charged = 0;
73983+ unsigned long pax_task_size = TASK_SIZE;
73984
73985 if (flags & ~(MREMAP_FIXED | MREMAP_MAYMOVE))
73986 goto out;
73987@@ -432,6 +449,17 @@ unsigned long do_mremap(unsigned long ad
73988 if (!new_len)
73989 goto out;
73990
73991+#ifdef CONFIG_PAX_SEGMEXEC
73992+ if (mm->pax_flags & MF_PAX_SEGMEXEC)
73993+ pax_task_size = SEGMEXEC_TASK_SIZE;
73994+#endif
73995+
73996+ pax_task_size -= PAGE_SIZE;
73997+
73998+ if (new_len > pax_task_size || addr > pax_task_size-new_len ||
73999+ old_len > pax_task_size || addr > pax_task_size-old_len)
74000+ goto out;
74001+
74002 if (flags & MREMAP_FIXED) {
74003 if (flags & MREMAP_MAYMOVE)
74004 ret = mremap_to(addr, old_len, new_addr, new_len);
74005@@ -481,6 +509,7 @@ unsigned long do_mremap(unsigned long ad
74006 addr + new_len);
74007 }
74008 ret = addr;
74009+ track_exec_limit(vma->vm_mm, vma->vm_start, addr + new_len, vma->vm_flags);
74010 goto out;
74011 }
74012 }
74013@@ -507,7 +536,13 @@ unsigned long do_mremap(unsigned long ad
74014 ret = security_file_mmap(NULL, 0, 0, 0, new_addr, 1);
74015 if (ret)
74016 goto out;
74017+
74018+ map_flags = vma->vm_flags;
74019 ret = move_vma(vma, addr, old_len, new_len, new_addr);
74020+ if (!(ret & ~PAGE_MASK)) {
74021+ track_exec_limit(current->mm, addr, addr + old_len, 0UL);
74022+ track_exec_limit(current->mm, new_addr, new_addr + new_len, map_flags);
74023+ }
74024 }
74025 out:
74026 if (ret & ~PAGE_MASK)
74027diff -urNp linux-2.6.39/mm/nobootmem.c linux-2.6.39/mm/nobootmem.c
74028--- linux-2.6.39/mm/nobootmem.c 2011-05-19 00:06:34.000000000 -0400
74029+++ linux-2.6.39/mm/nobootmem.c 2011-05-22 19:36:33.000000000 -0400
74030@@ -110,19 +110,30 @@ static void __init __free_pages_memory(u
74031 unsigned long __init free_all_memory_core_early(int nodeid)
74032 {
74033 int i;
74034- u64 start, end;
74035+ u64 start, end, startrange, endrange;
74036 unsigned long count = 0;
74037- struct range *range = NULL;
74038+ struct range *range = NULL, rangerange = { 0, 0 };
74039 int nr_range;
74040
74041 nr_range = get_free_all_memory_range(&range, nodeid);
74042+ startrange = __pa(range) >> PAGE_SHIFT;
74043+ endrange = (__pa(range + nr_range) - 1) >> PAGE_SHIFT;
74044
74045 for (i = 0; i < nr_range; i++) {
74046 start = range[i].start;
74047 end = range[i].end;
74048+ if (start <= endrange && startrange < end) {
74049+ BUG_ON(rangerange.start | rangerange.end);
74050+ rangerange = range[i];
74051+ continue;
74052+ }
74053 count += end - start;
74054 __free_pages_memory(start, end);
74055 }
74056+ start = rangerange.start;
74057+ end = rangerange.end;
74058+ count += end - start;
74059+ __free_pages_memory(start, end);
74060
74061 return count;
74062 }
74063diff -urNp linux-2.6.39/mm/nommu.c linux-2.6.39/mm/nommu.c
74064--- linux-2.6.39/mm/nommu.c 2011-05-19 00:06:34.000000000 -0400
74065+++ linux-2.6.39/mm/nommu.c 2011-05-22 19:36:33.000000000 -0400
74066@@ -63,7 +63,6 @@ int sysctl_overcommit_memory = OVERCOMMI
74067 int sysctl_overcommit_ratio = 50; /* default is 50% */
74068 int sysctl_max_map_count = DEFAULT_MAX_MAP_COUNT;
74069 int sysctl_nr_trim_pages = CONFIG_NOMMU_INITIAL_TRIM_EXCESS;
74070-int heap_stack_gap = 0;
74071
74072 atomic_long_t mmap_pages_allocated;
74073
74074@@ -833,15 +832,6 @@ struct vm_area_struct *find_vma(struct m
74075 EXPORT_SYMBOL(find_vma);
74076
74077 /*
74078- * find a VMA
74079- * - we don't extend stack VMAs under NOMMU conditions
74080- */
74081-struct vm_area_struct *find_extend_vma(struct mm_struct *mm, unsigned long addr)
74082-{
74083- return find_vma(mm, addr);
74084-}
74085-
74086-/*
74087 * expand a stack to a given address
74088 * - not supported under NOMMU conditions
74089 */
74090@@ -1563,6 +1553,7 @@ int split_vma(struct mm_struct *mm, stru
74091
74092 /* most fields are the same, copy all, and then fixup */
74093 *new = *vma;
74094+ INIT_LIST_HEAD(&new->anon_vma_chain);
74095 *region = *vma->vm_region;
74096 new->vm_region = region;
74097
74098diff -urNp linux-2.6.39/mm/page_alloc.c linux-2.6.39/mm/page_alloc.c
74099--- linux-2.6.39/mm/page_alloc.c 2011-05-19 00:06:34.000000000 -0400
74100+++ linux-2.6.39/mm/page_alloc.c 2011-05-22 19:36:33.000000000 -0400
74101@@ -650,6 +650,10 @@ static bool free_pages_prepare(struct pa
74102 int i;
74103 int bad = 0;
74104
74105+#ifdef CONFIG_PAX_MEMORY_SANITIZE
74106+ unsigned long index = 1UL << order;
74107+#endif
74108+
74109 trace_mm_page_free_direct(page, order);
74110 kmemcheck_free_shadow(page, order);
74111
74112@@ -665,6 +669,12 @@ static bool free_pages_prepare(struct pa
74113 debug_check_no_obj_freed(page_address(page),
74114 PAGE_SIZE << order);
74115 }
74116+
74117+#ifdef CONFIG_PAX_MEMORY_SANITIZE
74118+ for (; index; --index)
74119+ sanitize_highpage(page + index - 1);
74120+#endif
74121+
74122 arch_free_page(page, order);
74123 kernel_map_pages(page, 1 << order, 0);
74124
74125@@ -780,8 +790,10 @@ static int prep_new_page(struct page *pa
74126 arch_alloc_page(page, order);
74127 kernel_map_pages(page, 1 << order, 1);
74128
74129+#ifndef CONFIG_PAX_MEMORY_SANITIZE
74130 if (gfp_flags & __GFP_ZERO)
74131 prep_zero_page(page, order, gfp_flags);
74132+#endif
74133
74134 if (order && (gfp_flags & __GFP_COMP))
74135 prep_compound_page(page, order);
74136@@ -2504,6 +2516,8 @@ void __show_free_areas(unsigned int filt
74137 int cpu;
74138 struct zone *zone;
74139
74140+ pax_track_stack();
74141+
74142 for_each_populated_zone(zone) {
74143 if (skip_free_areas_zone(filter, zone))
74144 continue;
74145diff -urNp linux-2.6.39/mm/percpu.c linux-2.6.39/mm/percpu.c
74146--- linux-2.6.39/mm/percpu.c 2011-05-19 00:06:34.000000000 -0400
74147+++ linux-2.6.39/mm/percpu.c 2011-05-22 19:36:33.000000000 -0400
74148@@ -121,7 +121,7 @@ static unsigned int pcpu_first_unit_cpu
74149 static unsigned int pcpu_last_unit_cpu __read_mostly;
74150
74151 /* the address of the first chunk which starts with the kernel static area */
74152-void *pcpu_base_addr __read_mostly;
74153+void *pcpu_base_addr __read_only;
74154 EXPORT_SYMBOL_GPL(pcpu_base_addr);
74155
74156 static const int *pcpu_unit_map __read_mostly; /* cpu -> unit */
74157diff -urNp linux-2.6.39/mm/rmap.c linux-2.6.39/mm/rmap.c
74158--- linux-2.6.39/mm/rmap.c 2011-05-19 00:06:34.000000000 -0400
74159+++ linux-2.6.39/mm/rmap.c 2011-05-22 19:36:33.000000000 -0400
74160@@ -131,6 +131,10 @@ int anon_vma_prepare(struct vm_area_stru
74161 struct anon_vma *anon_vma = vma->anon_vma;
74162 struct anon_vma_chain *avc;
74163
74164+#ifdef CONFIG_PAX_SEGMEXEC
74165+ struct anon_vma_chain *avc_m = NULL;
74166+#endif
74167+
74168 might_sleep();
74169 if (unlikely(!anon_vma)) {
74170 struct mm_struct *mm = vma->vm_mm;
74171@@ -140,6 +144,12 @@ int anon_vma_prepare(struct vm_area_stru
74172 if (!avc)
74173 goto out_enomem;
74174
74175+#ifdef CONFIG_PAX_SEGMEXEC
74176+ avc_m = anon_vma_chain_alloc();
74177+ if (!avc_m)
74178+ goto out_enomem_free_avc;
74179+#endif
74180+
74181 anon_vma = find_mergeable_anon_vma(vma);
74182 allocated = NULL;
74183 if (!anon_vma) {
74184@@ -153,6 +163,21 @@ int anon_vma_prepare(struct vm_area_stru
74185 /* page_table_lock to protect against threads */
74186 spin_lock(&mm->page_table_lock);
74187 if (likely(!vma->anon_vma)) {
74188+
74189+#ifdef CONFIG_PAX_SEGMEXEC
74190+ struct vm_area_struct *vma_m = pax_find_mirror_vma(vma);
74191+
74192+ if (vma_m) {
74193+ BUG_ON(vma_m->anon_vma);
74194+ vma_m->anon_vma = anon_vma;
74195+ avc_m->anon_vma = anon_vma;
74196+ avc_m->vma = vma;
74197+ list_add(&avc_m->same_vma, &vma_m->anon_vma_chain);
74198+ list_add(&avc_m->same_anon_vma, &anon_vma->head);
74199+ avc_m = NULL;
74200+ }
74201+#endif
74202+
74203 vma->anon_vma = anon_vma;
74204 avc->anon_vma = anon_vma;
74205 avc->vma = vma;
74206@@ -166,12 +191,24 @@ int anon_vma_prepare(struct vm_area_stru
74207
74208 if (unlikely(allocated))
74209 put_anon_vma(allocated);
74210+
74211+#ifdef CONFIG_PAX_SEGMEXEC
74212+ if (unlikely(avc_m))
74213+ anon_vma_chain_free(avc_m);
74214+#endif
74215+
74216 if (unlikely(avc))
74217 anon_vma_chain_free(avc);
74218 }
74219 return 0;
74220
74221 out_enomem_free_avc:
74222+
74223+#ifdef CONFIG_PAX_SEGMEXEC
74224+ if (avc_m)
74225+ anon_vma_chain_free(avc_m);
74226+#endif
74227+
74228 anon_vma_chain_free(avc);
74229 out_enomem:
74230 return -ENOMEM;
74231@@ -198,7 +235,7 @@ static void anon_vma_chain_link(struct v
74232 * Attach the anon_vmas from src to dst.
74233 * Returns 0 on success, -ENOMEM on failure.
74234 */
74235-int anon_vma_clone(struct vm_area_struct *dst, struct vm_area_struct *src)
74236+int anon_vma_clone(struct vm_area_struct *dst, const struct vm_area_struct *src)
74237 {
74238 struct anon_vma_chain *avc, *pavc;
74239
74240@@ -220,7 +257,7 @@ int anon_vma_clone(struct vm_area_struct
74241 * the corresponding VMA in the parent process is attached to.
74242 * Returns 0 on success, non-zero on failure.
74243 */
74244-int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma)
74245+int anon_vma_fork(struct vm_area_struct *vma, const struct vm_area_struct *pvma)
74246 {
74247 struct anon_vma_chain *avc;
74248 struct anon_vma *anon_vma;
74249diff -urNp linux-2.6.39/mm/shmem.c linux-2.6.39/mm/shmem.c
74250--- linux-2.6.39/mm/shmem.c 2011-05-19 00:06:34.000000000 -0400
74251+++ linux-2.6.39/mm/shmem.c 2011-05-22 19:41:42.000000000 -0400
74252@@ -31,7 +31,7 @@
74253 #include <linux/percpu_counter.h>
74254 #include <linux/swap.h>
74255
74256-static struct vfsmount *shm_mnt;
74257+struct vfsmount *shm_mnt;
74258
74259 #ifdef CONFIG_SHMEM
74260 /*
74261@@ -1086,6 +1086,8 @@ static int shmem_writepage(struct page *
74262 goto unlock;
74263 }
74264 entry = shmem_swp_entry(info, index, NULL);
74265+ if (!entry)
74266+ goto unlock;
74267 if (entry->val) {
74268 /*
74269 * The more uptodate page coming down from a stacked
74270@@ -1157,6 +1159,8 @@ static struct page *shmem_swapin(swp_ent
74271 struct vm_area_struct pvma;
74272 struct page *page;
74273
74274+ pax_track_stack();
74275+
74276 spol = mpol_cond_copy(&mpol,
74277 mpol_shared_policy_lookup(&info->policy, idx));
74278
74279@@ -2013,7 +2017,7 @@ static int shmem_symlink(struct inode *d
74280
74281 info = SHMEM_I(inode);
74282 inode->i_size = len-1;
74283- if (len <= (char *)inode - (char *)info) {
74284+ if (len <= (char *)inode - (char *)info && len <= 64) {
74285 /* do it inline */
74286 memcpy(info, symname, len);
74287 inode->i_op = &shmem_symlink_inline_operations;
74288@@ -2361,8 +2365,7 @@ int shmem_fill_super(struct super_block
74289 int err = -ENOMEM;
74290
74291 /* Round up to L1_CACHE_BYTES to resist false sharing */
74292- sbinfo = kzalloc(max((int)sizeof(struct shmem_sb_info),
74293- L1_CACHE_BYTES), GFP_KERNEL);
74294+ sbinfo = kzalloc(max(sizeof(struct shmem_sb_info), L1_CACHE_BYTES), GFP_KERNEL);
74295 if (!sbinfo)
74296 return -ENOMEM;
74297
74298diff -urNp linux-2.6.39/mm/slab.c linux-2.6.39/mm/slab.c
74299--- linux-2.6.39/mm/slab.c 2011-05-19 00:06:34.000000000 -0400
74300+++ linux-2.6.39/mm/slab.c 2011-05-22 19:41:42.000000000 -0400
74301@@ -150,7 +150,7 @@
74302
74303 /* Legal flag mask for kmem_cache_create(). */
74304 #if DEBUG
74305-# define CREATE_MASK (SLAB_RED_ZONE | \
74306+# define CREATE_MASK (SLAB_USERCOPY | SLAB_RED_ZONE | \
74307 SLAB_POISON | SLAB_HWCACHE_ALIGN | \
74308 SLAB_CACHE_DMA | \
74309 SLAB_STORE_USER | \
74310@@ -158,7 +158,7 @@
74311 SLAB_DESTROY_BY_RCU | SLAB_MEM_SPREAD | \
74312 SLAB_DEBUG_OBJECTS | SLAB_NOLEAKTRACE | SLAB_NOTRACK)
74313 #else
74314-# define CREATE_MASK (SLAB_HWCACHE_ALIGN | \
74315+# define CREATE_MASK (SLAB_USERCOPY | SLAB_HWCACHE_ALIGN | \
74316 SLAB_CACHE_DMA | \
74317 SLAB_RECLAIM_ACCOUNT | SLAB_PANIC | \
74318 SLAB_DESTROY_BY_RCU | SLAB_MEM_SPREAD | \
74319@@ -287,7 +287,7 @@ struct kmem_list3 {
74320 * Need this for bootstrapping a per node allocator.
74321 */
74322 #define NUM_INIT_LISTS (3 * MAX_NUMNODES)
74323-static struct kmem_list3 __initdata initkmem_list3[NUM_INIT_LISTS];
74324+static struct kmem_list3 initkmem_list3[NUM_INIT_LISTS];
74325 #define CACHE_CACHE 0
74326 #define SIZE_AC MAX_NUMNODES
74327 #define SIZE_L3 (2 * MAX_NUMNODES)
74328@@ -388,10 +388,10 @@ static void kmem_list3_init(struct kmem_
74329 if ((x)->max_freeable < i) \
74330 (x)->max_freeable = i; \
74331 } while (0)
74332-#define STATS_INC_ALLOCHIT(x) atomic_inc(&(x)->allochit)
74333-#define STATS_INC_ALLOCMISS(x) atomic_inc(&(x)->allocmiss)
74334-#define STATS_INC_FREEHIT(x) atomic_inc(&(x)->freehit)
74335-#define STATS_INC_FREEMISS(x) atomic_inc(&(x)->freemiss)
74336+#define STATS_INC_ALLOCHIT(x) atomic_inc_unchecked(&(x)->allochit)
74337+#define STATS_INC_ALLOCMISS(x) atomic_inc_unchecked(&(x)->allocmiss)
74338+#define STATS_INC_FREEHIT(x) atomic_inc_unchecked(&(x)->freehit)
74339+#define STATS_INC_FREEMISS(x) atomic_inc_unchecked(&(x)->freemiss)
74340 #else
74341 #define STATS_INC_ACTIVE(x) do { } while (0)
74342 #define STATS_DEC_ACTIVE(x) do { } while (0)
74343@@ -537,7 +537,7 @@ static inline void *index_to_obj(struct
74344 * reciprocal_divide(offset, cache->reciprocal_buffer_size)
74345 */
74346 static inline unsigned int obj_to_index(const struct kmem_cache *cache,
74347- const struct slab *slab, void *obj)
74348+ const struct slab *slab, const void *obj)
74349 {
74350 u32 offset = (obj - slab->s_mem);
74351 return reciprocal_divide(offset, cache->reciprocal_buffer_size);
74352@@ -563,7 +563,7 @@ struct cache_names {
74353 static struct cache_names __initdata cache_names[] = {
74354 #define CACHE(x) { .name = "size-" #x, .name_dma = "size-" #x "(DMA)" },
74355 #include <linux/kmalloc_sizes.h>
74356- {NULL,}
74357+ {NULL}
74358 #undef CACHE
74359 };
74360
74361@@ -1529,7 +1529,7 @@ void __init kmem_cache_init(void)
74362 sizes[INDEX_AC].cs_cachep = kmem_cache_create(names[INDEX_AC].name,
74363 sizes[INDEX_AC].cs_size,
74364 ARCH_KMALLOC_MINALIGN,
74365- ARCH_KMALLOC_FLAGS|SLAB_PANIC,
74366+ ARCH_KMALLOC_FLAGS|SLAB_PANIC|SLAB_USERCOPY,
74367 NULL);
74368
74369 if (INDEX_AC != INDEX_L3) {
74370@@ -1537,7 +1537,7 @@ void __init kmem_cache_init(void)
74371 kmem_cache_create(names[INDEX_L3].name,
74372 sizes[INDEX_L3].cs_size,
74373 ARCH_KMALLOC_MINALIGN,
74374- ARCH_KMALLOC_FLAGS|SLAB_PANIC,
74375+ ARCH_KMALLOC_FLAGS|SLAB_PANIC|SLAB_USERCOPY,
74376 NULL);
74377 }
74378
74379@@ -1555,7 +1555,7 @@ void __init kmem_cache_init(void)
74380 sizes->cs_cachep = kmem_cache_create(names->name,
74381 sizes->cs_size,
74382 ARCH_KMALLOC_MINALIGN,
74383- ARCH_KMALLOC_FLAGS|SLAB_PANIC,
74384+ ARCH_KMALLOC_FLAGS|SLAB_PANIC|SLAB_USERCOPY,
74385 NULL);
74386 }
74387 #ifdef CONFIG_ZONE_DMA
74388@@ -4270,10 +4270,10 @@ static int s_show(struct seq_file *m, vo
74389 }
74390 /* cpu stats */
74391 {
74392- unsigned long allochit = atomic_read(&cachep->allochit);
74393- unsigned long allocmiss = atomic_read(&cachep->allocmiss);
74394- unsigned long freehit = atomic_read(&cachep->freehit);
74395- unsigned long freemiss = atomic_read(&cachep->freemiss);
74396+ unsigned long allochit = atomic_read_unchecked(&cachep->allochit);
74397+ unsigned long allocmiss = atomic_read_unchecked(&cachep->allocmiss);
74398+ unsigned long freehit = atomic_read_unchecked(&cachep->freehit);
74399+ unsigned long freemiss = atomic_read_unchecked(&cachep->freemiss);
74400
74401 seq_printf(m, " : cpustat %6lu %6lu %6lu %6lu",
74402 allochit, allocmiss, freehit, freemiss);
74403@@ -4530,15 +4530,66 @@ static const struct file_operations proc
74404
74405 static int __init slab_proc_init(void)
74406 {
74407- proc_create("slabinfo",S_IWUSR|S_IRUGO,NULL,&proc_slabinfo_operations);
74408+ mode_t gr_mode = S_IRUGO;
74409+
74410+#ifdef CONFIG_GRKERNSEC_PROC_ADD
74411+ gr_mode = S_IRUSR;
74412+#endif
74413+
74414+ proc_create("slabinfo",S_IWUSR|gr_mode,NULL,&proc_slabinfo_operations);
74415 #ifdef CONFIG_DEBUG_SLAB_LEAK
74416- proc_create("slab_allocators", 0, NULL, &proc_slabstats_operations);
74417+ proc_create("slab_allocators", gr_mode, NULL, &proc_slabstats_operations);
74418 #endif
74419 return 0;
74420 }
74421 module_init(slab_proc_init);
74422 #endif
74423
74424+void check_object_size(const void *ptr, unsigned long n, bool to)
74425+{
74426+
74427+#ifdef CONFIG_PAX_USERCOPY
74428+ struct page *page;
74429+ struct kmem_cache *cachep = NULL;
74430+ struct slab *slabp;
74431+ unsigned int objnr;
74432+ unsigned long offset;
74433+
74434+ if (!n)
74435+ return;
74436+
74437+ if (ZERO_OR_NULL_PTR(ptr))
74438+ goto report;
74439+
74440+ if (!virt_addr_valid(ptr))
74441+ return;
74442+
74443+ page = virt_to_head_page(ptr);
74444+
74445+ if (!PageSlab(page)) {
74446+ if (object_is_on_stack(ptr, n) == -1)
74447+ goto report;
74448+ return;
74449+ }
74450+
74451+ cachep = page_get_cache(page);
74452+ if (!(cachep->flags & SLAB_USERCOPY))
74453+ goto report;
74454+
74455+ slabp = page_get_slab(page);
74456+ objnr = obj_to_index(cachep, slabp, ptr);
74457+ BUG_ON(objnr >= cachep->num);
74458+ offset = ptr - index_to_obj(cachep, slabp, objnr) - obj_offset(cachep);
74459+ if (offset <= obj_size(cachep) && n <= obj_size(cachep) - offset)
74460+ return;
74461+
74462+report:
74463+ pax_report_usercopy(ptr, n, to, cachep ? cachep->name : NULL);
74464+#endif
74465+
74466+}
74467+EXPORT_SYMBOL(check_object_size);
74468+
74469 /**
74470 * ksize - get the actual amount of memory allocated for a given object
74471 * @objp: Pointer to the object
74472diff -urNp linux-2.6.39/mm/slob.c linux-2.6.39/mm/slob.c
74473--- linux-2.6.39/mm/slob.c 2011-05-19 00:06:34.000000000 -0400
74474+++ linux-2.6.39/mm/slob.c 2011-05-22 19:36:33.000000000 -0400
74475@@ -29,7 +29,7 @@
74476 * If kmalloc is asked for objects of PAGE_SIZE or larger, it calls
74477 * alloc_pages() directly, allocating compound pages so the page order
74478 * does not have to be separately tracked, and also stores the exact
74479- * allocation size in page->private so that it can be used to accurately
74480+ * allocation size in slob_page->size so that it can be used to accurately
74481 * provide ksize(). These objects are detected in kfree() because slob_page()
74482 * is false for them.
74483 *
74484@@ -58,6 +58,7 @@
74485 */
74486
74487 #include <linux/kernel.h>
74488+#include <linux/sched.h>
74489 #include <linux/slab.h>
74490 #include <linux/mm.h>
74491 #include <linux/swap.h> /* struct reclaim_state */
74492@@ -102,7 +103,8 @@ struct slob_page {
74493 unsigned long flags; /* mandatory */
74494 atomic_t _count; /* mandatory */
74495 slobidx_t units; /* free units left in page */
74496- unsigned long pad[2];
74497+ unsigned long pad[1];
74498+ unsigned long size; /* size when >=PAGE_SIZE */
74499 slob_t *free; /* first free slob_t in page */
74500 struct list_head list; /* linked list of free pages */
74501 };
74502@@ -135,7 +137,7 @@ static LIST_HEAD(free_slob_large);
74503 */
74504 static inline int is_slob_page(struct slob_page *sp)
74505 {
74506- return PageSlab((struct page *)sp);
74507+ return PageSlab((struct page *)sp) && !sp->size;
74508 }
74509
74510 static inline void set_slob_page(struct slob_page *sp)
74511@@ -150,7 +152,7 @@ static inline void clear_slob_page(struc
74512
74513 static inline struct slob_page *slob_page(const void *addr)
74514 {
74515- return (struct slob_page *)virt_to_page(addr);
74516+ return (struct slob_page *)virt_to_head_page(addr);
74517 }
74518
74519 /*
74520@@ -210,7 +212,7 @@ static void set_slob(slob_t *s, slobidx_
74521 /*
74522 * Return the size of a slob block.
74523 */
74524-static slobidx_t slob_units(slob_t *s)
74525+static slobidx_t slob_units(const slob_t *s)
74526 {
74527 if (s->units > 0)
74528 return s->units;
74529@@ -220,7 +222,7 @@ static slobidx_t slob_units(slob_t *s)
74530 /*
74531 * Return the next free slob block pointer after this one.
74532 */
74533-static slob_t *slob_next(slob_t *s)
74534+static slob_t *slob_next(const slob_t *s)
74535 {
74536 slob_t *base = (slob_t *)((unsigned long)s & PAGE_MASK);
74537 slobidx_t next;
74538@@ -235,7 +237,7 @@ static slob_t *slob_next(slob_t *s)
74539 /*
74540 * Returns true if s is the last free block in its page.
74541 */
74542-static int slob_last(slob_t *s)
74543+static int slob_last(const slob_t *s)
74544 {
74545 return !((unsigned long)slob_next(s) & ~PAGE_MASK);
74546 }
74547@@ -254,6 +256,7 @@ static void *slob_new_pages(gfp_t gfp, i
74548 if (!page)
74549 return NULL;
74550
74551+ set_slob_page(page);
74552 return page_address(page);
74553 }
74554
74555@@ -370,11 +373,11 @@ static void *slob_alloc(size_t size, gfp
74556 if (!b)
74557 return NULL;
74558 sp = slob_page(b);
74559- set_slob_page(sp);
74560
74561 spin_lock_irqsave(&slob_lock, flags);
74562 sp->units = SLOB_UNITS(PAGE_SIZE);
74563 sp->free = b;
74564+ sp->size = 0;
74565 INIT_LIST_HEAD(&sp->list);
74566 set_slob(b, SLOB_UNITS(PAGE_SIZE), b + SLOB_UNITS(PAGE_SIZE));
74567 set_slob_page_free(sp, slob_list);
74568@@ -476,10 +479,9 @@ out:
74569 * End of slob allocator proper. Begin kmem_cache_alloc and kmalloc frontend.
74570 */
74571
74572-void *__kmalloc_node(size_t size, gfp_t gfp, int node)
74573+static void *__kmalloc_node_align(size_t size, gfp_t gfp, int node, int align)
74574 {
74575- unsigned int *m;
74576- int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
74577+ slob_t *m;
74578 void *ret;
74579
74580 lockdep_trace_alloc(gfp);
74581@@ -492,7 +494,10 @@ void *__kmalloc_node(size_t size, gfp_t
74582
74583 if (!m)
74584 return NULL;
74585- *m = size;
74586+ BUILD_BUG_ON(ARCH_KMALLOC_MINALIGN < 2 * SLOB_UNIT);
74587+ BUILD_BUG_ON(ARCH_SLAB_MINALIGN < 2 * SLOB_UNIT);
74588+ m[0].units = size;
74589+ m[1].units = align;
74590 ret = (void *)m + align;
74591
74592 trace_kmalloc_node(_RET_IP_, ret,
74593@@ -504,9 +509,9 @@ void *__kmalloc_node(size_t size, gfp_t
74594 gfp |= __GFP_COMP;
74595 ret = slob_new_pages(gfp, order, node);
74596 if (ret) {
74597- struct page *page;
74598- page = virt_to_page(ret);
74599- page->private = size;
74600+ struct slob_page *sp;
74601+ sp = slob_page(ret);
74602+ sp->size = size;
74603 }
74604
74605 trace_kmalloc_node(_RET_IP_, ret,
74606@@ -516,6 +521,13 @@ void *__kmalloc_node(size_t size, gfp_t
74607 kmemleak_alloc(ret, size, 1, gfp);
74608 return ret;
74609 }
74610+
74611+void *__kmalloc_node(size_t size, gfp_t gfp, int node)
74612+{
74613+ int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
74614+
74615+ return __kmalloc_node_align(size, gfp, node, align);
74616+}
74617 EXPORT_SYMBOL(__kmalloc_node);
74618
74619 void kfree(const void *block)
74620@@ -531,13 +543,81 @@ void kfree(const void *block)
74621 sp = slob_page(block);
74622 if (is_slob_page(sp)) {
74623 int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
74624- unsigned int *m = (unsigned int *)(block - align);
74625- slob_free(m, *m + align);
74626- } else
74627+ slob_t *m = (slob_t *)(block - align);
74628+ slob_free(m, m[0].units + align);
74629+ } else {
74630+ clear_slob_page(sp);
74631+ free_slob_page(sp);
74632+ sp->size = 0;
74633 put_page(&sp->page);
74634+ }
74635 }
74636 EXPORT_SYMBOL(kfree);
74637
74638+void check_object_size(const void *ptr, unsigned long n, bool to)
74639+{
74640+
74641+#ifdef CONFIG_PAX_USERCOPY
74642+ struct slob_page *sp;
74643+ const slob_t *free;
74644+ const void *base;
74645+
74646+ if (!n)
74647+ return;
74648+
74649+ if (ZERO_OR_NULL_PTR(ptr))
74650+ goto report;
74651+
74652+ if (!virt_addr_valid(ptr))
74653+ return;
74654+
74655+ sp = slob_page(ptr);
74656+ if (!PageSlab((struct page*)sp)) {
74657+ if (object_is_on_stack(ptr, n) == -1)
74658+ goto report;
74659+ return;
74660+ }
74661+
74662+ if (sp->size) {
74663+ base = page_address(&sp->page);
74664+ if (base <= ptr && n <= sp->size - (ptr - base))
74665+ return;
74666+ goto report;
74667+ }
74668+
74669+ /* some tricky double walking to find the chunk */
74670+ base = (void *)((unsigned long)ptr & PAGE_MASK);
74671+ free = sp->free;
74672+
74673+ while (!slob_last(free) && (void *)free <= ptr) {
74674+ base = free + slob_units(free);
74675+ free = slob_next(free);
74676+ }
74677+
74678+ while (base < (void *)free) {
74679+ slobidx_t m = ((slob_t *)base)[0].units, align = ((slob_t *)base)[1].units;
74680+ int size = SLOB_UNIT * SLOB_UNITS(m + align);
74681+ int offset;
74682+
74683+ if (ptr < base + align)
74684+ goto report;
74685+
74686+ offset = ptr - base - align;
74687+ if (offset < m) {
74688+ if (n <= m - offset)
74689+ return;
74690+ goto report;
74691+ }
74692+ base += size;
74693+ }
74694+
74695+report:
74696+ pax_report_usercopy(ptr, n, to, NULL);
74697+#endif
74698+
74699+}
74700+EXPORT_SYMBOL(check_object_size);
74701+
74702 /* can't use ksize for kmem_cache_alloc memory, only kmalloc */
74703 size_t ksize(const void *block)
74704 {
74705@@ -550,10 +630,10 @@ size_t ksize(const void *block)
74706 sp = slob_page(block);
74707 if (is_slob_page(sp)) {
74708 int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
74709- unsigned int *m = (unsigned int *)(block - align);
74710- return SLOB_UNITS(*m) * SLOB_UNIT;
74711+ slob_t *m = (slob_t *)(block - align);
74712+ return SLOB_UNITS(m[0].units) * SLOB_UNIT;
74713 } else
74714- return sp->page.private;
74715+ return sp->size;
74716 }
74717 EXPORT_SYMBOL(ksize);
74718
74719@@ -608,17 +688,25 @@ void *kmem_cache_alloc_node(struct kmem_
74720 {
74721 void *b;
74722
74723+#ifdef CONFIG_PAX_USERCOPY
74724+ b = __kmalloc_node_align(c->size, flags, node, c->align);
74725+#else
74726 if (c->size < PAGE_SIZE) {
74727 b = slob_alloc(c->size, flags, c->align, node);
74728 trace_kmem_cache_alloc_node(_RET_IP_, b, c->size,
74729 SLOB_UNITS(c->size) * SLOB_UNIT,
74730 flags, node);
74731 } else {
74732+ struct slob_page *sp;
74733+
74734 b = slob_new_pages(flags, get_order(c->size), node);
74735+ sp = slob_page(b);
74736+ sp->size = c->size;
74737 trace_kmem_cache_alloc_node(_RET_IP_, b, c->size,
74738 PAGE_SIZE << get_order(c->size),
74739 flags, node);
74740 }
74741+#endif
74742
74743 if (c->ctor)
74744 c->ctor(b);
74745@@ -630,10 +718,16 @@ EXPORT_SYMBOL(kmem_cache_alloc_node);
74746
74747 static void __kmem_cache_free(void *b, int size)
74748 {
74749- if (size < PAGE_SIZE)
74750+ struct slob_page *sp = slob_page(b);
74751+
74752+ if (is_slob_page(sp))
74753 slob_free(b, size);
74754- else
74755+ else {
74756+ clear_slob_page(sp);
74757+ free_slob_page(sp);
74758+ sp->size = 0;
74759 slob_free_pages(b, get_order(size));
74760+ }
74761 }
74762
74763 static void kmem_rcu_free(struct rcu_head *head)
74764@@ -646,14 +740,23 @@ static void kmem_rcu_free(struct rcu_hea
74765
74766 void kmem_cache_free(struct kmem_cache *c, void *b)
74767 {
74768+ int size = c->size;
74769+
74770+#ifdef CONFIG_PAX_USERCOPY
74771+ if (size + c->align < PAGE_SIZE) {
74772+ size += c->align;
74773+ b -= c->align;
74774+ }
74775+#endif
74776+
74777 kmemleak_free_recursive(b, c->flags);
74778 if (unlikely(c->flags & SLAB_DESTROY_BY_RCU)) {
74779 struct slob_rcu *slob_rcu;
74780- slob_rcu = b + (c->size - sizeof(struct slob_rcu));
74781- slob_rcu->size = c->size;
74782+ slob_rcu = b + (size - sizeof(struct slob_rcu));
74783+ slob_rcu->size = size;
74784 call_rcu(&slob_rcu->head, kmem_rcu_free);
74785 } else {
74786- __kmem_cache_free(b, c->size);
74787+ __kmem_cache_free(b, size);
74788 }
74789
74790 trace_kmem_cache_free(_RET_IP_, b);
74791diff -urNp linux-2.6.39/mm/slub.c linux-2.6.39/mm/slub.c
74792--- linux-2.6.39/mm/slub.c 2011-05-19 00:06:34.000000000 -0400
74793+++ linux-2.6.39/mm/slub.c 2011-05-22 19:41:42.000000000 -0400
74794@@ -419,7 +419,7 @@ static void print_track(const char *s, s
74795 if (!t->addr)
74796 return;
74797
74798- printk(KERN_ERR "INFO: %s in %pS age=%lu cpu=%u pid=%d\n",
74799+ printk(KERN_ERR "INFO: %s in %pA age=%lu cpu=%u pid=%d\n",
74800 s, (void *)t->addr, jiffies - t->when, t->cpu, t->pid);
74801 }
74802
74803@@ -2171,6 +2171,8 @@ void kmem_cache_free(struct kmem_cache *
74804
74805 page = virt_to_head_page(x);
74806
74807+ BUG_ON(!PageSlab(page));
74808+
74809 slab_free(s, page, x, _RET_IP_);
74810
74811 trace_kmem_cache_free(_RET_IP_, x);
74812@@ -2204,7 +2206,7 @@ static int slub_min_objects;
74813 * Merge control. If this is set then no merging of slab caches will occur.
74814 * (Could be removed. This was introduced to pacify the merge skeptics.)
74815 */
74816-static int slub_nomerge;
74817+static int slub_nomerge = 1;
74818
74819 /*
74820 * Calculate the order of allocation given an slab object size.
74821@@ -2632,7 +2634,7 @@ static int kmem_cache_open(struct kmem_c
74822 * list to avoid pounding the page allocator excessively.
74823 */
74824 set_min_partial(s, ilog2(s->size));
74825- s->refcount = 1;
74826+ atomic_set(&s->refcount, 1);
74827 #ifdef CONFIG_NUMA
74828 s->remote_node_defrag_ratio = 1000;
74829 #endif
74830@@ -2738,8 +2740,7 @@ static inline int kmem_cache_close(struc
74831 void kmem_cache_destroy(struct kmem_cache *s)
74832 {
74833 down_write(&slub_lock);
74834- s->refcount--;
74835- if (!s->refcount) {
74836+ if (atomic_dec_and_test(&s->refcount)) {
74837 list_del(&s->list);
74838 if (kmem_cache_close(s)) {
74839 printk(KERN_ERR "SLUB %s: %s called for cache that "
74840@@ -2949,6 +2950,46 @@ void *__kmalloc_node(size_t size, gfp_t
74841 EXPORT_SYMBOL(__kmalloc_node);
74842 #endif
74843
74844+void check_object_size(const void *ptr, unsigned long n, bool to)
74845+{
74846+
74847+#ifdef CONFIG_PAX_USERCOPY
74848+ struct page *page;
74849+ struct kmem_cache *s = NULL;
74850+ unsigned long offset;
74851+
74852+ if (!n)
74853+ return;
74854+
74855+ if (ZERO_OR_NULL_PTR(ptr))
74856+ goto report;
74857+
74858+ if (!virt_addr_valid(ptr))
74859+ return;
74860+
74861+ page = virt_to_head_page(ptr);
74862+
74863+ if (!PageSlab(page)) {
74864+ if (object_is_on_stack(ptr, n) == -1)
74865+ goto report;
74866+ return;
74867+ }
74868+
74869+ s = page->slab;
74870+ if (!(s->flags & SLAB_USERCOPY))
74871+ goto report;
74872+
74873+ offset = (ptr - page_address(page)) % s->size;
74874+ if (offset <= s->objsize && n <= s->objsize - offset)
74875+ return;
74876+
74877+report:
74878+ pax_report_usercopy(ptr, n, to, s ? s->name : NULL);
74879+#endif
74880+
74881+}
74882+EXPORT_SYMBOL(check_object_size);
74883+
74884 size_t ksize(const void *object)
74885 {
74886 struct page *page;
74887@@ -3193,7 +3234,7 @@ static void __init kmem_cache_bootstrap_
74888 int node;
74889
74890 list_add(&s->list, &slab_caches);
74891- s->refcount = -1;
74892+ atomic_set(&s->refcount, -1);
74893
74894 for_each_node_state(node, N_NORMAL_MEMORY) {
74895 struct kmem_cache_node *n = get_node(s, node);
74896@@ -3310,17 +3351,17 @@ void __init kmem_cache_init(void)
74897
74898 /* Caches that are not of the two-to-the-power-of size */
74899 if (KMALLOC_MIN_SIZE <= 32) {
74900- kmalloc_caches[1] = create_kmalloc_cache("kmalloc-96", 96, 0);
74901+ kmalloc_caches[1] = create_kmalloc_cache("kmalloc-96", 96, SLAB_USERCOPY);
74902 caches++;
74903 }
74904
74905 if (KMALLOC_MIN_SIZE <= 64) {
74906- kmalloc_caches[2] = create_kmalloc_cache("kmalloc-192", 192, 0);
74907+ kmalloc_caches[2] = create_kmalloc_cache("kmalloc-192", 192, SLAB_USERCOPY);
74908 caches++;
74909 }
74910
74911 for (i = KMALLOC_SHIFT_LOW; i < SLUB_PAGE_SHIFT; i++) {
74912- kmalloc_caches[i] = create_kmalloc_cache("kmalloc", 1 << i, 0);
74913+ kmalloc_caches[i] = create_kmalloc_cache("kmalloc", 1 << i, SLAB_USERCOPY);
74914 caches++;
74915 }
74916
74917@@ -3388,7 +3429,7 @@ static int slab_unmergeable(struct kmem_
74918 /*
74919 * We may have set a slab to be unmergeable during bootstrap.
74920 */
74921- if (s->refcount < 0)
74922+ if (atomic_read(&s->refcount) < 0)
74923 return 1;
74924
74925 return 0;
74926@@ -3447,7 +3488,7 @@ struct kmem_cache *kmem_cache_create(con
74927 down_write(&slub_lock);
74928 s = find_mergeable(size, align, flags, name, ctor);
74929 if (s) {
74930- s->refcount++;
74931+ atomic_inc(&s->refcount);
74932 /*
74933 * Adjust the object sizes so that we clear
74934 * the complete object on kzalloc.
74935@@ -3456,7 +3497,7 @@ struct kmem_cache *kmem_cache_create(con
74936 s->inuse = max_t(int, s->inuse, ALIGN(size, sizeof(void *)));
74937
74938 if (sysfs_slab_alias(s, name)) {
74939- s->refcount--;
74940+ atomic_dec(&s->refcount);
74941 goto err;
74942 }
74943 up_write(&slub_lock);
74944@@ -4189,7 +4230,7 @@ SLAB_ATTR_RO(ctor);
74945
74946 static ssize_t aliases_show(struct kmem_cache *s, char *buf)
74947 {
74948- return sprintf(buf, "%d\n", s->refcount - 1);
74949+ return sprintf(buf, "%d\n", atomic_read(&s->refcount) - 1);
74950 }
74951 SLAB_ATTR_RO(aliases);
74952
74953@@ -4933,7 +4974,13 @@ static const struct file_operations proc
74954
74955 static int __init slab_proc_init(void)
74956 {
74957- proc_create("slabinfo", S_IRUGO, NULL, &proc_slabinfo_operations);
74958+ mode_t gr_mode = S_IRUGO;
74959+
74960+#ifdef CONFIG_GRKERNSEC_PROC_ADD
74961+ gr_mode = S_IRUSR;
74962+#endif
74963+
74964+ proc_create("slabinfo", gr_mode, NULL, &proc_slabinfo_operations);
74965 return 0;
74966 }
74967 module_init(slab_proc_init);
74968diff -urNp linux-2.6.39/mm/swapfile.c linux-2.6.39/mm/swapfile.c
74969--- linux-2.6.39/mm/swapfile.c 2011-05-19 00:06:34.000000000 -0400
74970+++ linux-2.6.39/mm/swapfile.c 2011-05-22 19:36:33.000000000 -0400
74971@@ -61,7 +61,7 @@ static DEFINE_MUTEX(swapon_mutex);
74972
74973 static DECLARE_WAIT_QUEUE_HEAD(proc_poll_wait);
74974 /* Activity counter to indicate that a swapon or swapoff has occurred */
74975-static atomic_t proc_poll_event = ATOMIC_INIT(0);
74976+static atomic_unchecked_t proc_poll_event = ATOMIC_INIT(0);
74977
74978 static inline unsigned char swap_count(unsigned char ent)
74979 {
74980@@ -1669,7 +1669,7 @@ SYSCALL_DEFINE1(swapoff, const char __us
74981 }
74982 filp_close(swap_file, NULL);
74983 err = 0;
74984- atomic_inc(&proc_poll_event);
74985+ atomic_inc_unchecked(&proc_poll_event);
74986 wake_up_interruptible(&proc_poll_wait);
74987
74988 out_dput:
74989@@ -1690,8 +1690,8 @@ static unsigned swaps_poll(struct file *
74990
74991 poll_wait(file, &proc_poll_wait, wait);
74992
74993- if (s->event != atomic_read(&proc_poll_event)) {
74994- s->event = atomic_read(&proc_poll_event);
74995+ if (s->event != atomic_read_unchecked(&proc_poll_event)) {
74996+ s->event = atomic_read_unchecked(&proc_poll_event);
74997 return POLLIN | POLLRDNORM | POLLERR | POLLPRI;
74998 }
74999
75000@@ -1797,7 +1797,7 @@ static int swaps_open(struct inode *inod
75001 }
75002
75003 s->seq.private = s;
75004- s->event = atomic_read(&proc_poll_event);
75005+ s->event = atomic_read_unchecked(&proc_poll_event);
75006 return ret;
75007 }
75008
75009@@ -2131,7 +2131,7 @@ SYSCALL_DEFINE2(swapon, const char __use
75010 (p->flags & SWP_DISCARDABLE) ? "D" : "");
75011
75012 mutex_unlock(&swapon_mutex);
75013- atomic_inc(&proc_poll_event);
75014+ atomic_inc_unchecked(&proc_poll_event);
75015 wake_up_interruptible(&proc_poll_wait);
75016
75017 if (S_ISREG(inode->i_mode))
75018diff -urNp linux-2.6.39/mm/util.c linux-2.6.39/mm/util.c
75019--- linux-2.6.39/mm/util.c 2011-05-19 00:06:34.000000000 -0400
75020+++ linux-2.6.39/mm/util.c 2011-05-23 17:07:00.000000000 -0400
75021@@ -112,6 +112,7 @@ EXPORT_SYMBOL(memdup_user);
75022 * allocated buffer. Use this if you don't want to free the buffer immediately
75023 * like, for example, with RCU.
75024 */
75025+#undef __krealloc
75026 void *__krealloc(const void *p, size_t new_size, gfp_t flags)
75027 {
75028 void *ret;
75029@@ -145,6 +146,7 @@ EXPORT_SYMBOL(__krealloc);
75030 * behaves exactly like kmalloc(). If @size is 0 and @p is not a
75031 * %NULL pointer, the object pointed to is freed.
75032 */
75033+#undef krealloc
75034 void *krealloc(const void *p, size_t new_size, gfp_t flags)
75035 {
75036 void *ret;
75037@@ -219,6 +221,12 @@ EXPORT_SYMBOL(strndup_user);
75038 void arch_pick_mmap_layout(struct mm_struct *mm)
75039 {
75040 mm->mmap_base = TASK_UNMAPPED_BASE;
75041+
75042+#ifdef CONFIG_PAX_RANDMMAP
75043+ if (mm->pax_flags & MF_PAX_RANDMMAP)
75044+ mm->mmap_base += mm->delta_mmap;
75045+#endif
75046+
75047 mm->get_unmapped_area = arch_get_unmapped_area;
75048 mm->unmap_area = arch_unmap_area;
75049 }
75050diff -urNp linux-2.6.39/mm/vmalloc.c linux-2.6.39/mm/vmalloc.c
75051--- linux-2.6.39/mm/vmalloc.c 2011-05-19 00:06:34.000000000 -0400
75052+++ linux-2.6.39/mm/vmalloc.c 2011-05-22 19:36:33.000000000 -0400
75053@@ -39,8 +39,19 @@ static void vunmap_pte_range(pmd_t *pmd,
75054
75055 pte = pte_offset_kernel(pmd, addr);
75056 do {
75057- pte_t ptent = ptep_get_and_clear(&init_mm, addr, pte);
75058- WARN_ON(!pte_none(ptent) && !pte_present(ptent));
75059+
75060+#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
75061+ if ((unsigned long)MODULES_EXEC_VADDR <= addr && addr < (unsigned long)MODULES_EXEC_END) {
75062+ BUG_ON(!pte_exec(*pte));
75063+ set_pte_at(&init_mm, addr, pte, pfn_pte(__pa(addr) >> PAGE_SHIFT, PAGE_KERNEL_EXEC));
75064+ continue;
75065+ }
75066+#endif
75067+
75068+ {
75069+ pte_t ptent = ptep_get_and_clear(&init_mm, addr, pte);
75070+ WARN_ON(!pte_none(ptent) && !pte_present(ptent));
75071+ }
75072 } while (pte++, addr += PAGE_SIZE, addr != end);
75073 }
75074
75075@@ -91,6 +102,7 @@ static int vmap_pte_range(pmd_t *pmd, un
75076 unsigned long end, pgprot_t prot, struct page **pages, int *nr)
75077 {
75078 pte_t *pte;
75079+ int ret = -ENOMEM;
75080
75081 /*
75082 * nr is a running index into the array which helps higher level
75083@@ -100,17 +112,30 @@ static int vmap_pte_range(pmd_t *pmd, un
75084 pte = pte_alloc_kernel(pmd, addr);
75085 if (!pte)
75086 return -ENOMEM;
75087+
75088+ pax_open_kernel();
75089 do {
75090 struct page *page = pages[*nr];
75091
75092- if (WARN_ON(!pte_none(*pte)))
75093- return -EBUSY;
75094- if (WARN_ON(!page))
75095- return -ENOMEM;
75096+#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
75097+ if (pgprot_val(prot) & _PAGE_NX)
75098+#endif
75099+
75100+ if (WARN_ON(!pte_none(*pte))) {
75101+ ret = -EBUSY;
75102+ goto out;
75103+ }
75104+ if (WARN_ON(!page)) {
75105+ ret = -ENOMEM;
75106+ goto out;
75107+ }
75108 set_pte_at(&init_mm, addr, pte, mk_pte(page, prot));
75109 (*nr)++;
75110 } while (pte++, addr += PAGE_SIZE, addr != end);
75111- return 0;
75112+ ret = 0;
75113+out:
75114+ pax_close_kernel();
75115+ return ret;
75116 }
75117
75118 static int vmap_pmd_range(pud_t *pud, unsigned long addr,
75119@@ -191,11 +216,20 @@ int is_vmalloc_or_module_addr(const void
75120 * and fall back on vmalloc() if that fails. Others
75121 * just put it in the vmalloc space.
75122 */
75123-#if defined(CONFIG_MODULES) && defined(MODULES_VADDR)
75124+#ifdef CONFIG_MODULES
75125+#ifdef MODULES_VADDR
75126 unsigned long addr = (unsigned long)x;
75127 if (addr >= MODULES_VADDR && addr < MODULES_END)
75128 return 1;
75129 #endif
75130+
75131+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
75132+ if (x >= (const void *)MODULES_EXEC_VADDR && x < (const void *)MODULES_EXEC_END)
75133+ return 1;
75134+#endif
75135+
75136+#endif
75137+
75138 return is_vmalloc_addr(x);
75139 }
75140
75141@@ -216,8 +250,14 @@ struct page *vmalloc_to_page(const void
75142
75143 if (!pgd_none(*pgd)) {
75144 pud_t *pud = pud_offset(pgd, addr);
75145+#ifdef CONFIG_X86
75146+ if (!pud_large(*pud))
75147+#endif
75148 if (!pud_none(*pud)) {
75149 pmd_t *pmd = pmd_offset(pud, addr);
75150+#ifdef CONFIG_X86
75151+ if (!pmd_large(*pmd))
75152+#endif
75153 if (!pmd_none(*pmd)) {
75154 pte_t *ptep, pte;
75155
75156@@ -1296,6 +1336,16 @@ static struct vm_struct *__get_vm_area_n
75157 struct vm_struct *area;
75158
75159 BUG_ON(in_interrupt());
75160+
75161+#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
75162+ if (flags & VM_KERNEXEC) {
75163+ if (start != VMALLOC_START || end != VMALLOC_END)
75164+ return NULL;
75165+ start = (unsigned long)MODULES_EXEC_VADDR;
75166+ end = (unsigned long)MODULES_EXEC_END;
75167+ }
75168+#endif
75169+
75170 if (flags & VM_IOREMAP) {
75171 int bit = fls(size);
75172
75173@@ -1514,6 +1564,11 @@ void *vmap(struct page **pages, unsigned
75174 if (count > totalram_pages)
75175 return NULL;
75176
75177+#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
75178+ if (!(pgprot_val(prot) & _PAGE_NX))
75179+ flags |= VM_KERNEXEC;
75180+#endif
75181+
75182 area = get_vm_area_caller((count << PAGE_SHIFT), flags,
75183 __builtin_return_address(0));
75184 if (!area)
75185@@ -1610,6 +1665,13 @@ void *__vmalloc_node_range(unsigned long
75186 if (!size || (size >> PAGE_SHIFT) > totalram_pages)
75187 return NULL;
75188
75189+#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
75190+ if (!(pgprot_val(prot) & _PAGE_NX))
75191+ area = __get_vm_area_node(size, align, VM_ALLOC | VM_KERNEXEC, VMALLOC_START, VMALLOC_END,
75192+ node, gfp_mask, caller);
75193+ else
75194+#endif
75195+
75196 area = __get_vm_area_node(size, align, VM_ALLOC, start, end, node,
75197 gfp_mask, caller);
75198
75199@@ -1649,6 +1711,7 @@ static void *__vmalloc_node(unsigned lon
75200 gfp_mask, prot, node, caller);
75201 }
75202
75203+#undef __vmalloc
75204 void *__vmalloc(unsigned long size, gfp_t gfp_mask, pgprot_t prot)
75205 {
75206 return __vmalloc_node(size, 1, gfp_mask, prot, -1,
75207@@ -1672,6 +1735,7 @@ static inline void *__vmalloc_node_flags
75208 * For tight control over page level allocator and protection flags
75209 * use __vmalloc() instead.
75210 */
75211+#undef vmalloc
75212 void *vmalloc(unsigned long size)
75213 {
75214 return __vmalloc_node_flags(size, -1, GFP_KERNEL | __GFP_HIGHMEM);
75215@@ -1688,6 +1752,7 @@ EXPORT_SYMBOL(vmalloc);
75216 * For tight control over page level allocator and protection flags
75217 * use __vmalloc() instead.
75218 */
75219+#undef vzalloc
75220 void *vzalloc(unsigned long size)
75221 {
75222 return __vmalloc_node_flags(size, -1,
75223@@ -1702,6 +1767,7 @@ EXPORT_SYMBOL(vzalloc);
75224 * The resulting memory area is zeroed so it can be mapped to userspace
75225 * without leaking data.
75226 */
75227+#undef vmalloc_user
75228 void *vmalloc_user(unsigned long size)
75229 {
75230 struct vm_struct *area;
75231@@ -1729,6 +1795,7 @@ EXPORT_SYMBOL(vmalloc_user);
75232 * For tight control over page level allocator and protection flags
75233 * use __vmalloc() instead.
75234 */
75235+#undef vmalloc_node
75236 void *vmalloc_node(unsigned long size, int node)
75237 {
75238 return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL,
75239@@ -1748,6 +1815,7 @@ EXPORT_SYMBOL(vmalloc_node);
75240 * For tight control over page level allocator and protection flags
75241 * use __vmalloc_node() instead.
75242 */
75243+#undef vzalloc_node
75244 void *vzalloc_node(unsigned long size, int node)
75245 {
75246 return __vmalloc_node_flags(size, node,
75247@@ -1770,10 +1838,10 @@ EXPORT_SYMBOL(vzalloc_node);
75248 * For tight control over page level allocator and protection flags
75249 * use __vmalloc() instead.
75250 */
75251-
75252+#undef vmalloc_exec
75253 void *vmalloc_exec(unsigned long size)
75254 {
75255- return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL_EXEC,
75256+ return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO, PAGE_KERNEL_EXEC,
75257 -1, __builtin_return_address(0));
75258 }
75259
75260@@ -1792,6 +1860,7 @@ void *vmalloc_exec(unsigned long size)
75261 * Allocate enough 32bit PA addressable pages to cover @size from the
75262 * page level allocator and map them into contiguous kernel virtual space.
75263 */
75264+#undef vmalloc_32
75265 void *vmalloc_32(unsigned long size)
75266 {
75267 return __vmalloc_node(size, 1, GFP_VMALLOC32, PAGE_KERNEL,
75268@@ -1806,6 +1875,7 @@ EXPORT_SYMBOL(vmalloc_32);
75269 * The resulting memory area is 32bit addressable and zeroed so it can be
75270 * mapped to userspace without leaking data.
75271 */
75272+#undef vmalloc_32_user
75273 void *vmalloc_32_user(unsigned long size)
75274 {
75275 struct vm_struct *area;
75276@@ -2068,6 +2138,8 @@ int remap_vmalloc_range(struct vm_area_s
75277 unsigned long uaddr = vma->vm_start;
75278 unsigned long usize = vma->vm_end - vma->vm_start;
75279
75280+ BUG_ON(vma->vm_mirror);
75281+
75282 if ((PAGE_SIZE-1) & (unsigned long)addr)
75283 return -EINVAL;
75284
75285diff -urNp linux-2.6.39/mm/vmstat.c linux-2.6.39/mm/vmstat.c
75286--- linux-2.6.39/mm/vmstat.c 2011-05-19 00:06:34.000000000 -0400
75287+++ linux-2.6.39/mm/vmstat.c 2011-05-22 19:41:42.000000000 -0400
75288@@ -78,7 +78,7 @@ void vm_events_fold_cpu(int cpu)
75289 *
75290 * vm_stat contains the global counters
75291 */
75292-atomic_long_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
75293+atomic_long_unchecked_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
75294 EXPORT_SYMBOL(vm_stat);
75295
75296 #ifdef CONFIG_SMP
75297@@ -454,7 +454,7 @@ void refresh_cpu_vm_stats(int cpu)
75298 v = p->vm_stat_diff[i];
75299 p->vm_stat_diff[i] = 0;
75300 local_irq_restore(flags);
75301- atomic_long_add(v, &zone->vm_stat[i]);
75302+ atomic_long_add_unchecked(v, &zone->vm_stat[i]);
75303 global_diff[i] += v;
75304 #ifdef CONFIG_NUMA
75305 /* 3 seconds idle till flush */
75306@@ -492,7 +492,7 @@ void refresh_cpu_vm_stats(int cpu)
75307
75308 for (i = 0; i < NR_VM_ZONE_STAT_ITEMS; i++)
75309 if (global_diff[i])
75310- atomic_long_add(global_diff[i], &vm_stat[i]);
75311+ atomic_long_add_unchecked(global_diff[i], &vm_stat[i]);
75312 }
75313
75314 #endif
75315@@ -1205,10 +1205,20 @@ static int __init setup_vmstat(void)
75316 start_cpu_timer(cpu);
75317 #endif
75318 #ifdef CONFIG_PROC_FS
75319- proc_create("buddyinfo", S_IRUGO, NULL, &fragmentation_file_operations);
75320- proc_create("pagetypeinfo", S_IRUGO, NULL, &pagetypeinfo_file_ops);
75321- proc_create("vmstat", S_IRUGO, NULL, &proc_vmstat_file_operations);
75322- proc_create("zoneinfo", S_IRUGO, NULL, &proc_zoneinfo_file_operations);
75323+ {
75324+ mode_t gr_mode = S_IRUGO;
75325+#ifdef CONFIG_GRKERNSEC_PROC_ADD
75326+ gr_mode = S_IRUSR;
75327+#endif
75328+ proc_create("buddyinfo", gr_mode, NULL, &fragmentation_file_operations);
75329+ proc_create("pagetypeinfo", gr_mode, NULL, &pagetypeinfo_file_ops);
75330+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
75331+ proc_create("vmstat", gr_mode | S_IRGRP, NULL, &proc_vmstat_file_operations);
75332+#else
75333+ proc_create("vmstat", gr_mode, NULL, &proc_vmstat_file_operations);
75334+#endif
75335+ proc_create("zoneinfo", gr_mode, NULL, &proc_zoneinfo_file_operations);
75336+ }
75337 #endif
75338 return 0;
75339 }
75340diff -urNp linux-2.6.39/net/8021q/vlan.c linux-2.6.39/net/8021q/vlan.c
75341--- linux-2.6.39/net/8021q/vlan.c 2011-05-19 00:06:34.000000000 -0400
75342+++ linux-2.6.39/net/8021q/vlan.c 2011-05-22 19:36:33.000000000 -0400
75343@@ -592,8 +592,7 @@ static int vlan_ioctl_handler(struct net
75344 err = -EPERM;
75345 if (!capable(CAP_NET_ADMIN))
75346 break;
75347- if ((args.u.name_type >= 0) &&
75348- (args.u.name_type < VLAN_NAME_TYPE_HIGHEST)) {
75349+ if (args.u.name_type < VLAN_NAME_TYPE_HIGHEST) {
75350 struct vlan_net *vn;
75351
75352 vn = net_generic(net, vlan_net_id);
75353diff -urNp linux-2.6.39/net/atm/atm_misc.c linux-2.6.39/net/atm/atm_misc.c
75354--- linux-2.6.39/net/atm/atm_misc.c 2011-05-19 00:06:34.000000000 -0400
75355+++ linux-2.6.39/net/atm/atm_misc.c 2011-05-22 19:36:33.000000000 -0400
75356@@ -17,7 +17,7 @@ int atm_charge(struct atm_vcc *vcc, int
75357 if (atomic_read(&sk_atm(vcc)->sk_rmem_alloc) <= sk_atm(vcc)->sk_rcvbuf)
75358 return 1;
75359 atm_return(vcc, truesize);
75360- atomic_inc(&vcc->stats->rx_drop);
75361+ atomic_inc_unchecked(&vcc->stats->rx_drop);
75362 return 0;
75363 }
75364 EXPORT_SYMBOL(atm_charge);
75365@@ -39,7 +39,7 @@ struct sk_buff *atm_alloc_charge(struct
75366 }
75367 }
75368 atm_return(vcc, guess);
75369- atomic_inc(&vcc->stats->rx_drop);
75370+ atomic_inc_unchecked(&vcc->stats->rx_drop);
75371 return NULL;
75372 }
75373 EXPORT_SYMBOL(atm_alloc_charge);
75374@@ -86,7 +86,7 @@ EXPORT_SYMBOL(atm_pcr_goal);
75375
75376 void sonet_copy_stats(struct k_sonet_stats *from, struct sonet_stats *to)
75377 {
75378-#define __HANDLE_ITEM(i) to->i = atomic_read(&from->i)
75379+#define __HANDLE_ITEM(i) to->i = atomic_read_unchecked(&from->i)
75380 __SONET_ITEMS
75381 #undef __HANDLE_ITEM
75382 }
75383@@ -94,7 +94,7 @@ EXPORT_SYMBOL(sonet_copy_stats);
75384
75385 void sonet_subtract_stats(struct k_sonet_stats *from, struct sonet_stats *to)
75386 {
75387-#define __HANDLE_ITEM(i) atomic_sub(to->i, &from->i)
75388+#define __HANDLE_ITEM(i) atomic_sub_unchecked(to->i,&from->i)
75389 __SONET_ITEMS
75390 #undef __HANDLE_ITEM
75391 }
75392diff -urNp linux-2.6.39/net/atm/mpoa_caches.c linux-2.6.39/net/atm/mpoa_caches.c
75393--- linux-2.6.39/net/atm/mpoa_caches.c 2011-05-19 00:06:34.000000000 -0400
75394+++ linux-2.6.39/net/atm/mpoa_caches.c 2011-05-22 19:36:33.000000000 -0400
75395@@ -255,6 +255,8 @@ static void check_resolving_entries(stru
75396 struct timeval now;
75397 struct k_message msg;
75398
75399+ pax_track_stack();
75400+
75401 do_gettimeofday(&now);
75402
75403 read_lock_bh(&client->ingress_lock);
75404diff -urNp linux-2.6.39/net/atm/proc.c linux-2.6.39/net/atm/proc.c
75405--- linux-2.6.39/net/atm/proc.c 2011-05-19 00:06:34.000000000 -0400
75406+++ linux-2.6.39/net/atm/proc.c 2011-05-22 19:41:42.000000000 -0400
75407@@ -45,9 +45,9 @@ static void add_stats(struct seq_file *s
75408 const struct k_atm_aal_stats *stats)
75409 {
75410 seq_printf(seq, "%s ( %d %d %d %d %d )", aal,
75411- atomic_read(&stats->tx), atomic_read(&stats->tx_err),
75412- atomic_read(&stats->rx), atomic_read(&stats->rx_err),
75413- atomic_read(&stats->rx_drop));
75414+ atomic_read_unchecked(&stats->tx),atomic_read_unchecked(&stats->tx_err),
75415+ atomic_read_unchecked(&stats->rx),atomic_read_unchecked(&stats->rx_err),
75416+ atomic_read_unchecked(&stats->rx_drop));
75417 }
75418
75419 static void atm_dev_info(struct seq_file *seq, const struct atm_dev *dev)
75420@@ -191,7 +191,12 @@ static void vcc_info(struct seq_file *se
75421 {
75422 struct sock *sk = sk_atm(vcc);
75423
75424+#ifdef CONFIG_GRKERNSEC_HIDESYM
75425+ seq_printf(seq, "%p ", NULL);
75426+#else
75427 seq_printf(seq, "%p ", vcc);
75428+#endif
75429+
75430 if (!vcc->dev)
75431 seq_printf(seq, "Unassigned ");
75432 else
75433@@ -218,7 +223,11 @@ static void svc_info(struct seq_file *se
75434 {
75435 if (!vcc->dev)
75436 seq_printf(seq, sizeof(void *) == 4 ?
75437+#ifdef CONFIG_GRKERNSEC_HIDESYM
75438+ "N/A@%p%10s" : "N/A@%p%2s", NULL, "");
75439+#else
75440 "N/A@%p%10s" : "N/A@%p%2s", vcc, "");
75441+#endif
75442 else
75443 seq_printf(seq, "%3d %3d %5d ",
75444 vcc->dev->number, vcc->vpi, vcc->vci);
75445diff -urNp linux-2.6.39/net/atm/resources.c linux-2.6.39/net/atm/resources.c
75446--- linux-2.6.39/net/atm/resources.c 2011-05-19 00:06:34.000000000 -0400
75447+++ linux-2.6.39/net/atm/resources.c 2011-05-22 19:36:33.000000000 -0400
75448@@ -160,7 +160,7 @@ EXPORT_SYMBOL(atm_dev_deregister);
75449 static void copy_aal_stats(struct k_atm_aal_stats *from,
75450 struct atm_aal_stats *to)
75451 {
75452-#define __HANDLE_ITEM(i) to->i = atomic_read(&from->i)
75453+#define __HANDLE_ITEM(i) to->i = atomic_read_unchecked(&from->i)
75454 __AAL_STAT_ITEMS
75455 #undef __HANDLE_ITEM
75456 }
75457@@ -168,7 +168,7 @@ static void copy_aal_stats(struct k_atm_
75458 static void subtract_aal_stats(struct k_atm_aal_stats *from,
75459 struct atm_aal_stats *to)
75460 {
75461-#define __HANDLE_ITEM(i) atomic_sub(to->i, &from->i)
75462+#define __HANDLE_ITEM(i) atomic_sub_unchecked(to->i, &from->i)
75463 __AAL_STAT_ITEMS
75464 #undef __HANDLE_ITEM
75465 }
75466diff -urNp linux-2.6.39/net/batman-adv/hard-interface.c linux-2.6.39/net/batman-adv/hard-interface.c
75467--- linux-2.6.39/net/batman-adv/hard-interface.c 2011-05-19 00:06:34.000000000 -0400
75468+++ linux-2.6.39/net/batman-adv/hard-interface.c 2011-05-22 19:36:33.000000000 -0400
75469@@ -339,8 +339,8 @@ int hardif_enable_interface(struct hard_
75470 hard_iface->batman_adv_ptype.dev = hard_iface->net_dev;
75471 dev_add_pack(&hard_iface->batman_adv_ptype);
75472
75473- atomic_set(&hard_iface->seqno, 1);
75474- atomic_set(&hard_iface->frag_seqno, 1);
75475+ atomic_set_unchecked(&hard_iface->seqno, 1);
75476+ atomic_set_unchecked(&hard_iface->frag_seqno, 1);
75477 bat_info(hard_iface->soft_iface, "Adding interface: %s\n",
75478 hard_iface->net_dev->name);
75479
75480diff -urNp linux-2.6.39/net/batman-adv/routing.c linux-2.6.39/net/batman-adv/routing.c
75481--- linux-2.6.39/net/batman-adv/routing.c 2011-05-19 00:06:34.000000000 -0400
75482+++ linux-2.6.39/net/batman-adv/routing.c 2011-05-22 19:36:33.000000000 -0400
75483@@ -625,7 +625,7 @@ void receive_bat_packet(struct ethhdr *e
75484 return;
75485
75486 /* could be changed by schedule_own_packet() */
75487- if_incoming_seqno = atomic_read(&if_incoming->seqno);
75488+ if_incoming_seqno = atomic_read_unchecked(&if_incoming->seqno);
75489
75490 has_directlink_flag = (batman_packet->flags & DIRECTLINK ? 1 : 0);
75491
75492diff -urNp linux-2.6.39/net/batman-adv/send.c linux-2.6.39/net/batman-adv/send.c
75493--- linux-2.6.39/net/batman-adv/send.c 2011-05-19 00:06:34.000000000 -0400
75494+++ linux-2.6.39/net/batman-adv/send.c 2011-05-22 19:36:33.000000000 -0400
75495@@ -277,7 +277,7 @@ void schedule_own_packet(struct hard_ifa
75496
75497 /* change sequence number to network order */
75498 batman_packet->seqno =
75499- htonl((uint32_t)atomic_read(&hard_iface->seqno));
75500+ htonl((uint32_t)atomic_read_unchecked(&hard_iface->seqno));
75501
75502 if (vis_server == VIS_TYPE_SERVER_SYNC)
75503 batman_packet->flags |= VIS_SERVER;
75504@@ -291,7 +291,7 @@ void schedule_own_packet(struct hard_ifa
75505 else
75506 batman_packet->gw_flags = 0;
75507
75508- atomic_inc(&hard_iface->seqno);
75509+ atomic_inc_unchecked(&hard_iface->seqno);
75510
75511 slide_own_bcast_window(hard_iface);
75512 send_time = own_send_time(bat_priv);
75513diff -urNp linux-2.6.39/net/batman-adv/soft-interface.c linux-2.6.39/net/batman-adv/soft-interface.c
75514--- linux-2.6.39/net/batman-adv/soft-interface.c 2011-05-19 00:06:34.000000000 -0400
75515+++ linux-2.6.39/net/batman-adv/soft-interface.c 2011-05-22 19:36:33.000000000 -0400
75516@@ -386,7 +386,7 @@ int interface_tx(struct sk_buff *skb, st
75517
75518 /* set broadcast sequence number */
75519 bcast_packet->seqno =
75520- htonl(atomic_inc_return(&bat_priv->bcast_seqno));
75521+ htonl(atomic_inc_return_unchecked(&bat_priv->bcast_seqno));
75522
75523 add_bcast_packet_to_list(bat_priv, skb);
75524
75525@@ -579,7 +579,7 @@ struct net_device *softif_create(char *n
75526 atomic_set(&bat_priv->batman_queue_left, BATMAN_QUEUE_LEN);
75527
75528 atomic_set(&bat_priv->mesh_state, MESH_INACTIVE);
75529- atomic_set(&bat_priv->bcast_seqno, 1);
75530+ atomic_set_unchecked(&bat_priv->bcast_seqno, 1);
75531 atomic_set(&bat_priv->hna_local_changed, 0);
75532
75533 bat_priv->primary_if = NULL;
75534diff -urNp linux-2.6.39/net/batman-adv/types.h linux-2.6.39/net/batman-adv/types.h
75535--- linux-2.6.39/net/batman-adv/types.h 2011-05-19 00:06:34.000000000 -0400
75536+++ linux-2.6.39/net/batman-adv/types.h 2011-05-22 19:36:33.000000000 -0400
75537@@ -38,8 +38,8 @@ struct hard_iface {
75538 int16_t if_num;
75539 char if_status;
75540 struct net_device *net_dev;
75541- atomic_t seqno;
75542- atomic_t frag_seqno;
75543+ atomic_unchecked_t seqno;
75544+ atomic_unchecked_t frag_seqno;
75545 unsigned char *packet_buff;
75546 int packet_len;
75547 struct kobject *hardif_obj;
75548@@ -141,7 +141,7 @@ struct bat_priv {
75549 atomic_t orig_interval; /* uint */
75550 atomic_t hop_penalty; /* uint */
75551 atomic_t log_level; /* uint */
75552- atomic_t bcast_seqno;
75553+ atomic_unchecked_t bcast_seqno;
75554 atomic_t bcast_queue_left;
75555 atomic_t batman_queue_left;
75556 char num_ifaces;
75557diff -urNp linux-2.6.39/net/batman-adv/unicast.c linux-2.6.39/net/batman-adv/unicast.c
75558--- linux-2.6.39/net/batman-adv/unicast.c 2011-05-19 00:06:34.000000000 -0400
75559+++ linux-2.6.39/net/batman-adv/unicast.c 2011-05-22 19:36:33.000000000 -0400
75560@@ -263,7 +263,7 @@ int frag_send_skb(struct sk_buff *skb, s
75561 frag1->flags = UNI_FRAG_HEAD | large_tail;
75562 frag2->flags = large_tail;
75563
75564- seqno = atomic_add_return(2, &hard_iface->frag_seqno);
75565+ seqno = atomic_add_return_unchecked(2, &hard_iface->frag_seqno);
75566 frag1->seqno = htons(seqno - 1);
75567 frag2->seqno = htons(seqno);
75568
75569diff -urNp linux-2.6.39/net/bridge/br_multicast.c linux-2.6.39/net/bridge/br_multicast.c
75570--- linux-2.6.39/net/bridge/br_multicast.c 2011-05-19 00:06:34.000000000 -0400
75571+++ linux-2.6.39/net/bridge/br_multicast.c 2011-05-22 19:36:33.000000000 -0400
75572@@ -1482,7 +1482,7 @@ static int br_multicast_ipv6_rcv(struct
75573 nexthdr = ip6h->nexthdr;
75574 offset = ipv6_skip_exthdr(skb, sizeof(*ip6h), &nexthdr);
75575
75576- if (offset < 0 || nexthdr != IPPROTO_ICMPV6)
75577+ if (nexthdr != IPPROTO_ICMPV6)
75578 return 0;
75579
75580 /* Okay, we found ICMPv6 header */
75581diff -urNp linux-2.6.39/net/bridge/netfilter/ebtables.c linux-2.6.39/net/bridge/netfilter/ebtables.c
75582--- linux-2.6.39/net/bridge/netfilter/ebtables.c 2011-05-19 00:06:34.000000000 -0400
75583+++ linux-2.6.39/net/bridge/netfilter/ebtables.c 2011-05-22 19:36:33.000000000 -0400
75584@@ -1512,7 +1512,7 @@ static int do_ebt_get_ctl(struct sock *s
75585 tmp.valid_hooks = t->table->valid_hooks;
75586 }
75587 mutex_unlock(&ebt_mutex);
75588- if (copy_to_user(user, &tmp, *len) != 0){
75589+ if (*len > sizeof(tmp) || copy_to_user(user, &tmp, *len) != 0){
75590 BUGPRINT("c2u Didn't work\n");
75591 ret = -EFAULT;
75592 break;
75593@@ -1780,6 +1780,8 @@ static int compat_copy_everything_to_use
75594 int ret;
75595 void __user *pos;
75596
75597+ pax_track_stack();
75598+
75599 memset(&tinfo, 0, sizeof(tinfo));
75600
75601 if (cmd == EBT_SO_GET_ENTRIES) {
75602diff -urNp linux-2.6.39/net/caif/caif_socket.c linux-2.6.39/net/caif/caif_socket.c
75603--- linux-2.6.39/net/caif/caif_socket.c 2011-05-19 00:06:34.000000000 -0400
75604+++ linux-2.6.39/net/caif/caif_socket.c 2011-05-22 19:36:33.000000000 -0400
75605@@ -48,18 +48,19 @@ static struct dentry *debugfsdir;
75606 #ifdef CONFIG_DEBUG_FS
75607 struct debug_fs_counter {
75608 atomic_t caif_nr_socks;
75609- atomic_t num_connect_req;
75610- atomic_t num_connect_resp;
75611- atomic_t num_connect_fail_resp;
75612- atomic_t num_disconnect;
75613- atomic_t num_remote_shutdown_ind;
75614- atomic_t num_tx_flow_off_ind;
75615- atomic_t num_tx_flow_on_ind;
75616- atomic_t num_rx_flow_off;
75617- atomic_t num_rx_flow_on;
75618+ atomic_unchecked_t num_connect_req;
75619+ atomic_unchecked_t num_connect_resp;
75620+ atomic_unchecked_t num_connect_fail_resp;
75621+ atomic_unchecked_t num_disconnect;
75622+ atomic_unchecked_t num_remote_shutdown_ind;
75623+ atomic_unchecked_t num_tx_flow_off_ind;
75624+ atomic_unchecked_t num_tx_flow_on_ind;
75625+ atomic_unchecked_t num_rx_flow_off;
75626+ atomic_unchecked_t num_rx_flow_on;
75627 };
75628 static struct debug_fs_counter cnt;
75629 #define dbfs_atomic_inc(v) atomic_inc(v)
75630+#define dbfs_atomic_inc_unchecked(v) atomic_inc_unchecked(v)
75631 #define dbfs_atomic_dec(v) atomic_dec(v)
75632 #else
75633 #define dbfs_atomic_inc(v)
75634@@ -159,7 +160,7 @@ static int caif_queue_rcv_skb(struct soc
75635 atomic_read(&cf_sk->sk.sk_rmem_alloc),
75636 sk_rcvbuf_lowwater(cf_sk));
75637 set_rx_flow_off(cf_sk);
75638- dbfs_atomic_inc(&cnt.num_rx_flow_off);
75639+ dbfs_atomic_inc_unchecked(&cnt.num_rx_flow_off);
75640 caif_flow_ctrl(sk, CAIF_MODEMCMD_FLOW_OFF_REQ);
75641 }
75642
75643@@ -169,7 +170,7 @@ static int caif_queue_rcv_skb(struct soc
75644 if (!sk_rmem_schedule(sk, skb->truesize) && rx_flow_is_on(cf_sk)) {
75645 set_rx_flow_off(cf_sk);
75646 pr_debug("sending flow OFF due to rmem_schedule\n");
75647- dbfs_atomic_inc(&cnt.num_rx_flow_off);
75648+ dbfs_atomic_inc_unchecked(&cnt.num_rx_flow_off);
75649 caif_flow_ctrl(sk, CAIF_MODEMCMD_FLOW_OFF_REQ);
75650 }
75651 skb->dev = NULL;
75652@@ -218,21 +219,21 @@ static void caif_ctrl_cb(struct cflayer
75653 switch (flow) {
75654 case CAIF_CTRLCMD_FLOW_ON_IND:
75655 /* OK from modem to start sending again */
75656- dbfs_atomic_inc(&cnt.num_tx_flow_on_ind);
75657+ dbfs_atomic_inc_unchecked(&cnt.num_tx_flow_on_ind);
75658 set_tx_flow_on(cf_sk);
75659 cf_sk->sk.sk_state_change(&cf_sk->sk);
75660 break;
75661
75662 case CAIF_CTRLCMD_FLOW_OFF_IND:
75663 /* Modem asks us to shut up */
75664- dbfs_atomic_inc(&cnt.num_tx_flow_off_ind);
75665+ dbfs_atomic_inc_unchecked(&cnt.num_tx_flow_off_ind);
75666 set_tx_flow_off(cf_sk);
75667 cf_sk->sk.sk_state_change(&cf_sk->sk);
75668 break;
75669
75670 case CAIF_CTRLCMD_INIT_RSP:
75671 /* We're now connected */
75672- dbfs_atomic_inc(&cnt.num_connect_resp);
75673+ dbfs_atomic_inc_unchecked(&cnt.num_connect_resp);
75674 cf_sk->sk.sk_state = CAIF_CONNECTED;
75675 set_tx_flow_on(cf_sk);
75676 cf_sk->sk.sk_state_change(&cf_sk->sk);
75677@@ -247,7 +248,7 @@ static void caif_ctrl_cb(struct cflayer
75678
75679 case CAIF_CTRLCMD_INIT_FAIL_RSP:
75680 /* Connect request failed */
75681- dbfs_atomic_inc(&cnt.num_connect_fail_resp);
75682+ dbfs_atomic_inc_unchecked(&cnt.num_connect_fail_resp);
75683 cf_sk->sk.sk_err = ECONNREFUSED;
75684 cf_sk->sk.sk_state = CAIF_DISCONNECTED;
75685 cf_sk->sk.sk_shutdown = SHUTDOWN_MASK;
75686@@ -261,7 +262,7 @@ static void caif_ctrl_cb(struct cflayer
75687
75688 case CAIF_CTRLCMD_REMOTE_SHUTDOWN_IND:
75689 /* Modem has closed this connection, or device is down. */
75690- dbfs_atomic_inc(&cnt.num_remote_shutdown_ind);
75691+ dbfs_atomic_inc_unchecked(&cnt.num_remote_shutdown_ind);
75692 cf_sk->sk.sk_shutdown = SHUTDOWN_MASK;
75693 cf_sk->sk.sk_err = ECONNRESET;
75694 set_rx_flow_on(cf_sk);
75695@@ -281,7 +282,7 @@ static void caif_check_flow_release(stru
75696 return;
75697
75698 if (atomic_read(&sk->sk_rmem_alloc) <= sk_rcvbuf_lowwater(cf_sk)) {
75699- dbfs_atomic_inc(&cnt.num_rx_flow_on);
75700+ dbfs_atomic_inc_unchecked(&cnt.num_rx_flow_on);
75701 set_rx_flow_on(cf_sk);
75702 caif_flow_ctrl(sk, CAIF_MODEMCMD_FLOW_ON_REQ);
75703 }
75704@@ -864,7 +865,7 @@ static int caif_connect(struct socket *s
75705 /*ifindex = id of the interface.*/
75706 cf_sk->conn_req.ifindex = cf_sk->sk.sk_bound_dev_if;
75707
75708- dbfs_atomic_inc(&cnt.num_connect_req);
75709+ dbfs_atomic_inc_unchecked(&cnt.num_connect_req);
75710 cf_sk->layer.receive = caif_sktrecv_cb;
75711 err = caif_connect_client(&cf_sk->conn_req,
75712 &cf_sk->layer, &ifindex, &headroom, &tailroom);
75713@@ -952,7 +953,7 @@ static int caif_release(struct socket *s
75714 spin_unlock(&sk->sk_receive_queue.lock);
75715 sock->sk = NULL;
75716
75717- dbfs_atomic_inc(&cnt.num_disconnect);
75718+ dbfs_atomic_inc_unchecked(&cnt.num_disconnect);
75719
75720 if (cf_sk->debugfs_socket_dir != NULL)
75721 debugfs_remove_recursive(cf_sk->debugfs_socket_dir);
75722diff -urNp linux-2.6.39/net/caif/cfctrl.c linux-2.6.39/net/caif/cfctrl.c
75723--- linux-2.6.39/net/caif/cfctrl.c 2011-05-19 00:06:34.000000000 -0400
75724+++ linux-2.6.39/net/caif/cfctrl.c 2011-05-22 19:36:33.000000000 -0400
75725@@ -9,6 +9,7 @@
75726 #include <linux/stddef.h>
75727 #include <linux/spinlock.h>
75728 #include <linux/slab.h>
75729+#include <linux/sched.h>
75730 #include <net/caif/caif_layer.h>
75731 #include <net/caif/cfpkt.h>
75732 #include <net/caif/cfctrl.h>
75733@@ -46,8 +47,8 @@ struct cflayer *cfctrl_create(void)
75734 dev_info.id = 0xff;
75735 memset(this, 0, sizeof(*this));
75736 cfsrvl_init(&this->serv, 0, &dev_info, false);
75737- atomic_set(&this->req_seq_no, 1);
75738- atomic_set(&this->rsp_seq_no, 1);
75739+ atomic_set_unchecked(&this->req_seq_no, 1);
75740+ atomic_set_unchecked(&this->rsp_seq_no, 1);
75741 this->serv.layer.receive = cfctrl_recv;
75742 sprintf(this->serv.layer.name, "ctrl");
75743 this->serv.layer.ctrlcmd = cfctrl_ctrlcmd;
75744@@ -116,8 +117,8 @@ void cfctrl_insert_req(struct cfctrl *ct
75745 struct cfctrl_request_info *req)
75746 {
75747 spin_lock(&ctrl->info_list_lock);
75748- atomic_inc(&ctrl->req_seq_no);
75749- req->sequence_no = atomic_read(&ctrl->req_seq_no);
75750+ atomic_inc_unchecked(&ctrl->req_seq_no);
75751+ req->sequence_no = atomic_read_unchecked(&ctrl->req_seq_no);
75752 list_add_tail(&req->list, &ctrl->list);
75753 spin_unlock(&ctrl->info_list_lock);
75754 }
75755@@ -136,7 +137,7 @@ struct cfctrl_request_info *cfctrl_remov
75756 if (p != first)
75757 pr_warn("Requests are not received in order\n");
75758
75759- atomic_set(&ctrl->rsp_seq_no,
75760+ atomic_set_unchecked(&ctrl->rsp_seq_no,
75761 p->sequence_no);
75762 list_del(&p->list);
75763 goto out;
75764@@ -385,6 +386,7 @@ static int cfctrl_recv(struct cflayer *l
75765 struct cfctrl *cfctrl = container_obj(layer);
75766 struct cfctrl_request_info rsp, *req;
75767
75768+ pax_track_stack();
75769
75770 cfpkt_extr_head(pkt, &cmdrsp, 1);
75771 cmd = cmdrsp & CFCTRL_CMD_MASK;
75772diff -urNp linux-2.6.39/net/can/bcm.c linux-2.6.39/net/can/bcm.c
75773--- linux-2.6.39/net/can/bcm.c 2011-05-19 00:06:34.000000000 -0400
75774+++ linux-2.6.39/net/can/bcm.c 2011-05-22 19:41:42.000000000 -0400
75775@@ -165,9 +165,15 @@ static int bcm_proc_show(struct seq_file
75776 struct bcm_sock *bo = bcm_sk(sk);
75777 struct bcm_op *op;
75778
75779+#ifdef CONFIG_GRKERNSEC_HIDESYM
75780+ seq_printf(m, ">>> socket %p", NULL);
75781+ seq_printf(m, " / sk %p", NULL);
75782+ seq_printf(m, " / bo %p", NULL);
75783+#else
75784 seq_printf(m, ">>> socket %p", sk->sk_socket);
75785 seq_printf(m, " / sk %p", sk);
75786 seq_printf(m, " / bo %p", bo);
75787+#endif
75788 seq_printf(m, " / dropped %lu", bo->dropped_usr_msgs);
75789 seq_printf(m, " / bound %s", bcm_proc_getifname(ifname, bo->ifindex));
75790 seq_printf(m, " <<<\n");
75791diff -urNp linux-2.6.39/net/core/datagram.c linux-2.6.39/net/core/datagram.c
75792--- linux-2.6.39/net/core/datagram.c 2011-05-19 00:06:34.000000000 -0400
75793+++ linux-2.6.39/net/core/datagram.c 2011-05-22 19:36:33.000000000 -0400
75794@@ -285,7 +285,7 @@ int skb_kill_datagram(struct sock *sk, s
75795 }
75796
75797 kfree_skb(skb);
75798- atomic_inc(&sk->sk_drops);
75799+ atomic_inc_unchecked(&sk->sk_drops);
75800 sk_mem_reclaim_partial(sk);
75801
75802 return err;
75803diff -urNp linux-2.6.39/net/core/dev.c linux-2.6.39/net/core/dev.c
75804--- linux-2.6.39/net/core/dev.c 2011-05-19 00:06:34.000000000 -0400
75805+++ linux-2.6.39/net/core/dev.c 2011-05-22 19:41:42.000000000 -0400
75806@@ -1125,10 +1125,14 @@ void dev_load(struct net *net, const cha
75807 if (no_module && capable(CAP_NET_ADMIN))
75808 no_module = request_module("netdev-%s", name);
75809 if (no_module && capable(CAP_SYS_MODULE)) {
75810+#ifdef CONFIG_GRKERNSEC_MODHARDEN
75811+ ___request_module(true, "grsec_modharden_netdev", "%s", name);
75812+#else
75813 if (!request_module("%s", name))
75814 pr_err("Loading kernel module for a network device "
75815 "with CAP_SYS_MODULE (deprecated). Use CAP_NET_ADMIN and alias netdev-%s "
75816 "instead\n", name);
75817+#endif
75818 }
75819 }
75820 EXPORT_SYMBOL(dev_load);
75821@@ -1957,7 +1961,7 @@ struct dev_gso_cb {
75822
75823 static void dev_gso_skb_destructor(struct sk_buff *skb)
75824 {
75825- struct dev_gso_cb *cb;
75826+ const struct dev_gso_cb *cb;
75827
75828 do {
75829 struct sk_buff *nskb = skb->next;
75830@@ -2901,7 +2905,7 @@ int netif_rx_ni(struct sk_buff *skb)
75831 }
75832 EXPORT_SYMBOL(netif_rx_ni);
75833
75834-static void net_tx_action(struct softirq_action *h)
75835+static void net_tx_action(void)
75836 {
75837 struct softnet_data *sd = &__get_cpu_var(softnet_data);
75838
75839@@ -3765,7 +3769,7 @@ void netif_napi_del(struct napi_struct *
75840 }
75841 EXPORT_SYMBOL(netif_napi_del);
75842
75843-static void net_rx_action(struct softirq_action *h)
75844+static void net_rx_action(void)
75845 {
75846 struct softnet_data *sd = &__get_cpu_var(softnet_data);
75847 unsigned long time_limit = jiffies + 2;
75848diff -urNp linux-2.6.39/net/core/flow.c linux-2.6.39/net/core/flow.c
75849--- linux-2.6.39/net/core/flow.c 2011-05-19 00:06:34.000000000 -0400
75850+++ linux-2.6.39/net/core/flow.c 2011-05-22 19:36:34.000000000 -0400
75851@@ -60,7 +60,7 @@ struct flow_cache {
75852 struct timer_list rnd_timer;
75853 };
75854
75855-atomic_t flow_cache_genid = ATOMIC_INIT(0);
75856+atomic_unchecked_t flow_cache_genid = ATOMIC_INIT(0);
75857 EXPORT_SYMBOL(flow_cache_genid);
75858 static struct flow_cache flow_cache_global;
75859 static struct kmem_cache *flow_cachep __read_mostly;
75860@@ -85,7 +85,7 @@ static void flow_cache_new_hashrnd(unsig
75861
75862 static int flow_entry_valid(struct flow_cache_entry *fle)
75863 {
75864- if (atomic_read(&flow_cache_genid) != fle->genid)
75865+ if (atomic_read_unchecked(&flow_cache_genid) != fle->genid)
75866 return 0;
75867 if (fle->object && !fle->object->ops->check(fle->object))
75868 return 0;
75869@@ -253,7 +253,7 @@ flow_cache_lookup(struct net *net, const
75870 hlist_add_head(&fle->u.hlist, &fcp->hash_table[hash]);
75871 fcp->hash_count++;
75872 }
75873- } else if (likely(fle->genid == atomic_read(&flow_cache_genid))) {
75874+ } else if (likely(fle->genid == atomic_read_unchecked(&flow_cache_genid))) {
75875 flo = fle->object;
75876 if (!flo)
75877 goto ret_object;
75878@@ -274,7 +274,7 @@ nocache:
75879 }
75880 flo = resolver(net, key, family, dir, flo, ctx);
75881 if (fle) {
75882- fle->genid = atomic_read(&flow_cache_genid);
75883+ fle->genid = atomic_read_unchecked(&flow_cache_genid);
75884 if (!IS_ERR(flo))
75885 fle->object = flo;
75886 else
75887diff -urNp linux-2.6.39/net/core/skbuff.c linux-2.6.39/net/core/skbuff.c
75888--- linux-2.6.39/net/core/skbuff.c 2011-05-19 00:06:34.000000000 -0400
75889+++ linux-2.6.39/net/core/skbuff.c 2011-05-22 19:36:34.000000000 -0400
75890@@ -1542,6 +1542,8 @@ int skb_splice_bits(struct sk_buff *skb,
75891 struct sock *sk = skb->sk;
75892 int ret = 0;
75893
75894+ pax_track_stack();
75895+
75896 if (splice_grow_spd(pipe, &spd))
75897 return -ENOMEM;
75898
75899diff -urNp linux-2.6.39/net/core/sock.c linux-2.6.39/net/core/sock.c
75900--- linux-2.6.39/net/core/sock.c 2011-05-19 00:06:34.000000000 -0400
75901+++ linux-2.6.39/net/core/sock.c 2011-05-22 19:36:34.000000000 -0400
75902@@ -291,7 +291,7 @@ int sock_queue_rcv_skb(struct sock *sk,
75903 */
75904 if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=
75905 (unsigned)sk->sk_rcvbuf) {
75906- atomic_inc(&sk->sk_drops);
75907+ atomic_inc_unchecked(&sk->sk_drops);
75908 return -ENOMEM;
75909 }
75910
75911@@ -300,7 +300,7 @@ int sock_queue_rcv_skb(struct sock *sk,
75912 return err;
75913
75914 if (!sk_rmem_schedule(sk, skb->truesize)) {
75915- atomic_inc(&sk->sk_drops);
75916+ atomic_inc_unchecked(&sk->sk_drops);
75917 return -ENOBUFS;
75918 }
75919
75920@@ -320,7 +320,7 @@ int sock_queue_rcv_skb(struct sock *sk,
75921 skb_dst_force(skb);
75922
75923 spin_lock_irqsave(&list->lock, flags);
75924- skb->dropcount = atomic_read(&sk->sk_drops);
75925+ skb->dropcount = atomic_read_unchecked(&sk->sk_drops);
75926 __skb_queue_tail(list, skb);
75927 spin_unlock_irqrestore(&list->lock, flags);
75928
75929@@ -340,7 +340,7 @@ int sk_receive_skb(struct sock *sk, stru
75930 skb->dev = NULL;
75931
75932 if (sk_rcvqueues_full(sk, skb)) {
75933- atomic_inc(&sk->sk_drops);
75934+ atomic_inc_unchecked(&sk->sk_drops);
75935 goto discard_and_relse;
75936 }
75937 if (nested)
75938@@ -358,7 +358,7 @@ int sk_receive_skb(struct sock *sk, stru
75939 mutex_release(&sk->sk_lock.dep_map, 1, _RET_IP_);
75940 } else if (sk_add_backlog(sk, skb)) {
75941 bh_unlock_sock(sk);
75942- atomic_inc(&sk->sk_drops);
75943+ atomic_inc_unchecked(&sk->sk_drops);
75944 goto discard_and_relse;
75945 }
75946
75947@@ -934,7 +934,7 @@ int sock_getsockopt(struct socket *sock,
75948 return -ENOTCONN;
75949 if (lv < len)
75950 return -EINVAL;
75951- if (copy_to_user(optval, address, len))
75952+ if (len > sizeof(address) || copy_to_user(optval, address, len))
75953 return -EFAULT;
75954 goto lenout;
75955 }
75956@@ -967,7 +967,7 @@ int sock_getsockopt(struct socket *sock,
75957
75958 if (len > lv)
75959 len = lv;
75960- if (copy_to_user(optval, &v, len))
75961+ if (len > sizeof(v) || copy_to_user(optval, &v, len))
75962 return -EFAULT;
75963 lenout:
75964 if (put_user(len, optlen))
75965@@ -2023,7 +2023,7 @@ void sock_init_data(struct socket *sock,
75966 */
75967 smp_wmb();
75968 atomic_set(&sk->sk_refcnt, 1);
75969- atomic_set(&sk->sk_drops, 0);
75970+ atomic_set_unchecked(&sk->sk_drops, 0);
75971 }
75972 EXPORT_SYMBOL(sock_init_data);
75973
75974diff -urNp linux-2.6.39/net/decnet/sysctl_net_decnet.c linux-2.6.39/net/decnet/sysctl_net_decnet.c
75975--- linux-2.6.39/net/decnet/sysctl_net_decnet.c 2011-05-19 00:06:34.000000000 -0400
75976+++ linux-2.6.39/net/decnet/sysctl_net_decnet.c 2011-05-22 19:36:34.000000000 -0400
75977@@ -173,7 +173,7 @@ static int dn_node_address_handler(ctl_t
75978
75979 if (len > *lenp) len = *lenp;
75980
75981- if (copy_to_user(buffer, addr, len))
75982+ if (len > sizeof addr || copy_to_user(buffer, addr, len))
75983 return -EFAULT;
75984
75985 *lenp = len;
75986@@ -236,7 +236,7 @@ static int dn_def_dev_handler(ctl_table
75987
75988 if (len > *lenp) len = *lenp;
75989
75990- if (copy_to_user(buffer, devname, len))
75991+ if (len > sizeof devname || copy_to_user(buffer, devname, len))
75992 return -EFAULT;
75993
75994 *lenp = len;
75995diff -urNp linux-2.6.39/net/econet/Kconfig linux-2.6.39/net/econet/Kconfig
75996--- linux-2.6.39/net/econet/Kconfig 2011-05-19 00:06:34.000000000 -0400
75997+++ linux-2.6.39/net/econet/Kconfig 2011-05-22 19:41:42.000000000 -0400
75998@@ -4,7 +4,7 @@
75999
76000 config ECONET
76001 tristate "Acorn Econet/AUN protocols (EXPERIMENTAL)"
76002- depends on EXPERIMENTAL && INET
76003+ depends on EXPERIMENTAL && INET && BROKEN
76004 ---help---
76005 Econet is a fairly old and slow networking protocol mainly used by
76006 Acorn computers to access file and print servers. It uses native
76007diff -urNp linux-2.6.39/net/ipv4/fib_frontend.c linux-2.6.39/net/ipv4/fib_frontend.c
76008--- linux-2.6.39/net/ipv4/fib_frontend.c 2011-05-19 00:06:34.000000000 -0400
76009+++ linux-2.6.39/net/ipv4/fib_frontend.c 2011-05-22 19:36:34.000000000 -0400
76010@@ -968,12 +968,12 @@ static int fib_inetaddr_event(struct not
76011 #ifdef CONFIG_IP_ROUTE_MULTIPATH
76012 fib_sync_up(dev);
76013 #endif
76014- atomic_inc(&net->ipv4.dev_addr_genid);
76015+ atomic_inc_unchecked(&net->ipv4.dev_addr_genid);
76016 rt_cache_flush(dev_net(dev), -1);
76017 break;
76018 case NETDEV_DOWN:
76019 fib_del_ifaddr(ifa, NULL);
76020- atomic_inc(&net->ipv4.dev_addr_genid);
76021+ atomic_inc_unchecked(&net->ipv4.dev_addr_genid);
76022 if (ifa->ifa_dev->ifa_list == NULL) {
76023 /* Last address was deleted from this interface.
76024 * Disable IP.
76025@@ -1009,7 +1009,7 @@ static int fib_netdev_event(struct notif
76026 #ifdef CONFIG_IP_ROUTE_MULTIPATH
76027 fib_sync_up(dev);
76028 #endif
76029- atomic_inc(&net->ipv4.dev_addr_genid);
76030+ atomic_inc_unchecked(&net->ipv4.dev_addr_genid);
76031 rt_cache_flush(dev_net(dev), -1);
76032 break;
76033 case NETDEV_DOWN:
76034diff -urNp linux-2.6.39/net/ipv4/fib_semantics.c linux-2.6.39/net/ipv4/fib_semantics.c
76035--- linux-2.6.39/net/ipv4/fib_semantics.c 2011-05-19 00:06:34.000000000 -0400
76036+++ linux-2.6.39/net/ipv4/fib_semantics.c 2011-05-22 19:36:34.000000000 -0400
76037@@ -701,7 +701,7 @@ __be32 fib_info_update_nh_saddr(struct n
76038 nh->nh_saddr = inet_select_addr(nh->nh_dev,
76039 nh->nh_gw,
76040 nh->nh_parent->fib_scope);
76041- nh->nh_saddr_genid = atomic_read(&net->ipv4.dev_addr_genid);
76042+ nh->nh_saddr_genid = atomic_read_unchecked(&net->ipv4.dev_addr_genid);
76043
76044 return nh->nh_saddr;
76045 }
76046diff -urNp linux-2.6.39/net/ipv4/inet_diag.c linux-2.6.39/net/ipv4/inet_diag.c
76047--- linux-2.6.39/net/ipv4/inet_diag.c 2011-05-19 00:06:34.000000000 -0400
76048+++ linux-2.6.39/net/ipv4/inet_diag.c 2011-05-22 19:41:42.000000000 -0400
76049@@ -114,8 +114,14 @@ static int inet_csk_diag_fill(struct soc
76050 r->idiag_retrans = 0;
76051
76052 r->id.idiag_if = sk->sk_bound_dev_if;
76053+
76054+#ifdef CONFIG_GRKERNSEC_HIDESYM
76055+ r->id.idiag_cookie[0] = 0;
76056+ r->id.idiag_cookie[1] = 0;
76057+#else
76058 r->id.idiag_cookie[0] = (u32)(unsigned long)sk;
76059 r->id.idiag_cookie[1] = (u32)(((unsigned long)sk >> 31) >> 1);
76060+#endif
76061
76062 r->id.idiag_sport = inet->inet_sport;
76063 r->id.idiag_dport = inet->inet_dport;
76064@@ -201,8 +207,15 @@ static int inet_twsk_diag_fill(struct in
76065 r->idiag_family = tw->tw_family;
76066 r->idiag_retrans = 0;
76067 r->id.idiag_if = tw->tw_bound_dev_if;
76068+
76069+#ifdef CONFIG_GRKERNSEC_HIDESYM
76070+ r->id.idiag_cookie[0] = 0;
76071+ r->id.idiag_cookie[1] = 0;
76072+#else
76073 r->id.idiag_cookie[0] = (u32)(unsigned long)tw;
76074 r->id.idiag_cookie[1] = (u32)(((unsigned long)tw >> 31) >> 1);
76075+#endif
76076+
76077 r->id.idiag_sport = tw->tw_sport;
76078 r->id.idiag_dport = tw->tw_dport;
76079 r->id.idiag_src[0] = tw->tw_rcv_saddr;
76080@@ -285,12 +298,14 @@ static int inet_diag_get_exact(struct sk
76081 if (sk == NULL)
76082 goto unlock;
76083
76084+#ifndef CONFIG_GRKERNSEC_HIDESYM
76085 err = -ESTALE;
76086 if ((req->id.idiag_cookie[0] != INET_DIAG_NOCOOKIE ||
76087 req->id.idiag_cookie[1] != INET_DIAG_NOCOOKIE) &&
76088 ((u32)(unsigned long)sk != req->id.idiag_cookie[0] ||
76089 (u32)((((unsigned long)sk) >> 31) >> 1) != req->id.idiag_cookie[1]))
76090 goto out;
76091+#endif
76092
76093 err = -ENOMEM;
76094 rep = alloc_skb(NLMSG_SPACE((sizeof(struct inet_diag_msg) +
76095@@ -582,8 +597,14 @@ static int inet_diag_fill_req(struct sk_
76096 r->idiag_retrans = req->retrans;
76097
76098 r->id.idiag_if = sk->sk_bound_dev_if;
76099+
76100+#ifdef CONFIG_GRKERNSEC_HIDESYM
76101+ r->id.idiag_cookie[0] = 0;
76102+ r->id.idiag_cookie[1] = 0;
76103+#else
76104 r->id.idiag_cookie[0] = (u32)(unsigned long)req;
76105 r->id.idiag_cookie[1] = (u32)(((unsigned long)req >> 31) >> 1);
76106+#endif
76107
76108 tmo = req->expires - jiffies;
76109 if (tmo < 0)
76110diff -urNp linux-2.6.39/net/ipv4/inet_hashtables.c linux-2.6.39/net/ipv4/inet_hashtables.c
76111--- linux-2.6.39/net/ipv4/inet_hashtables.c 2011-05-19 00:06:34.000000000 -0400
76112+++ linux-2.6.39/net/ipv4/inet_hashtables.c 2011-05-22 19:41:42.000000000 -0400
76113@@ -18,11 +18,14 @@
76114 #include <linux/sched.h>
76115 #include <linux/slab.h>
76116 #include <linux/wait.h>
76117+#include <linux/security.h>
76118
76119 #include <net/inet_connection_sock.h>
76120 #include <net/inet_hashtables.h>
76121 #include <net/ip.h>
76122
76123+extern void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet);
76124+
76125 /*
76126 * Allocate and initialize a new local port bind bucket.
76127 * The bindhash mutex for snum's hash chain must be held here.
76128@@ -529,6 +532,8 @@ ok:
76129 twrefcnt += inet_twsk_bind_unhash(tw, hinfo);
76130 spin_unlock(&head->lock);
76131
76132+ gr_update_task_in_ip_table(current, inet_sk(sk));
76133+
76134 if (tw) {
76135 inet_twsk_deschedule(tw, death_row);
76136 while (twrefcnt) {
76137diff -urNp linux-2.6.39/net/ipv4/inetpeer.c linux-2.6.39/net/ipv4/inetpeer.c
76138--- linux-2.6.39/net/ipv4/inetpeer.c 2011-05-19 00:06:34.000000000 -0400
76139+++ linux-2.6.39/net/ipv4/inetpeer.c 2011-05-22 19:36:34.000000000 -0400
76140@@ -467,6 +467,8 @@ struct inet_peer *inet_getpeer(struct in
76141 unsigned int sequence;
76142 int invalidated;
76143
76144+ pax_track_stack();
76145+
76146 /* Look up for the address quickly, lockless.
76147 * Because of a concurrent writer, we might not find an existing entry.
76148 */
76149@@ -504,8 +506,8 @@ struct inet_peer *inet_getpeer(struct in
76150 if (p) {
76151 p->daddr = *daddr;
76152 atomic_set(&p->refcnt, 1);
76153- atomic_set(&p->rid, 0);
76154- atomic_set(&p->ip_id_count, secure_ip_id(daddr->addr.a4));
76155+ atomic_set_unchecked(&p->rid, 0);
76156+ atomic_set_unchecked(&p->ip_id_count, secure_ip_id(daddr->addr.a4));
76157 p->tcp_ts_stamp = 0;
76158 p->metrics[RTAX_LOCK-1] = INETPEER_METRICS_NEW;
76159 p->rate_tokens = 0;
76160diff -urNp linux-2.6.39/net/ipv4/ip_fragment.c linux-2.6.39/net/ipv4/ip_fragment.c
76161--- linux-2.6.39/net/ipv4/ip_fragment.c 2011-05-19 00:06:34.000000000 -0400
76162+++ linux-2.6.39/net/ipv4/ip_fragment.c 2011-05-22 19:36:34.000000000 -0400
76163@@ -297,7 +297,7 @@ static inline int ip_frag_too_far(struct
76164 return 0;
76165
76166 start = qp->rid;
76167- end = atomic_inc_return(&peer->rid);
76168+ end = atomic_inc_return_unchecked(&peer->rid);
76169 qp->rid = end;
76170
76171 rc = qp->q.fragments && (end - start) > max;
76172diff -urNp linux-2.6.39/net/ipv4/ip_sockglue.c linux-2.6.39/net/ipv4/ip_sockglue.c
76173--- linux-2.6.39/net/ipv4/ip_sockglue.c 2011-05-19 00:06:34.000000000 -0400
76174+++ linux-2.6.39/net/ipv4/ip_sockglue.c 2011-05-22 19:36:34.000000000 -0400
76175@@ -1064,6 +1064,8 @@ static int do_ip_getsockopt(struct sock
76176 int val;
76177 int len;
76178
76179+ pax_track_stack();
76180+
76181 if (level != SOL_IP)
76182 return -EOPNOTSUPP;
76183
76184diff -urNp linux-2.6.39/net/ipv4/netfilter/nf_nat_snmp_basic.c linux-2.6.39/net/ipv4/netfilter/nf_nat_snmp_basic.c
76185--- linux-2.6.39/net/ipv4/netfilter/nf_nat_snmp_basic.c 2011-05-19 00:06:34.000000000 -0400
76186+++ linux-2.6.39/net/ipv4/netfilter/nf_nat_snmp_basic.c 2011-05-22 19:36:34.000000000 -0400
76187@@ -399,7 +399,7 @@ static unsigned char asn1_octets_decode(
76188
76189 *len = 0;
76190
76191- *octets = kmalloc(eoc - ctx->pointer, GFP_ATOMIC);
76192+ *octets = kmalloc((eoc - ctx->pointer), GFP_ATOMIC);
76193 if (*octets == NULL) {
76194 if (net_ratelimit())
76195 pr_notice("OOM in bsalg (%d)\n", __LINE__);
76196diff -urNp linux-2.6.39/net/ipv4/raw.c linux-2.6.39/net/ipv4/raw.c
76197--- linux-2.6.39/net/ipv4/raw.c 2011-05-19 00:06:34.000000000 -0400
76198+++ linux-2.6.39/net/ipv4/raw.c 2011-05-22 19:41:42.000000000 -0400
76199@@ -302,7 +302,7 @@ static int raw_rcv_skb(struct sock * sk,
76200 int raw_rcv(struct sock *sk, struct sk_buff *skb)
76201 {
76202 if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb)) {
76203- atomic_inc(&sk->sk_drops);
76204+ atomic_inc_unchecked(&sk->sk_drops);
76205 kfree_skb(skb);
76206 return NET_RX_DROP;
76207 }
76208@@ -730,15 +730,19 @@ static int raw_init(struct sock *sk)
76209
76210 static int raw_seticmpfilter(struct sock *sk, char __user *optval, int optlen)
76211 {
76212+ struct icmp_filter filter;
76213+
76214 if (optlen > sizeof(struct icmp_filter))
76215 optlen = sizeof(struct icmp_filter);
76216- if (copy_from_user(&raw_sk(sk)->filter, optval, optlen))
76217+ if (copy_from_user(&filter, optval, optlen))
76218 return -EFAULT;
76219+ memcpy(&raw_sk(sk)->filter, &filter, sizeof(filter));
76220 return 0;
76221 }
76222
76223 static int raw_geticmpfilter(struct sock *sk, char __user *optval, int __user *optlen)
76224 {
76225+ struct icmp_filter filter;
76226 int len, ret = -EFAULT;
76227
76228 if (get_user(len, optlen))
76229@@ -749,8 +753,9 @@ static int raw_geticmpfilter(struct sock
76230 if (len > sizeof(struct icmp_filter))
76231 len = sizeof(struct icmp_filter);
76232 ret = -EFAULT;
76233+ memcpy(&filter, &raw_sk(sk)->filter, len);
76234 if (put_user(len, optlen) ||
76235- copy_to_user(optval, &raw_sk(sk)->filter, len))
76236+ copy_to_user(optval, &filter, len))
76237 goto out;
76238 ret = 0;
76239 out: return ret;
76240@@ -978,7 +983,13 @@ static void raw_sock_seq_show(struct seq
76241 sk_wmem_alloc_get(sp),
76242 sk_rmem_alloc_get(sp),
76243 0, 0L, 0, sock_i_uid(sp), 0, sock_i_ino(sp),
76244- atomic_read(&sp->sk_refcnt), sp, atomic_read(&sp->sk_drops));
76245+ atomic_read(&sp->sk_refcnt),
76246+#ifdef CONFIG_GRKERNSEC_HIDESYM
76247+ NULL,
76248+#else
76249+ sp,
76250+#endif
76251+ atomic_read_unchecked(&sp->sk_drops));
76252 }
76253
76254 static int raw_seq_show(struct seq_file *seq, void *v)
76255diff -urNp linux-2.6.39/net/ipv4/route.c linux-2.6.39/net/ipv4/route.c
76256--- linux-2.6.39/net/ipv4/route.c 2011-05-19 00:06:34.000000000 -0400
76257+++ linux-2.6.39/net/ipv4/route.c 2011-05-22 19:36:34.000000000 -0400
76258@@ -303,7 +303,7 @@ static inline unsigned int rt_hash(__be3
76259
76260 static inline int rt_genid(struct net *net)
76261 {
76262- return atomic_read(&net->ipv4.rt_genid);
76263+ return atomic_read_unchecked(&net->ipv4.rt_genid);
76264 }
76265
76266 #ifdef CONFIG_PROC_FS
76267@@ -831,7 +831,7 @@ static void rt_cache_invalidate(struct n
76268 unsigned char shuffle;
76269
76270 get_random_bytes(&shuffle, sizeof(shuffle));
76271- atomic_add(shuffle + 1U, &net->ipv4.rt_genid);
76272+ atomic_add_unchecked(shuffle + 1U, &net->ipv4.rt_genid);
76273 }
76274
76275 /*
76276@@ -2835,7 +2835,7 @@ static int rt_fill_info(struct net *net,
76277 rt->peer->pmtu_expires - jiffies : 0;
76278 if (rt->peer) {
76279 inet_peer_refcheck(rt->peer);
76280- id = atomic_read(&rt->peer->ip_id_count) & 0xffff;
76281+ id = atomic_read_unchecked(&rt->peer->ip_id_count) & 0xffff;
76282 if (rt->peer->tcp_ts_stamp) {
76283 ts = rt->peer->tcp_ts;
76284 tsage = get_seconds() - rt->peer->tcp_ts_stamp;
76285diff -urNp linux-2.6.39/net/ipv4/tcp.c linux-2.6.39/net/ipv4/tcp.c
76286--- linux-2.6.39/net/ipv4/tcp.c 2011-05-19 00:06:34.000000000 -0400
76287+++ linux-2.6.39/net/ipv4/tcp.c 2011-05-22 19:36:34.000000000 -0400
76288@@ -2121,6 +2121,8 @@ static int do_tcp_setsockopt(struct sock
76289 int val;
76290 int err = 0;
76291
76292+ pax_track_stack();
76293+
76294 /* These are data/string values, all the others are ints */
76295 switch (optname) {
76296 case TCP_CONGESTION: {
76297@@ -2500,6 +2502,8 @@ static int do_tcp_getsockopt(struct sock
76298 struct tcp_sock *tp = tcp_sk(sk);
76299 int val, len;
76300
76301+ pax_track_stack();
76302+
76303 if (get_user(len, optlen))
76304 return -EFAULT;
76305
76306diff -urNp linux-2.6.39/net/ipv4/tcp_ipv4.c linux-2.6.39/net/ipv4/tcp_ipv4.c
76307--- linux-2.6.39/net/ipv4/tcp_ipv4.c 2011-05-19 00:06:34.000000000 -0400
76308+++ linux-2.6.39/net/ipv4/tcp_ipv4.c 2011-05-22 19:41:42.000000000 -0400
76309@@ -86,6 +86,9 @@ int sysctl_tcp_tw_reuse __read_mostly;
76310 int sysctl_tcp_low_latency __read_mostly;
76311 EXPORT_SYMBOL(sysctl_tcp_low_latency);
76312
76313+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76314+extern int grsec_enable_blackhole;
76315+#endif
76316
76317 #ifdef CONFIG_TCP_MD5SIG
76318 static struct tcp_md5sig_key *tcp_v4_md5_do_lookup(struct sock *sk,
76319@@ -1594,6 +1597,9 @@ int tcp_v4_do_rcv(struct sock *sk, struc
76320 return 0;
76321
76322 reset:
76323+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76324+ if (!grsec_enable_blackhole)
76325+#endif
76326 tcp_v4_send_reset(rsk, skb);
76327 discard:
76328 kfree_skb(skb);
76329@@ -1656,12 +1662,19 @@ int tcp_v4_rcv(struct sk_buff *skb)
76330 TCP_SKB_CB(skb)->sacked = 0;
76331
76332 sk = __inet_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
76333- if (!sk)
76334+ if (!sk) {
76335+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76336+ ret = 1;
76337+#endif
76338 goto no_tcp_socket;
76339-
76340+ }
76341 process:
76342- if (sk->sk_state == TCP_TIME_WAIT)
76343+ if (sk->sk_state == TCP_TIME_WAIT) {
76344+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76345+ ret = 2;
76346+#endif
76347 goto do_time_wait;
76348+ }
76349
76350 if (unlikely(iph->ttl < inet_sk(sk)->min_ttl)) {
76351 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
76352@@ -1711,6 +1724,10 @@ no_tcp_socket:
76353 bad_packet:
76354 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
76355 } else {
76356+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76357+ if (!grsec_enable_blackhole || (ret == 1 &&
76358+ (skb->dev->flags & IFF_LOOPBACK)))
76359+#endif
76360 tcp_v4_send_reset(NULL, skb);
76361 }
76362
76363@@ -2374,7 +2391,11 @@ static void get_openreq4(struct sock *sk
76364 0, /* non standard timer */
76365 0, /* open_requests have no inode */
76366 atomic_read(&sk->sk_refcnt),
76367+#ifdef CONFIG_GRKERNSEC_HIDESYM
76368+ NULL,
76369+#else
76370 req,
76371+#endif
76372 len);
76373 }
76374
76375@@ -2424,7 +2445,12 @@ static void get_tcp4_sock(struct sock *s
76376 sock_i_uid(sk),
76377 icsk->icsk_probes_out,
76378 sock_i_ino(sk),
76379- atomic_read(&sk->sk_refcnt), sk,
76380+ atomic_read(&sk->sk_refcnt),
76381+#ifdef CONFIG_GRKERNSEC_HIDESYM
76382+ NULL,
76383+#else
76384+ sk,
76385+#endif
76386 jiffies_to_clock_t(icsk->icsk_rto),
76387 jiffies_to_clock_t(icsk->icsk_ack.ato),
76388 (icsk->icsk_ack.quick << 1) | icsk->icsk_ack.pingpong,
76389@@ -2452,7 +2478,13 @@ static void get_timewait4_sock(struct in
76390 " %02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %p%n",
76391 i, src, srcp, dest, destp, tw->tw_substate, 0, 0,
76392 3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
76393- atomic_read(&tw->tw_refcnt), tw, len);
76394+ atomic_read(&tw->tw_refcnt),
76395+#ifdef CONFIG_GRKERNSEC_HIDESYM
76396+ NULL,
76397+#else
76398+ tw,
76399+#endif
76400+ len);
76401 }
76402
76403 #define TMPSZ 150
76404diff -urNp linux-2.6.39/net/ipv4/tcp_minisocks.c linux-2.6.39/net/ipv4/tcp_minisocks.c
76405--- linux-2.6.39/net/ipv4/tcp_minisocks.c 2011-05-19 00:06:34.000000000 -0400
76406+++ linux-2.6.39/net/ipv4/tcp_minisocks.c 2011-05-22 19:41:42.000000000 -0400
76407@@ -27,6 +27,10 @@
76408 #include <net/inet_common.h>
76409 #include <net/xfrm.h>
76410
76411+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76412+extern int grsec_enable_blackhole;
76413+#endif
76414+
76415 int sysctl_tcp_syncookies __read_mostly = 1;
76416 EXPORT_SYMBOL(sysctl_tcp_syncookies);
76417
76418@@ -745,6 +749,10 @@ listen_overflow:
76419
76420 embryonic_reset:
76421 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_EMBRYONICRSTS);
76422+
76423+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76424+ if (!grsec_enable_blackhole)
76425+#endif
76426 if (!(flg & TCP_FLAG_RST))
76427 req->rsk_ops->send_reset(sk, skb);
76428
76429diff -urNp linux-2.6.39/net/ipv4/tcp_output.c linux-2.6.39/net/ipv4/tcp_output.c
76430--- linux-2.6.39/net/ipv4/tcp_output.c 2011-05-19 00:06:34.000000000 -0400
76431+++ linux-2.6.39/net/ipv4/tcp_output.c 2011-05-22 19:36:34.000000000 -0400
76432@@ -2421,6 +2421,8 @@ struct sk_buff *tcp_make_synack(struct s
76433 int mss;
76434 int s_data_desired = 0;
76435
76436+ pax_track_stack();
76437+
76438 if (cvp != NULL && cvp->s_data_constant && cvp->s_data_desired)
76439 s_data_desired = cvp->s_data_desired;
76440 skb = sock_wmalloc(sk, MAX_TCP_HEADER + 15 + s_data_desired, 1, GFP_ATOMIC);
76441diff -urNp linux-2.6.39/net/ipv4/tcp_probe.c linux-2.6.39/net/ipv4/tcp_probe.c
76442--- linux-2.6.39/net/ipv4/tcp_probe.c 2011-05-19 00:06:34.000000000 -0400
76443+++ linux-2.6.39/net/ipv4/tcp_probe.c 2011-05-22 19:36:34.000000000 -0400
76444@@ -202,7 +202,7 @@ static ssize_t tcpprobe_read(struct file
76445 if (cnt + width >= len)
76446 break;
76447
76448- if (copy_to_user(buf + cnt, tbuf, width))
76449+ if (width > sizeof tbuf || copy_to_user(buf + cnt, tbuf, width))
76450 return -EFAULT;
76451 cnt += width;
76452 }
76453diff -urNp linux-2.6.39/net/ipv4/tcp_timer.c linux-2.6.39/net/ipv4/tcp_timer.c
76454--- linux-2.6.39/net/ipv4/tcp_timer.c 2011-05-19 00:06:34.000000000 -0400
76455+++ linux-2.6.39/net/ipv4/tcp_timer.c 2011-05-22 19:41:42.000000000 -0400
76456@@ -22,6 +22,10 @@
76457 #include <linux/gfp.h>
76458 #include <net/tcp.h>
76459
76460+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76461+extern int grsec_lastack_retries;
76462+#endif
76463+
76464 int sysctl_tcp_syn_retries __read_mostly = TCP_SYN_RETRIES;
76465 int sysctl_tcp_synack_retries __read_mostly = TCP_SYNACK_RETRIES;
76466 int sysctl_tcp_keepalive_time __read_mostly = TCP_KEEPALIVE_TIME;
76467@@ -199,6 +203,13 @@ static int tcp_write_timeout(struct sock
76468 }
76469 }
76470
76471+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76472+ if ((sk->sk_state == TCP_LAST_ACK) &&
76473+ (grsec_lastack_retries > 0) &&
76474+ (grsec_lastack_retries < retry_until))
76475+ retry_until = grsec_lastack_retries;
76476+#endif
76477+
76478 if (retransmits_timed_out(sk, retry_until,
76479 syn_set ? 0 : icsk->icsk_user_timeout, syn_set)) {
76480 /* Has it gone just too far? */
76481diff -urNp linux-2.6.39/net/ipv4/udp.c linux-2.6.39/net/ipv4/udp.c
76482--- linux-2.6.39/net/ipv4/udp.c 2011-05-19 00:06:34.000000000 -0400
76483+++ linux-2.6.39/net/ipv4/udp.c 2011-05-22 19:41:42.000000000 -0400
76484@@ -86,6 +86,7 @@
76485 #include <linux/types.h>
76486 #include <linux/fcntl.h>
76487 #include <linux/module.h>
76488+#include <linux/security.h>
76489 #include <linux/socket.h>
76490 #include <linux/sockios.h>
76491 #include <linux/igmp.h>
76492@@ -107,6 +108,10 @@
76493 #include <net/xfrm.h>
76494 #include "udp_impl.h"
76495
76496+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76497+extern int grsec_enable_blackhole;
76498+#endif
76499+
76500 struct udp_table udp_table __read_mostly;
76501 EXPORT_SYMBOL(udp_table);
76502
76503@@ -564,6 +569,9 @@ found:
76504 return s;
76505 }
76506
76507+extern int gr_search_udp_recvmsg(struct sock *sk, const struct sk_buff *skb);
76508+extern int gr_search_udp_sendmsg(struct sock *sk, struct sockaddr_in *addr);
76509+
76510 /*
76511 * This routine is called by the ICMP module when it gets some
76512 * sort of error condition. If err < 0 then the socket should
76513@@ -853,9 +861,18 @@ int udp_sendmsg(struct kiocb *iocb, stru
76514 dport = usin->sin_port;
76515 if (dport == 0)
76516 return -EINVAL;
76517+
76518+ err = gr_search_udp_sendmsg(sk, usin);
76519+ if (err)
76520+ return err;
76521 } else {
76522 if (sk->sk_state != TCP_ESTABLISHED)
76523 return -EDESTADDRREQ;
76524+
76525+ err = gr_search_udp_sendmsg(sk, NULL);
76526+ if (err)
76527+ return err;
76528+
76529 daddr = inet->inet_daddr;
76530 dport = inet->inet_dport;
76531 /* Open fast path for connected socket.
76532@@ -1090,7 +1107,7 @@ static unsigned int first_packet_length(
76533 udp_lib_checksum_complete(skb)) {
76534 UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS,
76535 IS_UDPLITE(sk));
76536- atomic_inc(&sk->sk_drops);
76537+ atomic_inc_unchecked(&sk->sk_drops);
76538 __skb_unlink(skb, rcvq);
76539 __skb_queue_tail(&list_kill, skb);
76540 }
76541@@ -1176,6 +1193,10 @@ try_again:
76542 if (!skb)
76543 goto out;
76544
76545+ err = gr_search_udp_recvmsg(sk, skb);
76546+ if (err)
76547+ goto out_free;
76548+
76549 ulen = skb->len - sizeof(struct udphdr);
76550 if (len > ulen)
76551 len = ulen;
76552@@ -1472,7 +1493,7 @@ int udp_queue_rcv_skb(struct sock *sk, s
76553
76554 drop:
76555 UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
76556- atomic_inc(&sk->sk_drops);
76557+ atomic_inc_unchecked(&sk->sk_drops);
76558 kfree_skb(skb);
76559 return -1;
76560 }
76561@@ -1491,7 +1512,7 @@ static void flush_stack(struct sock **st
76562 skb1 = (i == final) ? skb : skb_clone(skb, GFP_ATOMIC);
76563
76564 if (!skb1) {
76565- atomic_inc(&sk->sk_drops);
76566+ atomic_inc_unchecked(&sk->sk_drops);
76567 UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_RCVBUFERRORS,
76568 IS_UDPLITE(sk));
76569 UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS,
76570@@ -1660,6 +1681,9 @@ int __udp4_lib_rcv(struct sk_buff *skb,
76571 goto csum_error;
76572
76573 UDP_INC_STATS_BH(net, UDP_MIB_NOPORTS, proto == IPPROTO_UDPLITE);
76574+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76575+ if (!grsec_enable_blackhole || (skb->dev->flags & IFF_LOOPBACK))
76576+#endif
76577 icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
76578
76579 /*
76580@@ -2087,8 +2111,13 @@ static void udp4_format_sock(struct sock
76581 sk_wmem_alloc_get(sp),
76582 sk_rmem_alloc_get(sp),
76583 0, 0L, 0, sock_i_uid(sp), 0, sock_i_ino(sp),
76584- atomic_read(&sp->sk_refcnt), sp,
76585- atomic_read(&sp->sk_drops), len);
76586+ atomic_read(&sp->sk_refcnt),
76587+#ifdef CONFIG_GRKERNSEC_HIDESYM
76588+ NULL,
76589+#else
76590+ sp,
76591+#endif
76592+ atomic_read_unchecked(&sp->sk_drops), len);
76593 }
76594
76595 int udp4_seq_show(struct seq_file *seq, void *v)
76596diff -urNp linux-2.6.39/net/ipv6/inet6_connection_sock.c linux-2.6.39/net/ipv6/inet6_connection_sock.c
76597--- linux-2.6.39/net/ipv6/inet6_connection_sock.c 2011-05-19 00:06:34.000000000 -0400
76598+++ linux-2.6.39/net/ipv6/inet6_connection_sock.c 2011-05-22 19:36:34.000000000 -0400
76599@@ -178,7 +178,7 @@ void __inet6_csk_dst_store(struct sock *
76600 #ifdef CONFIG_XFRM
76601 {
76602 struct rt6_info *rt = (struct rt6_info *)dst;
76603- rt->rt6i_flow_cache_genid = atomic_read(&flow_cache_genid);
76604+ rt->rt6i_flow_cache_genid = atomic_read_unchecked(&flow_cache_genid);
76605 }
76606 #endif
76607 }
76608@@ -193,7 +193,7 @@ struct dst_entry *__inet6_csk_dst_check(
76609 #ifdef CONFIG_XFRM
76610 if (dst) {
76611 struct rt6_info *rt = (struct rt6_info *)dst;
76612- if (rt->rt6i_flow_cache_genid != atomic_read(&flow_cache_genid)) {
76613+ if (rt->rt6i_flow_cache_genid != atomic_read_unchecked(&flow_cache_genid)) {
76614 __sk_dst_reset(sk);
76615 dst = NULL;
76616 }
76617diff -urNp linux-2.6.39/net/ipv6/ipv6_sockglue.c linux-2.6.39/net/ipv6/ipv6_sockglue.c
76618--- linux-2.6.39/net/ipv6/ipv6_sockglue.c 2011-05-19 00:06:34.000000000 -0400
76619+++ linux-2.6.39/net/ipv6/ipv6_sockglue.c 2011-05-22 19:36:34.000000000 -0400
76620@@ -129,6 +129,8 @@ static int do_ipv6_setsockopt(struct soc
76621 int val, valbool;
76622 int retv = -ENOPROTOOPT;
76623
76624+ pax_track_stack();
76625+
76626 if (optval == NULL)
76627 val=0;
76628 else {
76629@@ -919,6 +921,8 @@ static int do_ipv6_getsockopt(struct soc
76630 int len;
76631 int val;
76632
76633+ pax_track_stack();
76634+
76635 if (ip6_mroute_opt(optname))
76636 return ip6_mroute_getsockopt(sk, optname, optval, optlen);
76637
76638diff -urNp linux-2.6.39/net/ipv6/raw.c linux-2.6.39/net/ipv6/raw.c
76639--- linux-2.6.39/net/ipv6/raw.c 2011-05-19 00:06:34.000000000 -0400
76640+++ linux-2.6.39/net/ipv6/raw.c 2011-05-22 19:41:42.000000000 -0400
76641@@ -376,7 +376,7 @@ static inline int rawv6_rcv_skb(struct s
76642 {
76643 if ((raw6_sk(sk)->checksum || rcu_dereference_raw(sk->sk_filter)) &&
76644 skb_checksum_complete(skb)) {
76645- atomic_inc(&sk->sk_drops);
76646+ atomic_inc_unchecked(&sk->sk_drops);
76647 kfree_skb(skb);
76648 return NET_RX_DROP;
76649 }
76650@@ -403,7 +403,7 @@ int rawv6_rcv(struct sock *sk, struct sk
76651 struct raw6_sock *rp = raw6_sk(sk);
76652
76653 if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb)) {
76654- atomic_inc(&sk->sk_drops);
76655+ atomic_inc_unchecked(&sk->sk_drops);
76656 kfree_skb(skb);
76657 return NET_RX_DROP;
76658 }
76659@@ -427,7 +427,7 @@ int rawv6_rcv(struct sock *sk, struct sk
76660
76661 if (inet->hdrincl) {
76662 if (skb_checksum_complete(skb)) {
76663- atomic_inc(&sk->sk_drops);
76664+ atomic_inc_unchecked(&sk->sk_drops);
76665 kfree_skb(skb);
76666 return NET_RX_DROP;
76667 }
76668@@ -601,7 +601,7 @@ out:
76669 return err;
76670 }
76671
76672-static int rawv6_send_hdrinc(struct sock *sk, void *from, int length,
76673+static int rawv6_send_hdrinc(struct sock *sk, void *from, unsigned int length,
76674 struct flowi6 *fl6, struct dst_entry **dstp,
76675 unsigned int flags)
76676 {
76677@@ -742,6 +742,8 @@ static int rawv6_sendmsg(struct kiocb *i
76678 u16 proto;
76679 int err;
76680
76681+ pax_track_stack();
76682+
76683 /* Rough check on arithmetic overflow,
76684 better check is made in ip6_append_data().
76685 */
76686@@ -909,12 +911,15 @@ do_confirm:
76687 static int rawv6_seticmpfilter(struct sock *sk, int level, int optname,
76688 char __user *optval, int optlen)
76689 {
76690+ struct icmp6_filter filter;
76691+
76692 switch (optname) {
76693 case ICMPV6_FILTER:
76694 if (optlen > sizeof(struct icmp6_filter))
76695 optlen = sizeof(struct icmp6_filter);
76696- if (copy_from_user(&raw6_sk(sk)->filter, optval, optlen))
76697+ if (copy_from_user(&filter, optval, optlen))
76698 return -EFAULT;
76699+ memcpy(&raw6_sk(sk)->filter, &filter, optlen);
76700 return 0;
76701 default:
76702 return -ENOPROTOOPT;
76703@@ -926,6 +931,7 @@ static int rawv6_seticmpfilter(struct so
76704 static int rawv6_geticmpfilter(struct sock *sk, int level, int optname,
76705 char __user *optval, int __user *optlen)
76706 {
76707+ struct icmp6_filter filter;
76708 int len;
76709
76710 switch (optname) {
76711@@ -938,7 +944,8 @@ static int rawv6_geticmpfilter(struct so
76712 len = sizeof(struct icmp6_filter);
76713 if (put_user(len, optlen))
76714 return -EFAULT;
76715- if (copy_to_user(optval, &raw6_sk(sk)->filter, len))
76716+ memcpy(&filter, &raw6_sk(sk)->filter, len);
76717+ if (copy_to_user(optval, &filter, len))
76718 return -EFAULT;
76719 return 0;
76720 default:
76721@@ -1252,7 +1259,13 @@ static void raw6_sock_seq_show(struct se
76722 0, 0L, 0,
76723 sock_i_uid(sp), 0,
76724 sock_i_ino(sp),
76725- atomic_read(&sp->sk_refcnt), sp, atomic_read(&sp->sk_drops));
76726+ atomic_read(&sp->sk_refcnt),
76727+#ifdef CONFIG_GRKERNSEC_HIDESYM
76728+ NULL,
76729+#else
76730+ sp,
76731+#endif
76732+ atomic_read_unchecked(&sp->sk_drops));
76733 }
76734
76735 static int raw6_seq_show(struct seq_file *seq, void *v)
76736diff -urNp linux-2.6.39/net/ipv6/tcp_ipv6.c linux-2.6.39/net/ipv6/tcp_ipv6.c
76737--- linux-2.6.39/net/ipv6/tcp_ipv6.c 2011-05-19 00:06:34.000000000 -0400
76738+++ linux-2.6.39/net/ipv6/tcp_ipv6.c 2011-05-22 19:41:42.000000000 -0400
76739@@ -92,6 +92,10 @@ static struct tcp_md5sig_key *tcp_v6_md5
76740 }
76741 #endif
76742
76743+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76744+extern int grsec_enable_blackhole;
76745+#endif
76746+
76747 static void tcp_v6_hash(struct sock *sk)
76748 {
76749 if (sk->sk_state != TCP_CLOSE) {
76750@@ -1660,6 +1664,9 @@ static int tcp_v6_do_rcv(struct sock *sk
76751 return 0;
76752
76753 reset:
76754+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76755+ if (!grsec_enable_blackhole)
76756+#endif
76757 tcp_v6_send_reset(sk, skb);
76758 discard:
76759 if (opt_skb)
76760@@ -1739,12 +1746,20 @@ static int tcp_v6_rcv(struct sk_buff *sk
76761 TCP_SKB_CB(skb)->sacked = 0;
76762
76763 sk = __inet6_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
76764- if (!sk)
76765+ if (!sk) {
76766+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76767+ ret = 1;
76768+#endif
76769 goto no_tcp_socket;
76770+ }
76771
76772 process:
76773- if (sk->sk_state == TCP_TIME_WAIT)
76774+ if (sk->sk_state == TCP_TIME_WAIT) {
76775+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76776+ ret = 2;
76777+#endif
76778 goto do_time_wait;
76779+ }
76780
76781 if (hdr->hop_limit < inet6_sk(sk)->min_hopcount) {
76782 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
76783@@ -1792,6 +1807,10 @@ no_tcp_socket:
76784 bad_packet:
76785 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
76786 } else {
76787+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76788+ if (!grsec_enable_blackhole || (ret == 1 &&
76789+ (skb->dev->flags & IFF_LOOPBACK)))
76790+#endif
76791 tcp_v6_send_reset(NULL, skb);
76792 }
76793
76794@@ -2052,7 +2071,13 @@ static void get_openreq6(struct seq_file
76795 uid,
76796 0, /* non standard timer */
76797 0, /* open_requests have no inode */
76798- 0, req);
76799+ 0,
76800+#ifdef CONFIG_GRKERNSEC_HIDESYM
76801+ NULL
76802+#else
76803+ req
76804+#endif
76805+ );
76806 }
76807
76808 static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
76809@@ -2102,7 +2127,12 @@ static void get_tcp6_sock(struct seq_fil
76810 sock_i_uid(sp),
76811 icsk->icsk_probes_out,
76812 sock_i_ino(sp),
76813- atomic_read(&sp->sk_refcnt), sp,
76814+ atomic_read(&sp->sk_refcnt),
76815+#ifdef CONFIG_GRKERNSEC_HIDESYM
76816+ NULL,
76817+#else
76818+ sp,
76819+#endif
76820 jiffies_to_clock_t(icsk->icsk_rto),
76821 jiffies_to_clock_t(icsk->icsk_ack.ato),
76822 (icsk->icsk_ack.quick << 1 ) | icsk->icsk_ack.pingpong,
76823@@ -2137,7 +2167,13 @@ static void get_timewait6_sock(struct se
76824 dest->s6_addr32[2], dest->s6_addr32[3], destp,
76825 tw->tw_substate, 0, 0,
76826 3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
76827- atomic_read(&tw->tw_refcnt), tw);
76828+ atomic_read(&tw->tw_refcnt),
76829+#ifdef CONFIG_GRKERNSEC_HIDESYM
76830+ NULL
76831+#else
76832+ tw
76833+#endif
76834+ );
76835 }
76836
76837 static int tcp6_seq_show(struct seq_file *seq, void *v)
76838diff -urNp linux-2.6.39/net/ipv6/udp.c linux-2.6.39/net/ipv6/udp.c
76839--- linux-2.6.39/net/ipv6/udp.c 2011-05-19 00:06:34.000000000 -0400
76840+++ linux-2.6.39/net/ipv6/udp.c 2011-05-22 19:41:42.000000000 -0400
76841@@ -50,6 +50,10 @@
76842 #include <linux/seq_file.h>
76843 #include "udp_impl.h"
76844
76845+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76846+extern int grsec_enable_blackhole;
76847+#endif
76848+
76849 int ipv6_rcv_saddr_equal(const struct sock *sk, const struct sock *sk2)
76850 {
76851 const struct in6_addr *sk_rcv_saddr6 = &inet6_sk(sk)->rcv_saddr;
76852@@ -545,7 +549,7 @@ int udpv6_queue_rcv_skb(struct sock * sk
76853
76854 return 0;
76855 drop:
76856- atomic_inc(&sk->sk_drops);
76857+ atomic_inc_unchecked(&sk->sk_drops);
76858 drop_no_sk_drops_inc:
76859 UDP6_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
76860 kfree_skb(skb);
76861@@ -621,7 +625,7 @@ static void flush_stack(struct sock **st
76862 continue;
76863 }
76864 drop:
76865- atomic_inc(&sk->sk_drops);
76866+ atomic_inc_unchecked(&sk->sk_drops);
76867 UDP6_INC_STATS_BH(sock_net(sk),
76868 UDP_MIB_RCVBUFERRORS, IS_UDPLITE(sk));
76869 UDP6_INC_STATS_BH(sock_net(sk),
76870@@ -776,6 +780,9 @@ int __udp6_lib_rcv(struct sk_buff *skb,
76871 UDP6_INC_STATS_BH(net, UDP_MIB_NOPORTS,
76872 proto == IPPROTO_UDPLITE);
76873
76874+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76875+ if (!grsec_enable_blackhole || (skb->dev->flags & IFF_LOOPBACK))
76876+#endif
76877 icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0);
76878
76879 kfree_skb(skb);
76880@@ -792,7 +799,7 @@ int __udp6_lib_rcv(struct sk_buff *skb,
76881 if (!sock_owned_by_user(sk))
76882 udpv6_queue_rcv_skb(sk, skb);
76883 else if (sk_add_backlog(sk, skb)) {
76884- atomic_inc(&sk->sk_drops);
76885+ atomic_inc_unchecked(&sk->sk_drops);
76886 bh_unlock_sock(sk);
76887 sock_put(sk);
76888 goto discard;
76889@@ -1403,8 +1410,13 @@ static void udp6_sock_seq_show(struct se
76890 0, 0L, 0,
76891 sock_i_uid(sp), 0,
76892 sock_i_ino(sp),
76893- atomic_read(&sp->sk_refcnt), sp,
76894- atomic_read(&sp->sk_drops));
76895+ atomic_read(&sp->sk_refcnt),
76896+#ifdef CONFIG_GRKERNSEC_HIDESYM
76897+ NULL,
76898+#else
76899+ sp,
76900+#endif
76901+ atomic_read_unchecked(&sp->sk_drops));
76902 }
76903
76904 int udp6_seq_show(struct seq_file *seq, void *v)
76905diff -urNp linux-2.6.39/net/irda/ircomm/ircomm_tty.c linux-2.6.39/net/irda/ircomm/ircomm_tty.c
76906--- linux-2.6.39/net/irda/ircomm/ircomm_tty.c 2011-05-19 00:06:34.000000000 -0400
76907+++ linux-2.6.39/net/irda/ircomm/ircomm_tty.c 2011-05-22 19:36:34.000000000 -0400
76908@@ -281,16 +281,16 @@ static int ircomm_tty_block_til_ready(st
76909 add_wait_queue(&self->open_wait, &wait);
76910
76911 IRDA_DEBUG(2, "%s(%d):block_til_ready before block on %s open_count=%d\n",
76912- __FILE__,__LINE__, tty->driver->name, self->open_count );
76913+ __FILE__,__LINE__, tty->driver->name, local_read(&self->open_count) );
76914
76915 /* As far as I can see, we protect open_count - Jean II */
76916 spin_lock_irqsave(&self->spinlock, flags);
76917 if (!tty_hung_up_p(filp)) {
76918 extra_count = 1;
76919- self->open_count--;
76920+ local_dec(&self->open_count);
76921 }
76922 spin_unlock_irqrestore(&self->spinlock, flags);
76923- self->blocked_open++;
76924+ local_inc(&self->blocked_open);
76925
76926 while (1) {
76927 if (tty->termios->c_cflag & CBAUD) {
76928@@ -330,7 +330,7 @@ static int ircomm_tty_block_til_ready(st
76929 }
76930
76931 IRDA_DEBUG(1, "%s(%d):block_til_ready blocking on %s open_count=%d\n",
76932- __FILE__,__LINE__, tty->driver->name, self->open_count );
76933+ __FILE__,__LINE__, tty->driver->name, local_read(&self->open_count) );
76934
76935 schedule();
76936 }
76937@@ -341,13 +341,13 @@ static int ircomm_tty_block_til_ready(st
76938 if (extra_count) {
76939 /* ++ is not atomic, so this should be protected - Jean II */
76940 spin_lock_irqsave(&self->spinlock, flags);
76941- self->open_count++;
76942+ local_inc(&self->open_count);
76943 spin_unlock_irqrestore(&self->spinlock, flags);
76944 }
76945- self->blocked_open--;
76946+ local_dec(&self->blocked_open);
76947
76948 IRDA_DEBUG(1, "%s(%d):block_til_ready after blocking on %s open_count=%d\n",
76949- __FILE__,__LINE__, tty->driver->name, self->open_count);
76950+ __FILE__,__LINE__, tty->driver->name, local_read(&self->open_count));
76951
76952 if (!retval)
76953 self->flags |= ASYNC_NORMAL_ACTIVE;
76954@@ -416,14 +416,14 @@ static int ircomm_tty_open(struct tty_st
76955 }
76956 /* ++ is not atomic, so this should be protected - Jean II */
76957 spin_lock_irqsave(&self->spinlock, flags);
76958- self->open_count++;
76959+ local_inc(&self->open_count);
76960
76961 tty->driver_data = self;
76962 self->tty = tty;
76963 spin_unlock_irqrestore(&self->spinlock, flags);
76964
76965 IRDA_DEBUG(1, "%s(), %s%d, count = %d\n", __func__ , tty->driver->name,
76966- self->line, self->open_count);
76967+ self->line, local_read(&self->open_count));
76968
76969 /* Not really used by us, but lets do it anyway */
76970 self->tty->low_latency = (self->flags & ASYNC_LOW_LATENCY) ? 1 : 0;
76971@@ -509,7 +509,7 @@ static void ircomm_tty_close(struct tty_
76972 return;
76973 }
76974
76975- if ((tty->count == 1) && (self->open_count != 1)) {
76976+ if ((tty->count == 1) && (local_read(&self->open_count) != 1)) {
76977 /*
76978 * Uh, oh. tty->count is 1, which means that the tty
76979 * structure will be freed. state->count should always
76980@@ -519,16 +519,16 @@ static void ircomm_tty_close(struct tty_
76981 */
76982 IRDA_DEBUG(0, "%s(), bad serial port count; "
76983 "tty->count is 1, state->count is %d\n", __func__ ,
76984- self->open_count);
76985- self->open_count = 1;
76986+ local_read(&self->open_count));
76987+ local_set(&self->open_count, 1);
76988 }
76989
76990- if (--self->open_count < 0) {
76991+ if (local_dec_return(&self->open_count) < 0) {
76992 IRDA_ERROR("%s(), bad serial port count for ttys%d: %d\n",
76993- __func__, self->line, self->open_count);
76994- self->open_count = 0;
76995+ __func__, self->line, local_read(&self->open_count));
76996+ local_set(&self->open_count, 0);
76997 }
76998- if (self->open_count) {
76999+ if (local_read(&self->open_count)) {
77000 spin_unlock_irqrestore(&self->spinlock, flags);
77001
77002 IRDA_DEBUG(0, "%s(), open count > 0\n", __func__ );
77003@@ -560,7 +560,7 @@ static void ircomm_tty_close(struct tty_
77004 tty->closing = 0;
77005 self->tty = NULL;
77006
77007- if (self->blocked_open) {
77008+ if (local_read(&self->blocked_open)) {
77009 if (self->close_delay)
77010 schedule_timeout_interruptible(self->close_delay);
77011 wake_up_interruptible(&self->open_wait);
77012@@ -1012,7 +1012,7 @@ static void ircomm_tty_hangup(struct tty
77013 spin_lock_irqsave(&self->spinlock, flags);
77014 self->flags &= ~ASYNC_NORMAL_ACTIVE;
77015 self->tty = NULL;
77016- self->open_count = 0;
77017+ local_set(&self->open_count, 0);
77018 spin_unlock_irqrestore(&self->spinlock, flags);
77019
77020 wake_up_interruptible(&self->open_wait);
77021@@ -1364,7 +1364,7 @@ static void ircomm_tty_line_info(struct
77022 seq_putc(m, '\n');
77023
77024 seq_printf(m, "Role: %s\n", self->client ? "client" : "server");
77025- seq_printf(m, "Open count: %d\n", self->open_count);
77026+ seq_printf(m, "Open count: %d\n", local_read(&self->open_count));
77027 seq_printf(m, "Max data size: %d\n", self->max_data_size);
77028 seq_printf(m, "Max header size: %d\n", self->max_header_size);
77029
77030diff -urNp linux-2.6.39/net/iucv/af_iucv.c linux-2.6.39/net/iucv/af_iucv.c
77031--- linux-2.6.39/net/iucv/af_iucv.c 2011-05-19 00:06:34.000000000 -0400
77032+++ linux-2.6.39/net/iucv/af_iucv.c 2011-05-22 19:36:34.000000000 -0400
77033@@ -653,10 +653,10 @@ static int iucv_sock_autobind(struct soc
77034
77035 write_lock_bh(&iucv_sk_list.lock);
77036
77037- sprintf(name, "%08x", atomic_inc_return(&iucv_sk_list.autobind_name));
77038+ sprintf(name, "%08x", atomic_inc_return_unchecked(&iucv_sk_list.autobind_name));
77039 while (__iucv_get_sock_by_name(name)) {
77040 sprintf(name, "%08x",
77041- atomic_inc_return(&iucv_sk_list.autobind_name));
77042+ atomic_inc_return_unchecked(&iucv_sk_list.autobind_name));
77043 }
77044
77045 write_unlock_bh(&iucv_sk_list.lock);
77046diff -urNp linux-2.6.39/net/key/af_key.c linux-2.6.39/net/key/af_key.c
77047--- linux-2.6.39/net/key/af_key.c 2011-05-19 00:06:34.000000000 -0400
77048+++ linux-2.6.39/net/key/af_key.c 2011-05-22 19:41:42.000000000 -0400
77049@@ -2481,6 +2481,8 @@ static int pfkey_migrate(struct sock *sk
77050 struct xfrm_migrate m[XFRM_MAX_DEPTH];
77051 struct xfrm_kmaddress k;
77052
77053+ pax_track_stack();
77054+
77055 if (!present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC - 1],
77056 ext_hdrs[SADB_EXT_ADDRESS_DST - 1]) ||
77057 !ext_hdrs[SADB_X_EXT_POLICY - 1]) {
77058@@ -3016,10 +3018,10 @@ static int pfkey_send_policy_notify(stru
77059 static u32 get_acqseq(void)
77060 {
77061 u32 res;
77062- static atomic_t acqseq;
77063+ static atomic_unchecked_t acqseq;
77064
77065 do {
77066- res = atomic_inc_return(&acqseq);
77067+ res = atomic_inc_return_unchecked(&acqseq);
77068 } while (!res);
77069 return res;
77070 }
77071@@ -3657,7 +3659,11 @@ static int pfkey_seq_show(struct seq_fil
77072 seq_printf(f ,"sk RefCnt Rmem Wmem User Inode\n");
77073 else
77074 seq_printf(f ,"%p %-6d %-6u %-6u %-6u %-6lu\n",
77075+#ifdef CONFIG_GRKERNSEC_HIDESYM
77076+ NULL,
77077+#else
77078 s,
77079+#endif
77080 atomic_read(&s->sk_refcnt),
77081 sk_rmem_alloc_get(s),
77082 sk_wmem_alloc_get(s),
77083diff -urNp linux-2.6.39/net/l2tp/l2tp_ip.c linux-2.6.39/net/l2tp/l2tp_ip.c
77084--- linux-2.6.39/net/l2tp/l2tp_ip.c 2011-05-19 00:06:34.000000000 -0400
77085+++ linux-2.6.39/net/l2tp/l2tp_ip.c 2011-05-22 19:36:34.000000000 -0400
77086@@ -625,7 +625,7 @@ static struct inet_protosw l2tp_ip_proto
77087 .no_check = 0,
77088 };
77089
77090-static struct net_protocol l2tp_ip_protocol __read_mostly = {
77091+static const struct net_protocol l2tp_ip_protocol = {
77092 .handler = l2tp_ip_recv,
77093 };
77094
77095diff -urNp linux-2.6.39/net/lapb/lapb_iface.c linux-2.6.39/net/lapb/lapb_iface.c
77096--- linux-2.6.39/net/lapb/lapb_iface.c 2011-05-19 00:06:34.000000000 -0400
77097+++ linux-2.6.39/net/lapb/lapb_iface.c 2011-05-22 19:36:34.000000000 -0400
77098@@ -138,8 +138,7 @@ static struct lapb_cb *lapb_create_cb(vo
77099 out:
77100 return lapb;
77101 }
77102-
77103-int lapb_register(struct net_device *dev, struct lapb_register_struct *callbacks)
77104+int lapb_register(struct net_device *dev, const struct lapb_register_struct *callbacks)
77105 {
77106 struct lapb_cb *lapb;
77107 int rc = LAPB_BADTOKEN;
77108diff -urNp linux-2.6.39/net/mac80211/cfg.c linux-2.6.39/net/mac80211/cfg.c
77109--- linux-2.6.39/net/mac80211/cfg.c 2011-05-19 00:06:34.000000000 -0400
77110+++ linux-2.6.39/net/mac80211/cfg.c 2011-05-22 19:36:34.000000000 -0400
77111@@ -2029,7 +2029,7 @@ static void ieee80211_get_ringparam(stru
77112 drv_get_ringparam(local, tx, tx_max, rx, rx_max);
77113 }
77114
77115-struct cfg80211_ops mac80211_config_ops = {
77116+const struct cfg80211_ops mac80211_config_ops = {
77117 .add_virtual_intf = ieee80211_add_iface,
77118 .del_virtual_intf = ieee80211_del_iface,
77119 .change_virtual_intf = ieee80211_change_iface,
77120diff -urNp linux-2.6.39/net/mac80211/cfg.h linux-2.6.39/net/mac80211/cfg.h
77121--- linux-2.6.39/net/mac80211/cfg.h 2011-05-19 00:06:34.000000000 -0400
77122+++ linux-2.6.39/net/mac80211/cfg.h 2011-05-22 19:36:34.000000000 -0400
77123@@ -4,6 +4,6 @@
77124 #ifndef __CFG_H
77125 #define __CFG_H
77126
77127-extern struct cfg80211_ops mac80211_config_ops;
77128+extern const struct cfg80211_ops mac80211_config_ops;
77129
77130 #endif /* __CFG_H */
77131diff -urNp linux-2.6.39/net/mac80211/debugfs_sta.c linux-2.6.39/net/mac80211/debugfs_sta.c
77132--- linux-2.6.39/net/mac80211/debugfs_sta.c 2011-05-19 00:06:34.000000000 -0400
77133+++ linux-2.6.39/net/mac80211/debugfs_sta.c 2011-05-22 19:36:34.000000000 -0400
77134@@ -115,6 +115,8 @@ static ssize_t sta_agg_status_read(struc
77135 struct tid_ampdu_rx *tid_rx;
77136 struct tid_ampdu_tx *tid_tx;
77137
77138+ pax_track_stack();
77139+
77140 rcu_read_lock();
77141
77142 p += scnprintf(p, sizeof(buf) + buf - p, "next dialog_token: %#02x\n",
77143@@ -215,6 +217,8 @@ static ssize_t sta_ht_capa_read(struct f
77144 struct sta_info *sta = file->private_data;
77145 struct ieee80211_sta_ht_cap *htc = &sta->sta.ht_cap;
77146
77147+ pax_track_stack();
77148+
77149 p += scnprintf(p, sizeof(buf) + buf - p, "ht %ssupported\n",
77150 htc->ht_supported ? "" : "not ");
77151 if (htc->ht_supported) {
77152diff -urNp linux-2.6.39/net/mac80211/ieee80211_i.h linux-2.6.39/net/mac80211/ieee80211_i.h
77153--- linux-2.6.39/net/mac80211/ieee80211_i.h 2011-05-19 00:06:34.000000000 -0400
77154+++ linux-2.6.39/net/mac80211/ieee80211_i.h 2011-05-22 19:36:34.000000000 -0400
77155@@ -27,6 +27,7 @@
77156 #include <net/ieee80211_radiotap.h>
77157 #include <net/cfg80211.h>
77158 #include <net/mac80211.h>
77159+#include <asm/local.h>
77160 #include "key.h"
77161 #include "sta_info.h"
77162
77163@@ -714,7 +715,7 @@ struct ieee80211_local {
77164 /* also used to protect ampdu_ac_queue and amdpu_ac_stop_refcnt */
77165 spinlock_t queue_stop_reason_lock;
77166
77167- int open_count;
77168+ local_t open_count;
77169 int monitors, cooked_mntrs;
77170 /* number of interfaces with corresponding FIF_ flags */
77171 int fif_fcsfail, fif_plcpfail, fif_control, fif_other_bss, fif_pspoll,
77172diff -urNp linux-2.6.39/net/mac80211/iface.c linux-2.6.39/net/mac80211/iface.c
77173--- linux-2.6.39/net/mac80211/iface.c 2011-05-19 00:06:34.000000000 -0400
77174+++ linux-2.6.39/net/mac80211/iface.c 2011-05-22 19:36:34.000000000 -0400
77175@@ -211,7 +211,7 @@ static int ieee80211_do_open(struct net_
77176 break;
77177 }
77178
77179- if (local->open_count == 0) {
77180+ if (local_read(&local->open_count) == 0) {
77181 res = drv_start(local);
77182 if (res)
77183 goto err_del_bss;
77184@@ -235,7 +235,7 @@ static int ieee80211_do_open(struct net_
77185 memcpy(dev->perm_addr, dev->dev_addr, ETH_ALEN);
77186
77187 if (!is_valid_ether_addr(dev->dev_addr)) {
77188- if (!local->open_count)
77189+ if (!local_read(&local->open_count))
77190 drv_stop(local);
77191 return -EADDRNOTAVAIL;
77192 }
77193@@ -327,7 +327,7 @@ static int ieee80211_do_open(struct net_
77194 mutex_unlock(&local->mtx);
77195
77196 if (coming_up)
77197- local->open_count++;
77198+ local_inc(&local->open_count);
77199
77200 if (hw_reconf_flags) {
77201 ieee80211_hw_config(local, hw_reconf_flags);
77202@@ -347,7 +347,7 @@ static int ieee80211_do_open(struct net_
77203 err_del_interface:
77204 drv_remove_interface(local, &sdata->vif);
77205 err_stop:
77206- if (!local->open_count)
77207+ if (!local_read(&local->open_count))
77208 drv_stop(local);
77209 err_del_bss:
77210 sdata->bss = NULL;
77211@@ -474,7 +474,7 @@ static void ieee80211_do_stop(struct iee
77212 }
77213
77214 if (going_down)
77215- local->open_count--;
77216+ local_dec(&local->open_count);
77217
77218 switch (sdata->vif.type) {
77219 case NL80211_IFTYPE_AP_VLAN:
77220@@ -533,7 +533,7 @@ static void ieee80211_do_stop(struct iee
77221
77222 ieee80211_recalc_ps(local, -1);
77223
77224- if (local->open_count == 0) {
77225+ if (local_read(&local->open_count) == 0) {
77226 if (local->ops->napi_poll)
77227 napi_disable(&local->napi);
77228 ieee80211_clear_tx_pending(local);
77229diff -urNp linux-2.6.39/net/mac80211/main.c linux-2.6.39/net/mac80211/main.c
77230--- linux-2.6.39/net/mac80211/main.c 2011-05-19 00:06:34.000000000 -0400
77231+++ linux-2.6.39/net/mac80211/main.c 2011-05-22 19:36:34.000000000 -0400
77232@@ -215,7 +215,7 @@ int ieee80211_hw_config(struct ieee80211
77233 local->hw.conf.power_level = power;
77234 }
77235
77236- if (changed && local->open_count) {
77237+ if (changed && local_read(&local->open_count)) {
77238 ret = drv_config(local, changed);
77239 /*
77240 * Goal:
77241diff -urNp linux-2.6.39/net/mac80211/mlme.c linux-2.6.39/net/mac80211/mlme.c
77242--- linux-2.6.39/net/mac80211/mlme.c 2011-05-19 00:06:34.000000000 -0400
77243+++ linux-2.6.39/net/mac80211/mlme.c 2011-05-22 19:36:34.000000000 -0400
77244@@ -1431,6 +1431,8 @@ static bool ieee80211_assoc_success(stru
77245 bool have_higher_than_11mbit = false;
77246 u16 ap_ht_cap_flags;
77247
77248+ pax_track_stack();
77249+
77250 /* AssocResp and ReassocResp have identical structure */
77251
77252 aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
77253diff -urNp linux-2.6.39/net/mac80211/pm.c linux-2.6.39/net/mac80211/pm.c
77254--- linux-2.6.39/net/mac80211/pm.c 2011-05-19 00:06:34.000000000 -0400
77255+++ linux-2.6.39/net/mac80211/pm.c 2011-05-22 19:36:34.000000000 -0400
77256@@ -95,7 +95,7 @@ int __ieee80211_suspend(struct ieee80211
77257 }
77258
77259 /* stop hardware - this must stop RX */
77260- if (local->open_count)
77261+ if (local_read(&local->open_count))
77262 ieee80211_stop_device(local);
77263
77264 local->suspended = true;
77265diff -urNp linux-2.6.39/net/mac80211/rate.c linux-2.6.39/net/mac80211/rate.c
77266--- linux-2.6.39/net/mac80211/rate.c 2011-05-19 00:06:34.000000000 -0400
77267+++ linux-2.6.39/net/mac80211/rate.c 2011-05-22 19:36:34.000000000 -0400
77268@@ -371,7 +371,7 @@ int ieee80211_init_rate_ctrl_alg(struct
77269
77270 ASSERT_RTNL();
77271
77272- if (local->open_count)
77273+ if (local_read(&local->open_count))
77274 return -EBUSY;
77275
77276 if (local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL) {
77277diff -urNp linux-2.6.39/net/mac80211/rc80211_pid_debugfs.c linux-2.6.39/net/mac80211/rc80211_pid_debugfs.c
77278--- linux-2.6.39/net/mac80211/rc80211_pid_debugfs.c 2011-05-19 00:06:34.000000000 -0400
77279+++ linux-2.6.39/net/mac80211/rc80211_pid_debugfs.c 2011-05-22 19:36:34.000000000 -0400
77280@@ -192,7 +192,7 @@ static ssize_t rate_control_pid_events_r
77281
77282 spin_unlock_irqrestore(&events->lock, status);
77283
77284- if (copy_to_user(buf, pb, p))
77285+ if (p > sizeof(pb) || copy_to_user(buf, pb, p))
77286 return -EFAULT;
77287
77288 return p;
77289diff -urNp linux-2.6.39/net/mac80211/util.c linux-2.6.39/net/mac80211/util.c
77290--- linux-2.6.39/net/mac80211/util.c 2011-05-19 00:06:34.000000000 -0400
77291+++ linux-2.6.39/net/mac80211/util.c 2011-05-22 19:36:34.000000000 -0400
77292@@ -1129,7 +1129,7 @@ int ieee80211_reconfig(struct ieee80211_
77293 local->resuming = true;
77294
77295 /* restart hardware */
77296- if (local->open_count) {
77297+ if (local_read(&local->open_count)) {
77298 /*
77299 * Upon resume hardware can sometimes be goofy due to
77300 * various platform / driver / bus issues, so restarting
77301diff -urNp linux-2.6.39/net/netfilter/ipvs/ip_vs_conn.c linux-2.6.39/net/netfilter/ipvs/ip_vs_conn.c
77302--- linux-2.6.39/net/netfilter/ipvs/ip_vs_conn.c 2011-05-19 00:06:34.000000000 -0400
77303+++ linux-2.6.39/net/netfilter/ipvs/ip_vs_conn.c 2011-05-22 19:36:34.000000000 -0400
77304@@ -556,7 +556,7 @@ ip_vs_bind_dest(struct ip_vs_conn *cp, s
77305 /* Increase the refcnt counter of the dest */
77306 atomic_inc(&dest->refcnt);
77307
77308- conn_flags = atomic_read(&dest->conn_flags);
77309+ conn_flags = atomic_read_unchecked(&dest->conn_flags);
77310 if (cp->protocol != IPPROTO_UDP)
77311 conn_flags &= ~IP_VS_CONN_F_ONE_PACKET;
77312 /* Bind with the destination and its corresponding transmitter */
77313@@ -861,7 +861,7 @@ ip_vs_conn_new(const struct ip_vs_conn_p
77314 atomic_set(&cp->refcnt, 1);
77315
77316 atomic_set(&cp->n_control, 0);
77317- atomic_set(&cp->in_pkts, 0);
77318+ atomic_set_unchecked(&cp->in_pkts, 0);
77319
77320 atomic_inc(&ipvs->conn_count);
77321 if (flags & IP_VS_CONN_F_NO_CPORT)
77322@@ -1141,7 +1141,7 @@ static inline int todrop_entry(struct ip
77323
77324 /* Don't drop the entry if its number of incoming packets is not
77325 located in [0, 8] */
77326- i = atomic_read(&cp->in_pkts);
77327+ i = atomic_read_unchecked(&cp->in_pkts);
77328 if (i > 8 || i < 0) return 0;
77329
77330 if (!todrop_rate[i]) return 0;
77331diff -urNp linux-2.6.39/net/netfilter/ipvs/ip_vs_core.c linux-2.6.39/net/netfilter/ipvs/ip_vs_core.c
77332--- linux-2.6.39/net/netfilter/ipvs/ip_vs_core.c 2011-05-19 00:06:34.000000000 -0400
77333+++ linux-2.6.39/net/netfilter/ipvs/ip_vs_core.c 2011-05-22 19:36:34.000000000 -0400
77334@@ -563,7 +563,7 @@ int ip_vs_leave(struct ip_vs_service *sv
77335 ret = cp->packet_xmit(skb, cp, pd->pp);
77336 /* do not touch skb anymore */
77337
77338- atomic_inc(&cp->in_pkts);
77339+ atomic_inc_unchecked(&cp->in_pkts);
77340 ip_vs_conn_put(cp);
77341 return ret;
77342 }
77343@@ -1633,7 +1633,7 @@ ip_vs_in(unsigned int hooknum, struct sk
77344 if (cp->flags & IP_VS_CONN_F_ONE_PACKET)
77345 pkts = sysctl_sync_threshold(ipvs);
77346 else
77347- pkts = atomic_add_return(1, &cp->in_pkts);
77348+ pkts = atomic_add_return_unchecked(1, &cp->in_pkts);
77349
77350 if ((ipvs->sync_state & IP_VS_STATE_MASTER) &&
77351 cp->protocol == IPPROTO_SCTP) {
77352diff -urNp linux-2.6.39/net/netfilter/ipvs/ip_vs_ctl.c linux-2.6.39/net/netfilter/ipvs/ip_vs_ctl.c
77353--- linux-2.6.39/net/netfilter/ipvs/ip_vs_ctl.c 2011-05-19 00:06:34.000000000 -0400
77354+++ linux-2.6.39/net/netfilter/ipvs/ip_vs_ctl.c 2011-05-22 19:36:34.000000000 -0400
77355@@ -782,7 +782,7 @@ __ip_vs_update_dest(struct ip_vs_service
77356 ip_vs_rs_hash(ipvs, dest);
77357 write_unlock_bh(&ipvs->rs_lock);
77358 }
77359- atomic_set(&dest->conn_flags, conn_flags);
77360+ atomic_set_unchecked(&dest->conn_flags, conn_flags);
77361
77362 /* bind the service */
77363 if (!dest->svc) {
77364@@ -2027,7 +2027,7 @@ static int ip_vs_info_seq_show(struct se
77365 " %-7s %-6d %-10d %-10d\n",
77366 &dest->addr.in6,
77367 ntohs(dest->port),
77368- ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
77369+ ip_vs_fwd_name(atomic_read_unchecked(&dest->conn_flags)),
77370 atomic_read(&dest->weight),
77371 atomic_read(&dest->activeconns),
77372 atomic_read(&dest->inactconns));
77373@@ -2038,7 +2038,7 @@ static int ip_vs_info_seq_show(struct se
77374 "%-7s %-6d %-10d %-10d\n",
77375 ntohl(dest->addr.ip),
77376 ntohs(dest->port),
77377- ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
77378+ ip_vs_fwd_name(atomic_read_unchecked(&dest->conn_flags)),
77379 atomic_read(&dest->weight),
77380 atomic_read(&dest->activeconns),
77381 atomic_read(&dest->inactconns));
77382@@ -2287,6 +2287,8 @@ do_ip_vs_set_ctl(struct sock *sk, int cm
77383 struct ip_vs_dest_user *udest_compat;
77384 struct ip_vs_dest_user_kern udest;
77385
77386+ pax_track_stack();
77387+
77388 if (!capable(CAP_NET_ADMIN))
77389 return -EPERM;
77390
77391@@ -2501,7 +2503,7 @@ __ip_vs_get_dest_entries(struct net *net
77392
77393 entry.addr = dest->addr.ip;
77394 entry.port = dest->port;
77395- entry.conn_flags = atomic_read(&dest->conn_flags);
77396+ entry.conn_flags = atomic_read_unchecked(&dest->conn_flags);
77397 entry.weight = atomic_read(&dest->weight);
77398 entry.u_threshold = dest->u_threshold;
77399 entry.l_threshold = dest->l_threshold;
77400@@ -3029,7 +3031,7 @@ static int ip_vs_genl_fill_dest(struct s
77401 NLA_PUT_U16(skb, IPVS_DEST_ATTR_PORT, dest->port);
77402
77403 NLA_PUT_U32(skb, IPVS_DEST_ATTR_FWD_METHOD,
77404- atomic_read(&dest->conn_flags) & IP_VS_CONN_F_FWD_MASK);
77405+ atomic_read_unchecked(&dest->conn_flags) & IP_VS_CONN_F_FWD_MASK);
77406 NLA_PUT_U32(skb, IPVS_DEST_ATTR_WEIGHT, atomic_read(&dest->weight));
77407 NLA_PUT_U32(skb, IPVS_DEST_ATTR_U_THRESH, dest->u_threshold);
77408 NLA_PUT_U32(skb, IPVS_DEST_ATTR_L_THRESH, dest->l_threshold);
77409diff -urNp linux-2.6.39/net/netfilter/ipvs/ip_vs_sync.c linux-2.6.39/net/netfilter/ipvs/ip_vs_sync.c
77410--- linux-2.6.39/net/netfilter/ipvs/ip_vs_sync.c 2011-05-19 00:06:34.000000000 -0400
77411+++ linux-2.6.39/net/netfilter/ipvs/ip_vs_sync.c 2011-05-22 19:36:34.000000000 -0400
77412@@ -648,7 +648,7 @@ control:
77413 * i.e only increment in_pkts for Templates.
77414 */
77415 if (cp->flags & IP_VS_CONN_F_TEMPLATE) {
77416- int pkts = atomic_add_return(1, &cp->in_pkts);
77417+ int pkts = atomic_add_return_unchecked(1, &cp->in_pkts);
77418
77419 if (pkts % sysctl_sync_period(ipvs) != 1)
77420 return;
77421@@ -794,7 +794,7 @@ static void ip_vs_proc_conn(struct net *
77422
77423 if (opt)
77424 memcpy(&cp->in_seq, opt, sizeof(*opt));
77425- atomic_set(&cp->in_pkts, sysctl_sync_threshold(ipvs));
77426+ atomic_set_unchecked(&cp->in_pkts, sysctl_sync_threshold(ipvs));
77427 cp->state = state;
77428 cp->old_state = cp->state;
77429 /*
77430diff -urNp linux-2.6.39/net/netfilter/ipvs/ip_vs_xmit.c linux-2.6.39/net/netfilter/ipvs/ip_vs_xmit.c
77431--- linux-2.6.39/net/netfilter/ipvs/ip_vs_xmit.c 2011-05-19 00:06:34.000000000 -0400
77432+++ linux-2.6.39/net/netfilter/ipvs/ip_vs_xmit.c 2011-05-22 19:36:34.000000000 -0400
77433@@ -1127,7 +1127,7 @@ ip_vs_icmp_xmit(struct sk_buff *skb, str
77434 else
77435 rc = NF_ACCEPT;
77436 /* do not touch skb anymore */
77437- atomic_inc(&cp->in_pkts);
77438+ atomic_inc_unchecked(&cp->in_pkts);
77439 goto out;
77440 }
77441
77442@@ -1245,7 +1245,7 @@ ip_vs_icmp_xmit_v6(struct sk_buff *skb,
77443 else
77444 rc = NF_ACCEPT;
77445 /* do not touch skb anymore */
77446- atomic_inc(&cp->in_pkts);
77447+ atomic_inc_unchecked(&cp->in_pkts);
77448 goto out;
77449 }
77450
77451diff -urNp linux-2.6.39/net/netfilter/Kconfig linux-2.6.39/net/netfilter/Kconfig
77452--- linux-2.6.39/net/netfilter/Kconfig 2011-05-19 00:06:34.000000000 -0400
77453+++ linux-2.6.39/net/netfilter/Kconfig 2011-05-22 19:41:42.000000000 -0400
77454@@ -781,6 +781,16 @@ config NETFILTER_XT_MATCH_ESP
77455
77456 To compile it as a module, choose M here. If unsure, say N.
77457
77458+config NETFILTER_XT_MATCH_GRADM
77459+ tristate '"gradm" match support'
77460+ depends on NETFILTER_XTABLES && NETFILTER_ADVANCED
77461+ depends on GRKERNSEC && !GRKERNSEC_NO_RBAC
77462+ ---help---
77463+ The gradm match allows to match on grsecurity RBAC being enabled.
77464+ It is useful when iptables rules are applied early on bootup to
77465+ prevent connections to the machine (except from a trusted host)
77466+ while the RBAC system is disabled.
77467+
77468 config NETFILTER_XT_MATCH_HASHLIMIT
77469 tristate '"hashlimit" match support'
77470 depends on (IP6_NF_IPTABLES || IP6_NF_IPTABLES=n)
77471diff -urNp linux-2.6.39/net/netfilter/Makefile linux-2.6.39/net/netfilter/Makefile
77472--- linux-2.6.39/net/netfilter/Makefile 2011-05-19 00:06:34.000000000 -0400
77473+++ linux-2.6.39/net/netfilter/Makefile 2011-05-22 20:40:16.000000000 -0400
77474@@ -81,6 +81,7 @@ obj-$(CONFIG_NETFILTER_XT_MATCH_DCCP) +=
77475 obj-$(CONFIG_NETFILTER_XT_MATCH_DEVGROUP) += xt_devgroup.o
77476 obj-$(CONFIG_NETFILTER_XT_MATCH_DSCP) += xt_dscp.o
77477 obj-$(CONFIG_NETFILTER_XT_MATCH_ESP) += xt_esp.o
77478+obj-$(CONFIG_NETFILTER_XT_MATCH_GRADM) += xt_gradm.o
77479 obj-$(CONFIG_NETFILTER_XT_MATCH_HASHLIMIT) += xt_hashlimit.o
77480 obj-$(CONFIG_NETFILTER_XT_MATCH_HELPER) += xt_helper.o
77481 obj-$(CONFIG_NETFILTER_XT_MATCH_HL) += xt_hl.o
77482diff -urNp linux-2.6.39/net/netfilter/nfnetlink_log.c linux-2.6.39/net/netfilter/nfnetlink_log.c
77483--- linux-2.6.39/net/netfilter/nfnetlink_log.c 2011-05-19 00:06:34.000000000 -0400
77484+++ linux-2.6.39/net/netfilter/nfnetlink_log.c 2011-05-22 19:36:35.000000000 -0400
77485@@ -70,7 +70,7 @@ struct nfulnl_instance {
77486 };
77487
77488 static DEFINE_SPINLOCK(instances_lock);
77489-static atomic_t global_seq;
77490+static atomic_unchecked_t global_seq;
77491
77492 #define INSTANCE_BUCKETS 16
77493 static struct hlist_head instance_table[INSTANCE_BUCKETS];
77494@@ -506,7 +506,7 @@ __build_packet_message(struct nfulnl_ins
77495 /* global sequence number */
77496 if (inst->flags & NFULNL_CFG_F_SEQ_GLOBAL)
77497 NLA_PUT_BE32(inst->skb, NFULA_SEQ_GLOBAL,
77498- htonl(atomic_inc_return(&global_seq)));
77499+ htonl(atomic_inc_return_unchecked(&global_seq)));
77500
77501 if (data_len) {
77502 struct nlattr *nla;
77503diff -urNp linux-2.6.39/net/netfilter/nfnetlink_queue.c linux-2.6.39/net/netfilter/nfnetlink_queue.c
77504--- linux-2.6.39/net/netfilter/nfnetlink_queue.c 2011-05-19 00:06:34.000000000 -0400
77505+++ linux-2.6.39/net/netfilter/nfnetlink_queue.c 2011-05-22 19:36:35.000000000 -0400
77506@@ -58,7 +58,7 @@ struct nfqnl_instance {
77507 */
77508 spinlock_t lock;
77509 unsigned int queue_total;
77510- atomic_t id_sequence; /* 'sequence' of pkt ids */
77511+ atomic_unchecked_t id_sequence; /* 'sequence' of pkt ids */
77512 struct list_head queue_list; /* packets in queue */
77513 };
77514
77515@@ -272,7 +272,7 @@ nfqnl_build_packet_message(struct nfqnl_
77516 nfmsg->version = NFNETLINK_V0;
77517 nfmsg->res_id = htons(queue->queue_num);
77518
77519- entry->id = atomic_inc_return(&queue->id_sequence);
77520+ entry->id = atomic_inc_return_unchecked(&queue->id_sequence);
77521 pmsg.packet_id = htonl(entry->id);
77522 pmsg.hw_protocol = entskb->protocol;
77523 pmsg.hook = entry->hook;
77524@@ -869,7 +869,7 @@ static int seq_show(struct seq_file *s,
77525 inst->peer_pid, inst->queue_total,
77526 inst->copy_mode, inst->copy_range,
77527 inst->queue_dropped, inst->queue_user_dropped,
77528- atomic_read(&inst->id_sequence), 1);
77529+ atomic_read_unchecked(&inst->id_sequence), 1);
77530 }
77531
77532 static const struct seq_operations nfqnl_seq_ops = {
77533diff -urNp linux-2.6.39/net/netfilter/xt_gradm.c linux-2.6.39/net/netfilter/xt_gradm.c
77534--- linux-2.6.39/net/netfilter/xt_gradm.c 1969-12-31 19:00:00.000000000 -0500
77535+++ linux-2.6.39/net/netfilter/xt_gradm.c 2011-05-22 19:41:42.000000000 -0400
77536@@ -0,0 +1,51 @@
77537+/*
77538+ * gradm match for netfilter
77539